fs/verity/enable.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * fs/verity/enable.c: ioctl to enable verity on a file
   4  *
   5  * Copyright 2019 Google LLC
   6  */
   7
   8 #include "fsverity_private.h"
   9
  10 #include <crypto/hash.h>
  11 #include <linux/mount.h>
  12 #include <linux/pagemap.h>
  13 #include <linux/sched/signal.h>
  14 #include <linux/uaccess.h>
  15
  16 static int build_merkle_tree_level(struct inode *inode, unsigned int level,
  17                                    u64 num_blocks_to_hash,
  18                                    const struct merkle_tree_params *params,
  19                                    u8 *pending_hashes,
  20                                    struct ahash_request *req)
  21 {
  22         const struct fsverity_operations *vops = inode->i_sb->s_vop;
  23         unsigned int pending_size = 0;
  24         u64 dst_block_num;
  25         u64 i;
  26         int err;
  27
  28         if (WARN_ON(params->block_size != PAGE_SIZE)) /* checked earlier too */
  29                 return -EINVAL;
  30
  31         if (level < params->num_levels) {
  32                 dst_block_num = params->level_start[level];
  33         } else {
  34                 if (WARN_ON(num_blocks_to_hash != 1))
  35                         return -EINVAL;
  36                 dst_block_num = 0; /* unused */
  37         }
  38
  39         for (i = 0; i < num_blocks_to_hash; i++) {
  40                 struct page *src_page;
  41
  42                 if ((pgoff_t)i % 10000 == 0 || i + 1 == num_blocks_to_hash)
  43                         pr_debug("Hashing block %llu of %llu for level %u\n",
  44                                  i + 1, num_blocks_to_hash, level);
  45
  46                 if (level == 0) {
  47                         /* Leaf: hashing a data block */
  48                         src_page = read_mapping_page(inode->i_mapping, i, NULL);
  49                         if (IS_ERR(src_page)) {
  50                                 err = PTR_ERR(src_page);
  51                                 fsverity_err(inode,
  52                                              "Error %d reading data page %llu",
  53                                              err, i);
  54                                 return err;
  55                         }
  56                 } else {
  57                         /* Non-leaf: hashing hash block from level below */
  58                         src_page = vops->read_merkle_tree_page(inode,
  59                                         params->level_start[level - 1] + i);
  60                         if (IS_ERR(src_page)) {
  61                                 err = PTR_ERR(src_page);
  62                                 fsverity_err(inode,
  63                                              "Error %d reading Merkle tree page %llu",
  64                                              err, params->level_start[level - 1] + i);
  65                                 return err;
  66                         }
  67                 }
  68
  69                 err = fsverity_hash_page(params, inode, req, src_page,
  70                                          &pending_hashes[pending_size]);
  71                 put_page(src_page);
  72                 if (err)
  73                         return err;
  74                 pending_size += params->digest_size;
  75
  76                 if (level == params->num_levels) /* Root hash? */
  77                         return 0;
  78
  79                 if (pending_size + params->digest_size > params->block_size ||
  80                     i + 1 == num_blocks_to_hash) {
  81                         /* Flush the pending hash block */
  82                         memset(&pending_hashes[pending_size], 0,
  83                                params->block_size - pending_size);
  84                         err = vops->write_merkle_tree_block(inode,
  85                                         pending_hashes,
  86                                         dst_block_num,
  87                                         params->log_blocksize);
  88                         if (err) {
  89                                 fsverity_err(inode,
  90                                              "Error %d writing Merkle tree block %llu",
  91                                              err, dst_block_num);
  92                                 return err;
  93                         }
  94                         dst_block_num++;
  95                         pending_size = 0;
  96                 }
  97
  98                 if (fatal_signal_pending(current))
  99                         return -EINTR;
 100                 cond_resched();
 101         }
 102         return 0;
 103 }
 104
 105 /*
 106  * Build the Merkle tree for the given inode using the given parameters, and
 107  * return the root hash in @root_hash.
 108  *
 109  * The tree is written to a filesystem-specific location as determined by the
 110  * ->write_merkle_tree_block() method.  However, the blocks that comprise the
 111  * tree are the same for all filesystems.
 112  */
 113 static int build_merkle_tree(struct inode *inode,
 114                              const struct merkle_tree_params *params,
 115                              u8 *root_hash)
 116 {
 117         u8 *pending_hashes;
 118         struct ahash_request *req;
 119         u64 blocks;
 120         unsigned int level;
 121         int err = -ENOMEM;
 122
 123         if (inode->i_size == 0) {
 124                 /* Empty file is a special case; root hash is all 0's */
 125                 memset(root_hash, 0, params->digest_size);
 126                 return 0;
 127         }
 128
 129         pending_hashes = kmalloc(params->block_size, GFP_KERNEL);
 130         req = ahash_request_alloc(params->hash_alg->tfm, GFP_KERNEL);
 131         if (!pending_hashes || !req)
 132                 goto out;
 133
 134         /*
 135          * Build each level of the Merkle tree, starting at the leaf level
 136          * (level 0) and ascending to the root node (level 'num_levels - 1').
