From f0e0176eb40851a543ba07fd4fb334df6688219f Mon Sep 17 00:00:00 2001 From: James Simmons Date: Thu, 10 Apr 2025 10:46:03 -0400 Subject: [PATCH] LU-15420 sec: handle fscrypt_require_key removal in newer kernels Kernel commit de3cdc6e75179a2324c moved fscrypt_require_key() to the fscrypt_private.h which makes it no longer visible. With this change move to fscrypt_has_encryption_key() which existed for some time. Once difference is fscrypt_has_encryption_key() reports success when the inode has no encryption so we need to test IS_ENCRYPT(inode) as well. Expand the ll_has_encryption_key() to also test for IS_ENCRYPT since this is the most common use case. Update LLCRYPT_FNAME_DIGEST to LLCRYPT_EXTRACT_DIGEST for mdd layer. Test-Parameters: trivial testlist=sanity-sec Change-Id: I402f222f635e7c0f026c53093bb17ec4d461e189 Signed-off-by: James Simmons Reviewed-on: https://review.whamcloud.com/c/fs/lustre-release/+/57754 Tested-by: Maloo Tested-by: jenkins Reviewed-by: Sebastien Buisson Reviewed-by: Shaun Tancheff Reviewed-by: Oleg Drokin --- lustre/include/lustre_crypto.h | 7 ++----- lustre/llite/crypto.c | 4 ---- lustre/llite/dir.c | 6 ++++-- lustre/llite/file.c | 7 ++++--- lustre/llite/llite_lib.c | 4 ++-- lustre/llite/pcc.c | 2 +- lustre/mdd/mdd_dir.c | 2 +- lustre/tests/sanity-sec.sh | 6 +++++- 8 files changed, 19 insertions(+), 19 deletions(-) diff --git a/lustre/include/lustre_crypto.h b/lustre/include/lustre_crypto.h index 885eeac..17bf87c 100644 --- a/lustre/include/lustre_crypto.h +++ b/lustre/include/lustre_crypto.h @@ -43,9 +43,8 @@ #else int llcrypt_d_revalidate(struct dentry *dentry, unsigned int flags); #endif -#define llcrypt_require_key(inode) \ - fscrypt_require_key(inode) -#define llcrypt_has_encryption_key(inode) fscrypt_has_encryption_key(inode) +#define llcrypt_has_encryption_key(inode) \ + fscrypt_has_encryption_key(inode) #define llcrypt_encrypt_pagecache_blocks(page, len, offs, gfp_flags) \ fscrypt_encrypt_pagecache_blocks(page, len, offs, gfp_flags) #define llcrypt_decrypt_pagecache_blocks(page, len, offs) \ @@ -254,8 +253,6 @@ static inline int critical_decode(const u8 *src, int len, char *dst) */ #define S_PCCCOPY S_DIRSYNC #define IS_PCCCOPY(inode) ((inode)->i_flags & S_PCCCOPY) -#define ll_require_key(inode) \ - (IS_PCCCOPY(inode) ? -ENOKEY : llcrypt_require_key(inode)) #define ll_has_encryption_key(inode) \ (IS_PCCCOPY(inode) ? false : llcrypt_has_encryption_key(inode)) diff --git a/lustre/llite/crypto.c b/lustre/llite/crypto.c index 11824d5..1d459ca 100644 --- a/lustre/llite/crypto.c +++ b/lustre/llite/crypto.c @@ -670,10 +670,6 @@ int ll_file_open_encrypt(struct inode *inode, struct file *filp) return llcrypt_file_open(inode, filp); } -void llcrypt_free_ctx(void *encctx, __u32 size) -{ -} - bool ll_sb_has_test_dummy_encryption(struct super_block *sb) { return false; diff --git a/lustre/llite/dir.c b/lustre/llite/dir.c index 36dbfaa..09346e3 100644 --- a/lustre/llite/dir.c +++ b/lustre/llite/dir.c @@ -2420,7 +2420,8 @@ out_rmdir: st.st_uid = body->mbo_uid; st.st_gid = body->mbo_gid; st.st_rdev = body->mbo_rdev; - if (ll_require_key(inode) == -ENOKEY) + if (IS_ENCRYPTED(inode) && + !ll_has_encryption_key(inode)) st.st_size = round_up(st.st_size, LUSTRE_ENCRYPTION_UNIT_SIZE); else @@ -2447,7 +2448,8 @@ out_rmdir: stx.stx_mode = body->mbo_mode; stx.stx_ino = cl_fid_build_ino(&body->mbo_fid1, api32); - if (ll_require_key(inode) == -ENOKEY) + if (IS_ENCRYPTED(inode) && + !ll_has_encryption_key(inode)) stx.stx_size = round_up(stx.stx_size, LUSTRE_ENCRYPTION_UNIT_SIZE); else diff --git a/lustre/llite/file.c b/lustre/llite/file.c index b3163cb..ca812e7 100644 --- a/lustre/llite/file.c +++ b/lustre/llite/file.c @@ -96,7 +96,7 @@ static void ll_prepare_close(struct inode *inode, struct md_op_data *op_data, * stored into lli_lazysize in ll_merge_attr(), so set proper file size * now that we are closing. */ - if (ll_require_key(inode) == -ENOKEY && + if (IS_ENCRYPTED(inode) && !ll_has_encryption_key(inode) && ll_i2info(inode)->lli_attr_valid & OBD_MD_FLLAZYSIZE) { op_data->op_attr.ia_size = ll_i2info(inode)->lli_lazysize; if (IS_PCCCOPY(inode)) { @@ -1683,7 +1683,7 @@ static