Skip to content

Commit

Permalink
CRED: Wrap task credential accesses in the eCryptFS filesystem
Browse files Browse the repository at this point in the history 
Wrap access to task credentials so that they can be separated more easily from
the task_struct during the introduction of COW creds.

Change most current->(|e|s|fs)[ug]id to current_(|e|s|fs)[ug]id().

Change some task->e?[ug]id to task_e?[ug]id().  In some places it makes more
sense to use RCU directly rather than a convenient wrapper; these will be
addressed by later patches.

Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: James Morris <jmorris@namei.org>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Cc: Mike Halcrow <mhalcrow@us.ibm.com>
Cc: Phillip Hellewell <phillip@hellewell.homeip.net>
Cc: ecryptfs-devel@lists.sourceforge.net
Signed-off-by: James Morris <jmorris@namei.org>
  • Loading branch information
David Howells authored and James Morris committed Nov 13, 2008
1 parent ec4c2aa commit 4eea035
Show file tree
Hide file tree
Showing 2 changed files with 22 additions and 16 deletions.
18 changes: 10 additions & 8 deletions fs/ecryptfs/messaging.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -361,6 +361,7 @@ int ecryptfs_process_response(struct ecryptfs_message *msg, uid_t euid,
size_t msg_size;
struct nsproxy *nsproxy;
struct user_namespace *current_user_ns;
uid_t ctx_euid;
int rc;

if (msg->index >= ecryptfs_message_buf_len) {
Expand All @@ -385,23 +386,23 @@ int ecryptfs_process_response(struct ecryptfs_message *msg, uid_t euid,
goto wake_up;
}
current_user_ns = nsproxy->user_ns;
rc = ecryptfs_find_daemon_by_euid(&daemon, msg_ctx->task->euid,
current_user_ns);
ctx_euid = task_euid(msg_ctx->task);
rc = ecryptfs_find_daemon_by_euid(&daemon, ctx_euid, current_user_ns);
rcu_read_unlock();
mutex_unlock(&ecryptfs_daemon_hash_mux);
if (rc) {
rc = -EBADMSG;
printk(KERN_WARNING "%s: User [%d] received a "
"message response from process [0x%p] but does "
"not have a registered daemon\n", __func__,
msg_ctx->task->euid, pid);
ctx_euid, pid);
goto wake_up;
}
if (msg_ctx->task->euid != euid) {
if (ctx_euid != euid) {
rc = -EBADMSG;
printk(KERN_WARNING "%s: Received message from user "
"[%d]; expected message from user [%d]\n", __func__,
euid, msg_ctx->task->euid);
euid, ctx_euid);
goto unlock;
}
if (current_user_ns != user_ns) {
Expand All @@ -415,7 +416,7 @@ int ecryptfs_process_response(struct ecryptfs_message *msg, uid_t euid,
rc = -EBADMSG;
printk(KERN_ERR "%s: User [%d] sent a message response "
"from an unrecognized process [0x%p]\n",
__func__, msg_ctx->task->euid, pid);
__func__, ctx_euid, pid);
goto unlock;
}
if (msg_ctx->state != ECRYPTFS_MSG_CTX_STATE_PENDING) {
Expand Down Expand Up @@ -464,14 +465,15 @@ ecryptfs_send_message_locked(char *data, int data_len, u8 msg_type,
struct ecryptfs_msg_ctx **msg_ctx)
{
struct ecryptfs_daemon *daemon;
uid_t euid = current_euid();
int rc;

rc = ecryptfs_find_daemon_by_euid(&daemon, current->euid,
rc = ecryptfs_find_daemon_by_euid(&daemon, euid,
current->nsproxy->user_ns);
if (rc || !daemon) {
rc = -ENOTCONN;
printk(KERN_ERR "%s: User [%d] does not have a daemon "
"registered\n", __func__, current->euid);
"registered\n", __func__, euid);
goto out;
}
mutex_lock(&ecryptfs_msg_ctx_lists_mux);
Expand Down
20 changes: 12 additions & 8 deletions fs/ecryptfs/miscdev.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,11 +42,12 @@ ecryptfs_miscdev_poll(struct file *file, poll_table *pt)
{
struct ecryptfs_daemon *daemon;
unsigned int mask = 0;
uid_t euid = current_euid();
int rc;