 137          * Then at the end (level 'num_levels'), calculate the root hash.
 138          */
 139         blocks = ((u64)inode->i_size + params->block_size - 1) >>
 140                  params->log_blocksize;
 141         for (level = 0; level <= params->num_levels; level++) {
 142                 err = build_merkle_tree_level(inode, level, blocks, params,
 143                                               pending_hashes, req);
 144                 if (err)
 145                         goto out;
 146                 blocks = (blocks + params->hashes_per_block - 1) >>
 147                          params->log_arity;
 148         }
 149         memcpy(root_hash, pending_hashes, params->digest_size);
 150         err = 0;
 151 out:
 152         kfree(pending_hashes);
 153         ahash_request_free(req);
 154         return err;
 155 }
 156
 157 static int enable_verity(struct file *filp,
 158                          const struct fsverity_enable_arg *arg)
 159 {
 160         struct inode *inode = file_inode(filp);
 161         const struct fsverity_operations *vops = inode->i_sb->s_vop;
 162         struct merkle_tree_params params = { };
 163         struct fsverity_descriptor *desc;
 164         size_t desc_size = sizeof(*desc) + arg->sig_size;
 165         struct fsverity_info *vi;
 166         int err;
 167
 168         /* Start initializing the fsverity_descriptor */
 169         desc = kzalloc(desc_size, GFP_KERNEL);
 170         if (!desc)
 171                 return -ENOMEM;
 172         desc->version = 1;
 173         desc->hash_algorithm = arg->hash_algorithm;
 174         desc->log_blocksize = ilog2(arg->block_size);
 175
 176         /* Get the salt if the user provided one */
 177         if (arg->salt_size &&
 178             copy_from_user(desc->salt,
 179                            (const u8 __user *)(uintptr_t)arg->salt_ptr,
 180                            arg->salt_size)) {
 181                 err = -EFAULT;
 182                 goto out;
 183         }
 184         desc->salt_size = arg->salt_size;
 185
 186         /* Get the signature if the user provided one */
 187         if (arg->sig_size &&
 188             copy_from_user(desc->signature,
 189                            (const u8 __user *)(uintptr_t)arg->sig_ptr,
 190                            arg->sig_size)) {
 191                 err = -EFAULT;
 192                 goto out;
 193         }
 194         desc->sig_size = cpu_to_le32(arg->sig_size);
 195
 196         desc->data_size = cpu_to_le64(inode->i_size);
 197
 198         /* Prepare the Merkle tree parameters */
 199         err = fsverity_init_merkle_tree_params(&params, inode,
 200                                                arg->hash_algorithm,
 201                                                desc->log_blocksize,
 202                                                desc->salt, desc->salt_size);
 203         if (err)
 204                 goto out;
 205
 206         /*
 207          * Start enabling verity on this file, serialized by the inode lock.
 208          * Fail if verity is already enabled or is already being enabled.
 209          */
 210         inode_lock(inode);
 211         if (IS_VERITY(inode))
 212                 err = -EEXIST;
 213         else
 214                 err = vops->begin_enable_verity(filp);
 215         inode_unlock(inode);
 216         if (err)
 217                 goto out;
 218
 219         /*
 220          * Build the Merkle tree.  Don't hold the inode lock during this, since
 221          * on huge files this may take a very long time and we don't want to
 222          * force unrelated syscalls like chown() to block forever.  We don't
 223          * need the inode lock here because deny_write_access() already prevents
 224          * the file from being written to or truncated, and we still serialize
 225          * ->begin_enable_verity() and ->end_enable_verity() using the inode
 226          * lock and only allow one process to be here at a time on a given file.
 227          */
 228         pr_debug("Building Merkle tree...\n");
 229         BUILD_BUG_ON(sizeof(desc->root_hash) < FS_VERITY_MAX_DIGEST_SIZE);
 230         err = build_merkle_tree(inode, &params, desc->root_hash);
 231         if (err) {
 232                 fsverity_err(inode, "Error %d building Merkle tree", err);
 233                 goto rollback;
 234         }
 235         pr_debug("Done building Merkle tree.  Root hash is %s:%*phN\n",
 236                  params.hash_alg->name, params.digest_size, desc->root_hash);
 237
 238         /*
 239          * Create the fsverity_info.  Don't bother trying to save work by
 240          * reusing the merkle_tree_params from above.  Instead, just create the
 241          * fsverity_info from the fsverity_descriptor as if it were just loaded
 242          * from disk.  This is simpler, and it serves as an extra check that the
 243          * metadata we're writing is valid before actually enabling verity.
