← Back to branch summary

~ubuntu-branches/ubuntu/raring/ecryptfs-utils/raring-proposed

« back to all changes in this revision

Viewing changes to src/utils/mount.ecryptfs.c

  • Committer: Package Import Robot
  • Author(s): Dustin Kirkland, Kees Cook, Andreas Raster, George Wilson, Dustin Kirkland, Sergio Peña, Tyler Hicks, Colin King, Colin Watson, Serge Hallyn
  • Date: 2012-06-15 09:28:58 UTC
  • mfrom: (1.1.42)
  • Revision ID: package-import@ubuntu.com-20120615092858-vbb0wtozlzsp5ffo
Tags: 97-0ubuntu1
https://launchpad.net/bugs/938326
https://launchpad.net/bugs/937331
https://launchpad.net/bugs/922821
https://launchpad.net/bugs/917509
https://launchpad.net/bugs/994813
https://launchpad.net/bugs/1007159
https://launchpad.net/bugs/979350
[ Kees Cook ]
* src/pam_ecryptfs/pam_ecryptfs.c: LP: #938326
  - exit, rather than return to prevent duplicate processes

[ Andreas Raster ]
* src/desktop/ecryptfs-find:
  - $mounts was quoted once too often

[ George Wilson ]
* src/key_mod/ecryptfs_key_mod_openssl.c,
  src/key_mod/ecryptfs_key_mod_pkcs11_helper.c,
  src/key_mod/ecryptfs_key_mod_tspi.c: LP: #937331
  - IBM would like to grant a license exception for key modules that
    require linking to OpenSSL. The change should make the modules
    shippable by Linux distributions

[ Dustin Kirkland ]
* debian/copyright:
  - note the GPLv2 SSL exception granted by IBM for the key modules
* debian/control, debian/copyright, doc/manpage/ecryptfs.7,
  doc/manpage/ecryptfs-add-passphrase.1, doc/manpage/ecryptfsd.8,
  doc/manpage/ecryptfs-generate-tpm-key.1, doc/manpage/ecryptfs-
  insert-wrapped-passphrase-into-keyring.1, doc/manpage/ecryptfs-
  manager.8, doc/manpage/ecryptfs-mount-private.1,
  doc/manpage/ecryptfs-recover-private.1, doc/manpage/ecryptfs-rewrap-
  passphrase.1, doc/manpage/ecryptfs-rewrite-file.1,
  doc/manpage/ecryptfs-setup-private.1, doc/manpage/ecryptfs-setup-
  swap.1, doc/manpage/ecryptfs-stat.1, doc/manpage/ecryptfs-umount-
  private.1, doc/manpage/ecryptfs-unwrap-passphrase.1,
  doc/manpage/ecryptfs-wrap-passphrase.1,
  doc/manpage/mount.ecryptfs.8, doc/manpage/mount.ecryptfs_private.1,
  doc/manpage/pam_ecryptfs.8, doc/manpage/umount.ecryptfs.8,
  doc/manpage/umount.ecryptfs_private.1, README,
  src/utils/mount.ecryptfs.c:
  - use the new ecryptfs.org website where appropriate
* debian/control:
  - update to suggest zescrow-client
* precise

[ Sergio Peña ]
* src/libecryptfs/cipher_list.c: LP: #922821
  - add the new name of the blowfish cipher (linux >= 3.2)
* src/include/ecryptfs.h, src/libecryptfs/main.c,
  src/utils/mount.ecryptfs.c: LP: #917509
  - use execl() to mount ecryptfs
  - this allows us to support any arbitrary mount options in
    /etc/fstab

[ Tyler Hicks ]
* doc/manpage/ecryptfs.7:
  - Remove the note saying that the passphrase and openssl key modules are
    available by default. That's true upstream but not always true in distro
    builds.
* tests/run_tests.sh:
  - Make upper and lower mount point arguments optional by automatically
    creating directories in /tmp by default.
  - Make it possible to run only userspace tests without having to specify
    unused mount information
  - Accept a comma-separated list of lower filesystems to test on and loop
    through all kernel tests for each lower filesystem
  - Accept a comma-separated list of tests to run
* tests/lib/etl_funcs.sh:
  - Unset $ETL_DISK just before etl_remove_disk() successfully returns
* tests/userspace/Makefile.am:
  - Also build 'make check' tests when building with --enable-tests
* include/ecryptfs.h, libecryptfs/Makefile.am,
  libecryptfs/cipher_list.c, libecryptfs/module_mgr.c,
  utils/io.h: LP: #994813
  - remove overly complicated implementation to detect what ciphers
    are supported by the currently running kernel's crypto api
  - prompt for the entire supported cipher list, if the user selects a
    cipher that their kernel doesn't support, the mount will fail
    and the kernel will write an error message to the syslog
* src/libecryptfs/module_mgr.c:
  - Use correct blowfish block size when displaying supported ciphers to
    the user
* tests/kernel/lp-1009207.sh, tests/kernel/Makefile.am,
  tests/kernel/tests.rc:
  - Add simple test case for incorrect handling of umask and default POSIX
    ACL masks
* tests/kernel/lp-994247.sh, tests/kernel/lp-994247/test.c,
  tests/kernel/Makefile.am, tests/kernel/tests.rc:
  - Add test case for incorrect handling of open /dev/ecryptfs file
    descriptors that are passed or inherited by other processes

