Commit | Line | Data |
---|---|---|
3fda4c61 EB |
1 | // SPDX-License-Identifier: GPL-2.0 |
2 | /* | |
3 | * fs/verity/enable.c: ioctl to enable verity on a file | |
4 | * | |
5 | * Copyright 2019 Google LLC | |
6 | */ | |
7 | ||
8 | #include "fsverity_private.h" | |
9 | ||
10 | #include <crypto/hash.h> | |
fd39073d | 11 | #include <linux/backing-dev.h> |
3fda4c61 EB |
12 | #include <linux/mount.h> |
13 | #include <linux/pagemap.h> | |
14 | #include <linux/sched/signal.h> | |
15 | #include <linux/uaccess.h> | |
16 | ||
c22415d3 EB |
17 | /* |
18 | * Read a file data page for Merkle tree construction. Do aggressive readahead, | |
19 | * since we're sequentially reading the entire file. | |
20 | */ | |
21 | static struct page *read_file_data_page(struct file *filp, pgoff_t index, | |
22 | struct file_ra_state *ra, | |
23 | unsigned long remaining_pages) | |
24 | { | |
25 | struct page *page; | |
26 | ||
27 | page = find_get_page_flags(filp->f_mapping, index, FGP_ACCESSED); | |
28 | if (!page || !PageUptodate(page)) { | |
29 | if (page) | |
30 | put_page(page); | |
31 | else | |
32 | page_cache_sync_readahead(filp->f_mapping, ra, filp, | |
33 | index, remaining_pages); | |
34 | page = read_mapping_page(filp->f_mapping, index, NULL); | |
35 | if (IS_ERR(page)) | |
36 | return page; | |
37 | } | |
38 | if (PageReadahead(page)) | |
39 | page_cache_async_readahead(filp->f_mapping, ra, filp, page, | |
40 | index, remaining_pages); | |
41 | return page; | |
42 | } | |
43 | ||
44 | static int build_merkle_tree_level(struct file *filp, unsigned int level, | |
3fda4c61 EB |
45 | u64 num_blocks_to_hash, |
46 | const struct merkle_tree_params *params, | |
47 | u8 *pending_hashes, | |
48 | struct ahash_request *req) | |
49 | { | |
c22415d3 | 50 | struct inode *inode = file_inode(filp); |
3fda4c61 | 51 | const struct fsverity_operations *vops = inode->i_sb->s_vop; |
c22415d3 | 52 | struct file_ra_state ra = { 0 }; |
3fda4c61 EB |
53 | unsigned int pending_size = 0; |
54 | u64 dst_block_num; | |
55 | u64 i; | |
56 | int err; | |
57 | ||
58 | if (WARN_ON(params->block_size != PAGE_SIZE)) /* checked earlier too */ | |
59 | return -EINVAL; | |
60 | ||
61 | if (level < params->num_levels) { | |
62 | dst_block_num = params->level_start[level]; | |
63 | } else { | |
64 | if (WARN_ON(num_blocks_to_hash != 1)) | |
65 | return -EINVAL; | |
66 | dst_block_num = 0; /* unused */ | |
67 | } | |
68 | ||
c22415d3 EB |
69 | file_ra_state_init(&ra, filp->f_mapping); |
70 | ||
3fda4c61 EB |
71 | for (i = 0; i < num_blocks_to_hash; i++) { |
72 | struct page *src_page; | |
73 | ||
74 | if ((pgoff_t)i % 10000 == 0 || i + 1 == num_blocks_to_hash) | |
75 | pr_debug("Hashing block %llu of %llu for level %u\n", | |
76 | i + 1, num_blocks_to_hash, level); | |
77 | ||
78 | if (level == 0) { | |
79 | /* Leaf: hashing a data block */ | |
c22415d3 EB |
80 | src_page = read_file_data_page(filp, i, &ra, |
81 | num_blocks_to_hash - i); | |
3fda4c61 EB |
82 | if (IS_ERR(src_page)) { |
83 | err = PTR_ERR(src_page); | |
84 | fsverity_err(inode, | |
85 | "Error %d reading data page %llu", | |
86 | err, i); | |
87 | return err; | |
88 | } | |
89 | } else { | |
fd39073d EB |
90 | unsigned long num_ra_pages = |
91 | min_t(unsigned long, num_blocks_to_hash - i, | |
92 | inode->i_sb->s_bdi->io_pages); | |
93 | ||
3fda4c61 EB |
94 | /* Non-leaf: hashing hash block from level below */ |
95 | src_page = vops->read_merkle_tree_page(inode, | |
fd39073d EB |
96 | params->level_start[level - 1] + i, |
97 | num_ra_pages); | |
3fda4c61 EB |
98 | if (IS_ERR(src_page)) { |
99 | err = PTR_ERR(src_page); | |
100 | fsverity_err(inode, | |
101 | "Error %d reading Merkle tree page %llu", | |
102 | err, params->level_start[level - 1] + i); | |
103 | return err; | |
104 | } | |
105 | } | |
106 | ||
107 | err = fsverity_hash_page(params, inode, req, src_page, | |
108 | &pending_hashes[pending_size]); | |