 244          */
 245         vi = fsverity_create_info(inode, desc, desc_size);
 246         if (IS_ERR(vi)) {
 247                 err = PTR_ERR(vi);
 248                 goto rollback;
 249         }
 250
 251         if (arg->sig_size)
 252                 pr_debug("Storing a %u-byte PKCS#7 signature alongside the file\n",
 253                          arg->sig_size);
 254
 255         /*
 256          * Tell the filesystem to finish enabling verity on the file.
 257          * Serialized with ->begin_enable_verity() by the inode lock.
 258          */
 259         inode_lock(inode);
 260         err = vops->end_enable_verity(filp, desc, desc_size, params.tree_size);
 261         inode_unlock(inode);
 262         if (err) {
 263                 fsverity_err(inode, "%ps() failed with err %d",
 264                              vops->end_enable_verity, err);
 265                 fsverity_free_info(vi);
 266         } else if (WARN_ON(!IS_VERITY(inode))) {
 267                 err = -EINVAL;
 268                 fsverity_free_info(vi);
 269         } else {
 270                 /* Successfully enabled verity */
 271
 272                 /*
 273                  * Readers can start using ->i_verity_info immediately, so it
 274                  * can't be rolled back once set.  So don't set it until just
 275                  * after the filesystem has successfully enabled verity.
 276                  */
 277                 fsverity_set_info(inode, vi);
 278         }
 279 out:
 280         kfree(params.hashstate);
 281         kfree(desc);
 282         return err;
 283
 284 rollback:
 285         inode_lock(inode);
 286         (void)vops->end_enable_verity(filp, NULL, 0, params.tree_size);
 287         inode_unlock(inode);
 288         goto out;
 289 }
 290
 291 /**
 292  * fsverity_ioctl_enable() - enable verity on a file
 293  *
 294  * Enable fs-verity on a file.  See the "FS_IOC_ENABLE_VERITY" section of
 295  * Documentation/filesystems/fsverity.rst for the documentation.
 296  *
 297  * Return: 0 on success, -errno on failure
 298  */
 299 int fsverity_ioctl_enable(struct file *filp, const void __user *uarg)
 300 {
 301         struct inode *inode = file_inode(filp);
 302         struct fsverity_enable_arg arg;
 303         int err;
 304
 305         if (copy_from_user(&arg, uarg, sizeof(arg)))
 306                 return -EFAULT;
 307
 308         if (arg.version != 1)
 309                 return -EINVAL;
 310
 311         if (arg.__reserved1 ||
 312             memchr_inv(arg.__reserved2, 0, sizeof(arg.__reserved2)))
 313                 return -EINVAL;
 314
 315         if (arg.block_size != PAGE_SIZE)
 316                 return -EINVAL;
 317
 318         if (arg.salt_size > FIELD_SIZEOF(struct fsverity_descriptor, salt))
 319                 return -EMSGSIZE;
 320
 321         if (arg.sig_size > FS_VERITY_MAX_SIGNATURE_SIZE)
 322                 return -EMSGSIZE;
 323
 324         /*
 325          * Require a regular file with write access.  But the actual fd must
 326          * still be readonly so that we can lock out all writers.  This is
 327          * needed to guarantee that no writable fds exist to the file once it
 328          * has verity enabled, and to stabilize the data being hashed.
 329          */
 330
 331         err = inode_permission(inode, MAY_WRITE);
 332         if (err)
 333                 return err;
 334
 335         if (IS_APPEND(inode))
 336                 return -EPERM;
 337
 338         if (S_ISDIR(inode->i_mode))
 339                 return -EISDIR;
 340
 341         if (!S_ISREG(inode->i_mode))
 342                 return -EINVAL;
 343
 344         err = mnt_want_write_file(filp);
 345         if (err) /* -EROFS */
 346                 return err;
 347
 348         err = deny_write_access(filp);
 349         if (err) /* -ETXTBSY */
 350                 goto out_drop_write;
 351
 352         err = enable_verity(filp, &arg);
 353
 354         /*
 355          * We no longer drop the inode's pagecache after enabling verity.  This
 356          * used to be done to try to avoid a race condition where pages could be
 357          * evicted after being used in the Merkle tree construction, then
 358          * re-instantiated by a concurrent read.  Such pages are unverified, and
 359          * the backing storage could have filled them with different content, so
 360          * they shouldn't be used to fulfill reads once verity is enabled.
 361          *
 362          * But, dropping the pagecache has a big performance impact, and it
 363          * doesn't fully solve the race condition anyway.  So for those reasons,
 364          * and also because this race condition isn't very important relatively
 365          * speaking (especially for small-ish files, where the chance of a page
 366          * being used, evicted, *and* re-instantiated all while enabling verity
 367          * is quite small), we no longer drop the inode's pagecache.
 368          */
 369
 370         /*
 371          * allow_write_access() is needed to pair with deny_write_access().
 372          * Regardless, the filesystem won't allow writing to verity files.
 373          */
 374         allow_write_access(filp);
 375 out_drop_write:
 376         mnt_drop_write_file(filp);
 377         return err;
 378 }
 379 EXPORT_SYMBOL_GPL(fsverity_ioctl_enable);