[ Colin King ]
* tests/lib/etl_funcs.sh:
  - etl_lumount() should use DST rather than SRC dir so it can run on Lucid
  - use file system appropriate mkfs force flag
  - cater for correct ext2 default mount flags
* tests/kernel/lp-509180.sh, tests/kernel/lp-509180/test.c:
  - test for trailing garbage at end of files
* tests/kernel/lp-524919.sh, tests/kernel/lp-524919/test.c:
  - test case for checking lstat/readlink size
* tests/kernel/lp-870326.sh, tests/kernel/lp-870326/test.c:
  - test case for open(), mmap(), close(), modify mmap'd region
* tests/kernel/lp-469664.sh:
  - test case for lsattr
* tests/kernel/lp-613873.sh:
  - test case for stat modify time
* tests/kernel/lp-745836.sh:
  - test case for clearing ECRYPTFS_NEW_FILE flag during truncate
* tests/lib/etl_funcs.sh, tests/kernel/extend-file-random.sh,
  tests/kernel/trunc-file.sh (LP: #1007159):
  - Add test library function for estimating available space in lower fs
  - Use new library function in tests that need to create large files

[ Colin Watson ]
* src/utils/ecryptfs-setup-swap: Skip /dev/zram* swap devices
  LP: #979350

[ Serge Hallyn ]
* src/utils/mount.ecryptfs_private.c:
  - EoL fixes

Show diffs side-by-side

added added

removed removed

Lines of Context:
src/utils/mount.ecryptfs.c
135
135
        return rc;
136
136
}
137
137
 
138
 
static int ecryptfs_generate_mount_flags(char *options, int *flags)
139
 
{
140
 
        char *opt;
141
 
        char *next_opt;
142
 
        char *end;
143
 
        int num_options = 0;
144
 
 
145
 
        if (!options)
146
 
                return 0;
147
 
 
148
 
        end = strchr(options, '\0');
149
 
        opt = options;
150
 
        while (opt) {
151
 
                if ((next_opt = strchr(opt, ',')))
152
 
                        next_opt++;
153
 
                /* the following mount options should be
154
 
                 * stripped out from what is passed into the
155
 
                 * kernel since these eight options are best
156
 
                 * passed as the mount flags rather than
157
 
                 * redundantly to the kernel and could
158
 
                 * generate spurious warnings depending on the
159
 
                 * level of the corresponding cifs vfs kernel
160
 
                 * code */
161
 
                if (!strncmp(opt, "nosuid", 6))
162
 
                        *flags |= MS_NOSUID;
163
 
                else if (!strncmp(opt, "suid", 4))
164
 
                        *flags &= ~MS_NOSUID;
165
 
                else if (!strncmp(opt, "nodev", 5))
166
 
                        *flags |= MS_NODEV;
167
 
                else if (!strncmp(opt, "dev", 3))
168
 
                        *flags &= ~MS_NODEV;
169
 
                else if (!strncmp(opt, "noexec", 6))
170
 
                        *flags |= MS_NOEXEC;
171
 
                else if (!strncmp(opt, "exec", 4))
172
 
                        *flags &= ~MS_NOEXEC;
173
 
                else if (!strncmp(opt, "ro", 2))
174
 
                        *flags |= MS_RDONLY;
175
 
                else if (!strncmp(opt, "rw", 2))
176
 
                        *flags &= ~MS_RDONLY;
177
 
                else if (!strncmp(opt, "remount", 7))
178
 
                        *flags |= MS_REMOUNT;
179
 
                else {
180
 
                        opt = next_opt;
181
 
                        num_options++;
182
 
                        continue;
183
 
                }
184
 
                if (!next_opt) {
185
 
                        if (opt != options)
186
 
                                end = --opt;
187
 
                        else
188
 
                                end = options;
189
 
                        *end = '\0';
190
 
                        break;
191
 
                }
192
 
                memcpy(opt, next_opt, end - next_opt);
193
 
                end = end - (next_opt - opt);
194
 
                *end = '\0';
195
 
        }
196
 
        return num_options;
197
 
}
198
 
 
199
138
char *parameters_to_scrub[] = {
200
139
        "key=",
201
140
        "cipher=",
446
385
        return rc;
447
386
}
448
387
 
 
388
int ecryptfs_mount(char *source, char *target, char *opts)
 
389
{
 
390
        pid_t pid, pid_child;
 
391
        char *fullpath_source = NULL;
 
392
        char *fullpath_target = NULL;
 
393
        int rc, status;
 
394
 
 
395
        if (!source) {
 
396
                rc = -EINVAL;
 
397
                syslog(LOG_ERR, "Invalid source directory\n");
 
398
                goto out;
 
399
        }
 
400
 
 
401
        if (!target) {
 
402
                rc = -EINVAL;
 
403
                syslog(LOG_ERR, "Invalid target directory\n");
 
404
                goto out;
 
405
        }
 
406
 
 
407
        /* source & target are canonicalized here, so the correct error
 
408
         * is sent to syslog. 
 