109 | put_page(src_page); | |
110 | if (err) | |
111 | return err; | |
112 | pending_size += params->digest_size; | |
113 | ||
114 | if (level == params->num_levels) /* Root hash? */ | |
115 | return 0; | |
116 | ||
117 | if (pending_size + params->digest_size > params->block_size || | |
118 | i + 1 == num_blocks_to_hash) { | |
119 | /* Flush the pending hash block */ | |
120 | memset(&pending_hashes[pending_size], 0, | |
121 | params->block_size - pending_size); | |
122 | err = vops->write_merkle_tree_block(inode, | |
123 | pending_hashes, | |
124 | dst_block_num, | |
125 | params->log_blocksize); | |
126 | if (err) { | |
127 | fsverity_err(inode, | |
128 | "Error %d writing Merkle tree block %llu", | |
129 | err, dst_block_num); | |
130 | return err; | |
131 | } | |
132 | dst_block_num++; | |
133 | pending_size = 0; | |
134 | } | |
135 | ||
136 | if (fatal_signal_pending(current)) | |
137 | return -EINTR; | |
138 | cond_resched(); | |
139 | } | |
140 | return 0; | |
141 | } | |
142 | ||
143 | /* | |
c22415d3 | 144 | * Build the Merkle tree for the given file using the given parameters, and |
3fda4c61 EB |
145 | * return the root hash in @root_hash. |
146 | * | |
147 | * The tree is written to a filesystem-specific location as determined by the | |
148 | * ->write_merkle_tree_block() method. However, the blocks that comprise the | |
149 | * tree are the same for all filesystems. | |
150 | */ | |
c22415d3 | 151 | static int build_merkle_tree(struct file *filp, |
3fda4c61 EB |
152 | const struct merkle_tree_params *params, |
153 | u8 *root_hash) | |
154 | { | |
c22415d3 | 155 | struct inode *inode = file_inode(filp); |
3fda4c61 EB |
156 | u8 *pending_hashes; |
157 | struct ahash_request *req; | |
158 | u64 blocks; | |
159 | unsigned int level; | |
160 | int err = -ENOMEM; | |
161 | ||
162 | if (inode->i_size == 0) { | |
163 | /* Empty file is a special case; root hash is all 0's */ | |
164 | memset(root_hash, 0, params->digest_size); | |
165 | return 0; | |
166 | } | |
167 | ||
439bea10 EB |
168 | /* This allocation never fails, since it's mempool-backed. */ |
169 | req = fsverity_alloc_hash_request(params->hash_alg, GFP_KERNEL); | |
170 | ||
3fda4c61 | 171 | pending_hashes = kmalloc(params->block_size, GFP_KERNEL); |
439bea10 | 172 | if (!pending_hashes) |
3fda4c61 EB |
173 | goto out; |
174 | ||
175 | /* | |
176 | * Build each level of the Merkle tree, starting at the leaf level | |
177 | * (level 0) and ascending to the root node (level 'num_levels - 1'). | |
178 | * Then at the end (level 'num_levels'), calculate the root hash. | |
179 | */ | |
180 | blocks = (inode->i_size + params->block_size - 1) >> | |
181 | params->log_blocksize; | |
182 | for (level = 0; level <= params->num_levels; level++) { | |
c22415d3 | 183 | err = build_merkle_tree_level(filp, level, blocks, params, |
3fda4c61 EB |
184 | pending_hashes, req); |
185 | if (err) | |
186 | goto out; | |
187 | blocks = (blocks + params->hashes_per_block - 1) >> | |
188 | params->log_arity; | |
189 | } | |
190 | memcpy(root_hash, pending_hashes, params->digest_size); | |
191 | err = 0; | |
192 | out: | |
193 | kfree(pending_hashes); | |
439bea10 | 194 | fsverity_free_hash_request(params->hash_alg, req); |
3fda4c61 EB |
195 | return err; |
196 | } | |
197 | ||
198 | static int enable_verity(struct file *filp, | |
199 | const struct fsverity_enable_arg *arg) | |
200 | { | |
201 | struct inode *inode = file_inode(filp); | |
202 | const struct fsverity_operations *vops = inode->i_sb->s_vop; | |
203 | struct merkle_tree_params params = { }; | |
204 | struct fsverity_descriptor *desc; | |
432434c9 | 205 | size_t desc_size = sizeof(*desc) + arg->sig_size; |
3fda4c61 EB |
206 | struct fsverity_info *vi; |
207 | int err; | |
208 | ||
209 | /* Start initializing the fsverity_descriptor */ | |
210 | desc = kzalloc(desc_size, GFP_KERNEL); | |
211 | if (!desc) | |