int ll_merge_attr_nolock(const struct lu_env *env, struct inode *inode) CDEBUG(D_VFSTRACE, DFID" updating i_size %llu i_blocks %llu\n", PFID(&lli->lli_fid), attr->cat_size, attr->cat_blocks); - if (ll_require_key(inode) == -ENOKEY) { + if (IS_ENCRYPTED(inode) && !ll_has_encryption_key(inode)) { /* Without the key, round up encrypted file size to next * LUSTRE_ENCRYPTION_UNIT_SIZE. Clear text size is put in * lli_lazysize for proper file size setting at close time. @@ -5195,7 +5195,8 @@ static loff_t ll_lseek(struct file *file, loff_t offset, int whence) /* Without the key, SEEK_HOLE return value has to be * rounded up to next LUSTRE_ENCRYPTION_UNIT_SIZE. */ - if (ll_require_key(inode) == -ENOKEY && whence == SEEK_HOLE) + if (IS_ENCRYPTED(inode) && !ll_has_encryption_key(inode) && + whence == SEEK_HOLE) retval = round_up(retval, LUSTRE_ENCRYPTION_UNIT_SIZE); RETURN(retval); diff --git a/lustre/llite/llite_lib.c b/lustre/llite/llite_lib.c index 386d5e7..91df3cf 100644 --- a/lustre/llite/llite_lib.c +++ b/lustre/llite/llite_lib.c @@ -2407,7 +2407,7 @@ int ll_setattr_raw(struct dentry *dentry, struct iattr *attr, if (filename_is_volatile(dentry->d_name.name, dentry->d_name.len, NULL) && - ll_require_key(inode) == -ENOKEY) { + !ll_has_encryption_key(inode)) { struct file *ref_file; struct inode *ref_inode; struct ll_inode_info *ref_lli; @@ -2883,7 +2883,7 @@ int ll_update_inode(struct inode *inode, struct lustre_md *md) * we will need it in ll_prepare_close(). */ if (lli->lli_attr_valid & OBD_MD_FLLAZYSIZE && lli->lli_lazysize && - ll_require_key(inode) == -ENOKEY) + IS_ENCRYPTED(inode) && !ll_has_encryption_key(inode)) lli->lli_attr_valid = body->mbo_valid | OBD_MD_FLLAZYSIZE; else lli->lli_attr_valid = body->mbo_valid; diff --git a/lustre/llite/pcc.c b/lustre/llite/pcc.c index 5213da6..c7a20be 100644 --- a/lustre/llite/pcc.c +++ b/lustre/llite/pcc.c @@ -1466,7 +1466,7 @@ static int pcc_encsize_xattr_set(struct pcc_inode *pcci) if (!IS_ENCRYPTED(inode)) RETURN(0); - if (ll_require_key(inode) == -ENOKEY && + if (!ll_has_encryption_key(inode) && pcci->pcci_lli->lli_attr_valid & OBD_MD_FLLAZYSIZE) size = pcci->pcci_lli->lli_lazysize; else diff --git a/lustre/mdd/mdd_dir.c b/lustre/mdd/mdd_dir.c index a70086f..dc4fc61 100644 --- a/lustre/mdd/mdd_dir.c +++ b/lustre/mdd/mdd_dir.c @@ -1223,7 +1223,7 @@ static int changelog_name2digest(const char *name, int namelen, digest->cdf_fid = *fid; memcpy(digest->cdf_excerpt, - LLCRYPT_FNAME_DIGEST(ln->ln_name, ln->ln_namelen), + LLCRYPT_EXTRACT_DIGEST(ln->ln_name, ln->ln_namelen), LL_CRYPTO_BLOCK_SIZE); p = (char *)digest; len = sizeof(*digest); diff --git a/lustre/tests/sanity-sec.sh b/lustre/tests/sanity-sec.sh index 09886a8..5885055 100755 --- a/lustre/tests/sanity-sec.sh +++ b/lustre/tests/sanity-sec.sh @@ -6553,6 +6553,7 @@ test_64f() { stack_trap cleanup_local_client_nodemap EXIT mkdir -p $DIR/$tdir || error "mkdir $DIR/$tdir failed" + echo "setup local client nodmap c0" setup_local_client_nodemap "c0" 1 1 yes | fscrypt setup --force --verbose || @@ -6561,6 +6562,7 @@ test_64f() { /etc/fscrypt.conf yes | fscrypt setup --verbose $MOUNT || echo "fscrypt setup $MOUNT already done" + echo "fscrypt for mount $MOUNT is ready for use" stack_trap "rm -rf $MOUNT/.fscrypt" # file_perms is required because fscrypt uses chmod/chown @@ -6569,16 +6571,18 @@ test_64f() { do_facet mgs $LCTL nodemap_modify --name c0 --property rbac \ --value $rbac || error "setting rbac $rbac failed (1)" + echo "waiting for nodemap file_perms and fscrypt to be modified" wait_nm_sync c0 rbac mkdir -p $vaultdir - set -vx echo -e 'mypass\nmypass' | fscrypt encrypt --verbose \ --source=custom_passphrase --name=protector_64 $vaultdir || error "fscrypt encrypt $vaultdir failed" fscrypt lock $vaultdir || error "fscrypt lock $vaultdir failed (1)" + echo "$vaultdir is locked away with encryption" policy=$(fscrypt status $vaultdir | awk '$1 == "Policy:"{print $2}') [ -n "$policy" ] || error "could not get enc policy" + echo "fscrypt policy $policy is ready" protector=$(fscrypt status $vaultdir | awk 'BEGIN {found=0} { if (found == 1) { print $1 }} \ $1 == "PROTECTOR" {found=1}') -- 1.8.3.1