409
         * /bin/mount tells you the error on normal output only, not to syslog.
 
410
         */
 
411
        fullpath_source = realpath(source, NULL);
 
412
        if (!fullpath_source) {
 
413
                rc = -errno;
 
414
                syslog(LOG_ERR, "could not resolve full path for source %s [%d]",
 
415
                        source, -errno);
 
416
                goto out;
 
417
        }
 
418
 
 
419
        fullpath_target = realpath(target, NULL);
 
420
        if (!fullpath_target) {
 
421
                rc = -errno;
 
422
                syslog(LOG_ERR, "could not resolve full path for target %s [%d]",
 
423
                        target, -errno);
 
424
                goto out;
 
425
        }
 
426
 
 
427
        pid = fork();
 
428
        if (pid == -1) {
 
429
                syslog(LOG_ERR, "Could not fork process to mount eCryptfs: [%d]\n", -errno);
 
430
                rc = -errno;
 
431
        } else if (pid == 0) {
 
432
                execl("/bin/mount", "mount", "-i", "--no-canonicalize", "-t", "ecryptfs", fullpath_source, fullpath_target, "-o", opts, NULL);
 
433
 
 
434
                /* error message shown in console to let users know what was wrong */
 
435
                /* i.e. /bin/mount does not exist */
 
436
                perror("Failed to execute /bin/mount command");
 
437
                exit(errno);
 
438
        } else {
 
439
                pid_child = waitpid(pid, &status, 0);
 
440
                if (pid_child == -1) {
 
441
                        syslog(LOG_ERR, "Failed waiting for /bin/mount process: [%d]\n", -errno);
 
442
                        rc = -errno;
 
443
                        goto out;
 
444
                }
 
445
 
 
446
                rc = -EPERM;
 
447
                if (WIFEXITED(status))
 
448
                        rc = -WEXITSTATUS(status);
 
449
 
 
450
                if (rc) {
 
451
                        syslog(LOG_ERR, "Failed to perform eCryptfs mount: [%d]\n", rc);
 
452
                        if (-EPIPE == rc) {
 
453
                                rc = -EPERM;
 
454
                        }
 
455
                }
 
456
        }
 
457
 
 
458
out:
 
459
        free(fullpath_source);
 
460
        free(fullpath_target);
 
461
 
 
462
        return rc;
 
463
}
 
464
 
449
465
/**
450
466
 * ecryptfs_do_mount
451
467
 * @params:
460
476
                             int sig_cache, struct passwd *pw)
461
477
{
462
478
        int rc;
463
 
        int flags = 0;
464
 
        int num_opts = 0;
465
479
        char *src = NULL, *targ = NULL, *opts = NULL, *new_opts = NULL, *temp;
466
480
        char *val;
467
481
 
472
486
        rc = strip_userland_opts(opts);
473
487
        if (rc)
474
488
                goto out;
475
 
        num_opts = ecryptfs_generate_mount_flags(opts, &flags);
476
489
        if (!(temp = strdup("ecryptfs_unlink_sigs"))) {
477
490
                rc = -ENOMEM;
478
491
                goto out;
512
525
                       rc);
513
526
                goto out;
514
527
        }
515
 
        rc = ecryptfs_mount(src, targ, flags, new_opts);
 
528
        rc = ecryptfs_mount(src, targ, new_opts);
516
529
out:
517
530
        free(src);
518
531
        free(targ);
619
632
                               "[%d] %s\nCheck your system logs for details "
620
633
                               "on why this happened.\nTry updating your "
621
634
                               "ecryptfs-utils package, and/or\nsubmit a bug "
622
 
                               "report on https://launchpad.net/ecryptfs\n",
 
635
                               "report on https://bugs.launchpad.net/ecryptfs\n",
623
636
                                rc, strerror(-rc));
624
637
                        goto out;
625
638
                }
633
646
                                rc = -rc;
634
647
                        printf("Error mounting eCryptfs: [%d] %s\n"
635
648
                               "Check your system logs; visit "
636
 
                               "<http://launchpad.net/ecryptfs>\n",
 
649
                               "<http://ecryptfs.org/support.html>\n",
637
650
                               rc, strerror(-rc));
638
651
                        if (rc == -ENODEV)
639
652
                                printf("Try ``modprobe ecryptfs''\n");