212 | return -ENOMEM; | |
213 | desc->version = 1; | |
214 | desc->hash_algorithm = arg->hash_algorithm; | |
215 | desc->log_blocksize = ilog2(arg->block_size); | |
216 | ||
217 | /* Get the salt if the user provided one */ | |
218 | if (arg->salt_size && | |
da3a3da4 | 219 | copy_from_user(desc->salt, u64_to_user_ptr(arg->salt_ptr), |
3fda4c61 EB |
220 | arg->salt_size)) { |
221 | err = -EFAULT; | |
222 | goto out; | |
223 | } | |
224 | desc->salt_size = arg->salt_size; | |
225 | ||
432434c9 EB |
226 | /* Get the signature if the user provided one */ |
227 | if (arg->sig_size && | |
da3a3da4 | 228 | copy_from_user(desc->signature, u64_to_user_ptr(arg->sig_ptr), |
432434c9 EB |
229 | arg->sig_size)) { |
230 | err = -EFAULT; | |
231 | goto out; | |
232 | } | |
233 | desc->sig_size = cpu_to_le32(arg->sig_size); | |
234 | ||
3fda4c61 EB |
235 | desc->data_size = cpu_to_le64(inode->i_size); |
236 | ||
237 | /* Prepare the Merkle tree parameters */ | |
238 | err = fsverity_init_merkle_tree_params(¶ms, inode, | |
239 | arg->hash_algorithm, | |
240 | desc->log_blocksize, | |
241 | desc->salt, desc->salt_size); | |
242 | if (err) | |
243 | goto out; | |
244 | ||
245 | /* | |
246 | * Start enabling verity on this file, serialized by the inode lock. | |
247 | * Fail if verity is already enabled or is already being enabled. | |
248 | */ | |
249 | inode_lock(inode); | |
250 | if (IS_VERITY(inode)) | |
251 | err = -EEXIST; | |
252 | else | |
253 | err = vops->begin_enable_verity(filp); | |
254 | inode_unlock(inode); | |
255 | if (err) | |
256 | goto out; | |
257 | ||
258 | /* | |
259 | * Build the Merkle tree. Don't hold the inode lock during this, since | |
260 | * on huge files this may take a very long time and we don't want to | |
261 | * force unrelated syscalls like chown() to block forever. We don't | |
262 | * need the inode lock here because deny_write_access() already prevents | |
263 | * the file from being written to or truncated, and we still serialize | |
264 | * ->begin_enable_verity() and ->end_enable_verity() using the inode | |
265 | * lock and only allow one process to be here at a time on a given file. | |
266 | */ | |
267 | pr_debug("Building Merkle tree...\n"); | |
268 | BUILD_BUG_ON(sizeof(desc->root_hash) < FS_VERITY_MAX_DIGEST_SIZE); | |
c22415d3 | 269 | err = build_merkle_tree(filp, ¶ms, desc->root_hash); |
3fda4c61 EB |
270 | if (err) { |
271 | fsverity_err(inode, "Error %d building Merkle tree", err); | |
272 | goto rollback; | |
273 | } | |
274 | pr_debug("Done building Merkle tree. Root hash is %s:%*phN\n", | |
275 | params.hash_alg->name, params.digest_size, desc->root_hash); | |
276 | ||
277 | /* | |
278 | * Create the fsverity_info. Don't bother trying to save work by | |
279 | * reusing the merkle_tree_params from above. Instead, just create the | |
280 | * fsverity_info from the fsverity_descriptor as if it were just loaded | |
281 | * from disk. This is simpler, and it serves as an extra check that the | |
282 | * metadata we're writing is valid before actually enabling verity. | |
283 | */ | |
284 | vi = fsverity_create_info(inode, desc, desc_size); | |
285 | if (IS_ERR(vi)) { | |
286 | err = PTR_ERR(vi); | |
287 | goto rollback; | |
288 | } | |
289 | ||
432434c9 EB |
290 | if (arg->sig_size) |
291 | pr_debug("Storing a %u-byte PKCS#7 signature alongside the file\n", | |
292 | arg->sig_size); | |
293 | ||
3fda4c61 EB |
294 | /* |
295 | * Tell the filesystem to finish enabling verity on the file. | |
296 | * Serialized with ->begin_enable_verity() by the inode lock. | |
297 | */ | |
298 | inode_lock(inode); | |
299 | err = vops->end_enable_verity(filp, desc, desc_size, params.tree_size); | |
300 | inode_unlock(inode); | |
301 | if (err) { | |
302 | fsverity_err(inode, "%ps() failed with err %d", | |
303 | vops->end_enable_verity, err); | |
304 | fsverity_free_info(vi); | |
