linux.git/fs/ceph/dir.c, branch v6.6

ceph: switch ceph_lookup/atomic_open() to use new fscrypt helper

2023-08-24T09:24:37+00:00

Instead of setting the no-key dentry, use the new
fscrypt_prepare_lookup_partial() helper.  We still need to mark the
directory as incomplete if the directory was just unlocked.

In ceph_atomic_open() this fixes a bug where a dentry is incorrectly
set with DCACHE_NOKEY_NAME when 'dir' has been evicted but the key is
still available (for example, where there's a drop_caches).

Signed-off-by: Luís Henriques 
Reviewed-by: Xiubo Li 
Reviewed-by: Milind Changire 
Signed-off-by: Ilya Dryomov

ceph: prevent snapshot creation in encrypted locked directories

2023-08-24T09:24:36+00:00

With snapshot names encryption we can not allow snapshots to be created in
locked directories because the names wouldn't be encrypted.  This patch
forces the directory to be unlocked to allow a snapshot to be created.

Signed-off-by: Luís Henriques 
Reviewed-by: Jeff Layton 
Reviewed-by: Xiubo Li 
Reviewed-by: Milind Changire 
Signed-off-by: Ilya Dryomov

ceph: size handling in MClientRequest, cap updates and inode traces

2023-08-24T09:24:35+00:00

For encrypted inodes, transmit a rounded-up size to the MDS as the
normal file size and send the real inode size in fscrypt_file field.
Also, fix up creates and truncates to also transmit fscrypt_file.

When we get an inode trace from the MDS, grab the fscrypt_file field if
the inode is encrypted, and use it to populate the i_size field instead
of the regular inode size field.

Signed-off-by: Jeff Layton 
Reviewed-by: Xiubo Li 
Reviewed-and-tested-by: Luís Henriques 
Reviewed-by: Milind Changire 
Signed-off-by: Ilya Dryomov

ceph: mark directory as non-complete after loading key

2023-08-24T09:24:35+00:00

When setting a directory's crypt context, ceph_dir_clear_complete()
needs to be called otherwise if it was complete before, any existing
(old) dentry will still be valid.

This patch adds a wrapper around __fscrypt_prepare_readdir() which will
ensure a directory is marked as non-complete if key status changes.

[ xiubli: revise commit title per Milind ]

Signed-off-by: Luís Henriques 
Reviewed-by: Xiubo Li 
Reviewed-by: Milind Changire 
Signed-off-by: Ilya Dryomov

ceph: add some fscrypt guardrails

2023-08-24T09:24:35+00:00

Add the appropriate calls into fscrypt for various actions, including
link, rename, setattr, and the open codepaths.

Disable fallocate for encrypted inodes -- hopefully, just for now.

If we have an encrypted inode, then the client will need to re-encrypt
the contents of the new object. Disable copy offload to or from
encrypted inodes.

Set i_blkbits to crypto block size for encrypted inodes -- some of the
underlying infrastructure for fscrypt relies on i_blkbits being aligned
to crypto blocksize.

Report STATX_ATTR_ENCRYPTED on encrypted inodes.

[ lhenriques: forbid encryption with striped layouts ]

Signed-off-by: Jeff Layton 
Reviewed-by: Xiubo Li 
Reviewed-and-tested-by: Luís Henriques 
Reviewed-by: Milind Changire 
Signed-off-by: Ilya Dryomov

ceph: create symlinks with encrypted and base64-encoded targets

2023-08-24T09:24:35+00:00

When creating symlinks in encrypted directories, encrypt and
base64-encode the target with the new inode's key before sending to the
MDS.

When filling a symlinked inode, base64-decode it into a buffer that
we'll keep in ci->i_symlink. When get_link is called, decrypt the buffer
into a new one that will hang off i_link.

Signed-off-by: Jeff Layton 
Reviewed-by: Xiubo Li 
Reviewed-and-tested-by: Luís Henriques 
Reviewed-by: Milind Changire 
Signed-off-by: Ilya Dryomov

ceph: add support to readdir for encrypted names

2023-08-24T09:24:34+00:00

To make it simpler to decrypt names in a readdir reply (i.e. before
we have a dentry), add a new ceph_encode_encrypted_fname()-like helper
that takes a qstr pointer instead of a dentry pointer.

Once we've decrypted the names in a readdir reply, we no longer need the
crypttext, so overwrite them in ceph_mds_reply_dir_entry with the
unencrypted names. Then in both ceph_readdir_prepopulate() and
ceph_readdir() we will use the dencrypted name directly.

[ jlayton: convert some BUG_ONs into error returns ]

Signed-off-by: Xiubo Li 
Reviewed-by: Jeff Layton 
Reviewed-and-tested-by: Luís Henriques 
Reviewed-by: Milind Changire 
Signed-off-by: Ilya Dryomov

ceph: make d_revalidate call fscrypt revalidator for encrypted dentries

2023-08-24T09:24:34+00:00

If we have a dentry which represents a no-key name, then we need to test
whether the parent directory's encryption key has since been added.  Do
that before we test anything else about the dentry.

Signed-off-by: Jeff Layton 
Reviewed-by: Xiubo Li 
Reviewed-and-tested-by: Luís Henriques 
Reviewed-by: Milind Changire 
Signed-off-by: Ilya Dryomov

ceph: set DCACHE_NOKEY_NAME flag in ceph_lookup/atomic_open()

2023-08-24T09:24:34+00:00

This is required so that we know to invalidate these dentries when the
directory is unlocked.

Atomic open can act as a lookup if handed a dentry that is negative on
the MDS. Ensure that we set DCACHE_NOKEY_NAME on the dentry in
atomic_open, if we don't have the key for the parent. Otherwise, we can
end up validating the dentry inappropriately if someone later adds a
key.

Signed-off-by: Jeff Layton 
Reviewed-by: Xiubo Li 
Reviewed-and-tested-by: Luís Henriques 
Reviewed-by: Milind Changire 
Signed-off-by: Ilya Dryomov

ceph: preallocate inode for ops that may create one

2023-08-22T07:01:47+00:00

When creating a new inode, we need to determine the crypto context
before we can transmit the RPC. The fscrypt API has a routine for getting
a crypto context before a create occurs, but it requires an inode.

Change the ceph code to preallocate an inode in advance of a create of
any sort (open(), mknod(), symlink(), etc). Move the existing code that
generates the ACL and SELinux blobs into this routine since that's
mostly common across all the different codepaths.

In most cases, we just want to allow ceph_fill_trace to use that inode
after the reply comes in, so add a new field to the MDS request for it
(r_new_inode).

The async create codepath is a bit different though. In that case, we
want to hash the inode in advance of the RPC so that it can be used
before the reply comes in. If the call subsequently fails with
-EJUKEBOX, then just put the references and clean up the as_ctx. Note
that with this change, we now need to regenerate the as_ctx when this
occurs, but it's quite rare for it to happen.

Signed-off-by: Jeff Layton 
Reviewed-by: Xiubo Li 
Reviewed-and-tested-by: Luís Henriques 
Reviewed-by: Milind Changire 
Signed-off-by: Ilya Dryomov