ubifs: check for consistent encryption contexts in ubifs_lookup() (413d5a9e) · Commits · 戴 / test

As ext4 and f2fs do, ubifs should check for consistent encryption contexts during ->lookup() in an encrypted directory. This protects certain users of filesystem encryption against certain types of offline attacks. Signed-off-by:

Eric Biggers <ebiggers@google.com> Signed-off-by:

Theodore Ts'o <tytso@mit.edu>

fs/ubifs/dir.c

+11 −0

Original line number	Diff line number	Diff line
		@@ -285,6 +285,15 @@ static struct dentry ubifs_lookup(struct inode dir, struct dentry *dentry,
		goto out_dent;
		}

		if (ubifs_crypt_is_encrypted(dir) &&
		(S_ISDIR(inode->i_mode) \|\| S_ISLNK(inode->i_mode)) &&
		!fscrypt_has_permitted_context(dir, inode)) {
		ubifs_warn(c, "Inconsistent encryption contexts: %lu/%lu",
		dir->i_ino, inode->i_ino);
		err = -EPERM;
		goto out_inode;
		}

		done:
		kfree(dent);
		fscrypt_free_filename(&nm);
		@@ -295,6 +304,8 @@ done:
		d_add(dentry, inode);
		return NULL;

		out_inode:
		iput(inode);
		out_dent:
		kfree(dent);
		out_fname:

Admin message