305 | } else if (WARN_ON(!IS_VERITY(inode))) { | |
306 | err = -EINVAL; | |
307 | fsverity_free_info(vi); | |
308 | } else { | |
309 | /* Successfully enabled verity */ | |
310 | ||
311 | /* | |
312 | * Readers can start using ->i_verity_info immediately, so it | |
313 | * can't be rolled back once set. So don't set it until just | |
314 | * after the filesystem has successfully enabled verity. | |
315 | */ | |
316 | fsverity_set_info(inode, vi); | |
317 | } | |
318 | out: | |
319 | kfree(params.hashstate); | |
320 | kfree(desc); | |
321 | return err; | |
322 | ||
323 | rollback: | |
324 | inode_lock(inode); | |
325 | (void)vops->end_enable_verity(filp, NULL, 0, params.tree_size); | |
326 | inode_unlock(inode); | |
327 | goto out; | |
328 | } | |
329 | ||
330 | /** | |
331 | * fsverity_ioctl_enable() - enable verity on a file | |
332 | * | |
333 | * Enable fs-verity on a file. See the "FS_IOC_ENABLE_VERITY" section of | |
334 | * Documentation/filesystems/fsverity.rst for the documentation. | |
335 | * | |
336 | * Return: 0 on success, -errno on failure | |
337 | */ | |
338 | int fsverity_ioctl_enable(struct file *filp, const void __user *uarg) | |
339 | { | |
340 | struct inode *inode = file_inode(filp); | |
341 | struct fsverity_enable_arg arg; | |
342 | int err; | |
343 | ||
344 | if (copy_from_user(&arg, uarg, sizeof(arg))) | |
345 | return -EFAULT; | |
346 | ||
347 | if (arg.version != 1) | |
348 | return -EINVAL; | |
349 | ||
350 | if (arg.__reserved1 || | |
351 | memchr_inv(arg.__reserved2, 0, sizeof(arg.__reserved2))) | |
352 | return -EINVAL; | |
353 | ||
354 | if (arg.block_size != PAGE_SIZE) | |
355 | return -EINVAL; | |
356 | ||
c593642c | 357 | if (arg.salt_size > sizeof_field(struct fsverity_descriptor, salt)) |
3fda4c61 EB |
358 | return -EMSGSIZE; |
359 | ||
432434c9 EB |
360 | if (arg.sig_size > FS_VERITY_MAX_SIGNATURE_SIZE) |
361 | return -EMSGSIZE; | |
3fda4c61 EB |
362 | |
363 | /* | |
364 | * Require a regular file with write access. But the actual fd must | |
365 | * still be readonly so that we can lock out all writers. This is | |
366 | * needed to guarantee that no writable fds exist to the file once it | |
367 | * has verity enabled, and to stabilize the data being hashed. | |
368 | */ | |
369 | ||
370 | err = inode_permission(inode, MAY_WRITE); | |
371 | if (err) | |
372 | return err; | |
373 | ||
374 | if (IS_APPEND(inode)) | |
375 | return -EPERM; | |
376 | ||
377 | if (S_ISDIR(inode->i_mode)) | |
378 | return -EISDIR; | |
379 | ||
380 | if (!S_ISREG(inode->i_mode)) | |
381 | return -EINVAL; | |
382 | ||
383 | err = mnt_want_write_file(filp); | |
384 | if (err) /* -EROFS */ | |
385 | return err; | |
386 | ||
387 | err = deny_write_access(filp); | |
388 | if (err) /* -ETXTBSY */ | |
389 | goto out_drop_write; | |
390 | ||
391 | err = enable_verity(filp, &arg); | |
392 | if (err) | |
393 | goto out_allow_write_access; | |
394 | ||
395 | /* | |
396 | * Some pages of the file may have been evicted from pagecache after | |
397 | * being used in the Merkle tree construction, then read into pagecache | |
398 | * again by another process reading from the file concurrently. Since | |
399 | * these pages didn't undergo verification against the file measurement | |
400 | * which fs-verity now claims to be enforcing, we have to wipe the | |
401 | * pagecache to ensure that all future reads are verified. | |
402 | */ | |
403 | filemap_write_and_wait(inode->i_mapping); | |
404 | invalidate_inode_pages2(inode->i_mapping); | |
405 | ||
406 | /* | |
407 | * allow_write_access() is needed to pair with deny_write_access(). | |
408 | * Regardless, the filesystem won't allow writing to verity files. | |
409 | */ | |
410 | out_allow_write_access: | |
411 | allow_write_access(filp); | |
412 | out_drop_write: | |
413 | mnt_drop_write_file(filp); | |
414 | return err; | |
415 | } | |
416 | EXPORT_SYMBOL_GPL(fsverity_ioctl_enable); |