mutex_lock(&ecryptfs_daemon_hash_mux);
/* TODO: Just use file->private_data? */
rc = ecryptfs_find_daemon_by_euid(&daemon, current->euid,
rc = ecryptfs_find_daemon_by_euid(&daemon, euid,
current->nsproxy->user_ns);
BUG_ON(rc || !daemon);
mutex_lock(&daemon->mux);
Expand Down Expand Up @@ -83,6 +84,7 @@ static int
ecryptfs_miscdev_open(struct inode *inode, struct file *file)
{
struct ecryptfs_daemon *daemon = NULL;
uid_t euid = current_euid();
int rc;

mutex_lock(&ecryptfs_daemon_hash_mux);
Expand All @@ -93,10 +95,10 @@ ecryptfs_miscdev_open(struct inode *inode, struct file *file)
"count; rc = [%d]\n", __func__, rc);
goto out_unlock_daemon_list;
}
rc = ecryptfs_find_daemon_by_euid(&daemon, current->euid,
rc = ecryptfs_find_daemon_by_euid(&daemon, euid,
current->nsproxy->user_ns);
if (rc || !daemon) {
rc = ecryptfs_spawn_daemon(&daemon, current->euid,
rc = ecryptfs_spawn_daemon(&daemon, euid,
current->nsproxy->user_ns,
task_pid(current));
if (rc) {
Expand Down Expand Up @@ -147,10 +149,11 @@ static int
ecryptfs_miscdev_release(struct inode *inode, struct file *file)
{
struct ecryptfs_daemon *daemon = NULL;
uid_t euid = current_euid();
int rc;

mutex_lock(&ecryptfs_daemon_hash_mux);
rc = ecryptfs_find_daemon_by_euid(&daemon, current->euid,
rc = ecryptfs_find_daemon_by_euid(&daemon, euid,
current->nsproxy->user_ns);
BUG_ON(rc || !daemon);
mutex_lock(&daemon->mux);
Expand Down Expand Up @@ -246,11 +249,12 @@ ecryptfs_miscdev_read(struct file *file, char __user *buf, size_t count,
char packet_length[3];
size_t i;
size_t total_length;
uid_t euid = current_euid();
int rc;

mutex_lock(&ecryptfs_daemon_hash_mux);
/* TODO: Just use file->private_data? */
rc = ecryptfs_find_daemon_by_euid(&daemon, current->euid,
rc = ecryptfs_find_daemon_by_euid(&daemon, euid,
current->nsproxy->user_ns);
BUG_ON(rc || !daemon);
mutex_lock(&daemon->mux);
Expand Down Expand Up @@ -290,7 +294,7 @@ ecryptfs_miscdev_read(struct file *file, char __user *buf, size_t count,
* message from the queue; try again */
goto check_list;
}
BUG_ON(current->euid != daemon->euid);
BUG_ON(euid != daemon->euid);
BUG_ON(current->nsproxy->user_ns != daemon->user_ns);
BUG_ON(task_pid(current) != daemon->pid);
msg_ctx = list_first_entry(&daemon->msg_ctx_out_queue,
Expand Down Expand Up @@ -414,6 +418,7 @@ ecryptfs_miscdev_write(struct file *file, const char __user *buf,
size_t packet_size, packet_size_length, i;
ssize_t sz = 0;
char *data;
uid_t euid = current_euid();
int rc;

if (count == 0)
Expand Down Expand Up @@ -463,8 +468,7 @@ ecryptfs_miscdev_write(struct file *file, const char __user *buf,
goto out_free;
}
rc = ecryptfs_miscdev_response(&data[i], packet_size,
current->euid,
current->nsproxy->user_ns,
euid, current->nsproxy->user_ns,
task_pid(current), seq);
if (rc)
printk(KERN_WARNING "%s: Failed to deliver miscdev "
Expand Down

0 comments on commit 4eea035

Please sign in to comment.