fscrypt: use ENOKEY when file cannot be created w/o key

[ Upstream commit 54475f531bb8d7078f63c159e5e0615d486c498c ]

As part of an effort to clean up fscrypt-related error codes, make
attempting to create a file in an encrypted directory that hasn't been
"unlocked" fail with ENOKEY.  Previously, several error codes were used
for this case, including ENOENT, EACCES, and EPERM, and they were not
consistent between and within filesystems.  ENOKEY is a better choice
because it expresses that the failure is due to lacking the encryption
key.  It also matches the error code returned when trying to open an
encrypted regular file without the key.

I am not aware of any users who might be relying on the previous
inconsistent error codes, which were never documented anywhere.

This failure case will be exercised by an xfstest.

Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/crypto/fname.c b/fs/crypto/fname.c
index d1bbdc9dda765bf6d7056854fc1681ff80fd33f4..e14bb7b67e9c2276b1ac032f8f7cc6d82153c979 100644 (file)
--- a/fs/crypto/fname.c
+++ b/fs/crypto/fname.c
@@ -332,7 +332,7 @@ int fscrypt_fname_usr_to_disk(struct inode *inode,
         * in a directory. Consequently, a user space name cannot be mapped to
         * a disk-space name
         */
-       return -EACCES;
+       return -ENOKEY;
 }
 EXPORT_SYMBOL(fscrypt_fname_usr_to_disk);
 
@@ -367,7 +367,7 @@ int fscrypt_setup_filename(struct inode *dir, const struct qstr *iname,
                return 0;
        }
        if (!lookup)
-               return -EACCES;
+               return -ENOKEY;
 
        /*
         * We don't have the key and we are doing a lookup; decode the

diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index 170421edfdfe19567007be1b2b1d0a45cf9920fb..2d94e8524839a42160bb1d4f2511ddd55867924f 100644 (file)
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -771,7 +771,7 @@ struct inode *__ext4_new_inode(handle_t *handle, struct inode *dir,
                if (err)
                        return ERR_PTR(err);
                if (!fscrypt_has_encryption_key(dir))
-                       return ERR_PTR(-EPERM);
+                       return ERR_PTR(-ENOKEY);
                if (!handle)
                        nblocks += EXT4_DATA_TRANS_BLOCKS(dir->i_sb);
                encrypt = 1;

diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 00b8a5a66961890d7a8775a636d98763a9fe3b8f..4438b93f6fd6ab1cf8118390a972373a17501f8f 100644 (file)
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1378,6 +1378,8 @@ static struct buffer_head * ext4_find_entry (struct inode *dir,
                return NULL;
 
        retval = ext4_fname_setup_filename(dir, d_name, 1, &fname);
+       if (retval == -ENOENT)
+               return NULL;
        if (retval)
                return ERR_PTR(retval);
 
@@ -3090,7 +3092,7 @@ static int ext4_symlink(struct inode *dir,
                if (err)
                        return err;
                if (!fscrypt_has_encryption_key(dir))
-                       return -EPERM;
+                       return -ENOKEY;
                disk_link.len = (fscrypt_fname_encrypted_size(dir, len) +
                                 sizeof(struct fscrypt_symlink_data));
                sd = kzalloc(disk_link.len, GFP_KERNEL);

diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
index 11f3717ce4814fe474969e413dde3b83e4079afb..8add4e8bab9993d2bab2743bf93c0d9ae4933ec3 100644 (file)
--- a/fs/f2fs/dir.c
+++ b/fs/f2fs/dir.c
@@ -277,7 +277,10 @@ struct f2fs_dir_entry *f2fs_find_entry(struct inode *dir,
 
        err = fscrypt_setup_filename(dir, child, 1, &fname);
        if (err) {
-               *res_page = ERR_PTR(err);
+               if (err == -ENOENT)
+                       *res_page = NULL;
+               else
+                       *res_page = ERR_PTR(err);
                return NULL;
        }
 

diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
index 08d7dc99042ebc2d15176679146a75c3bb082206..8556fe1ccb8a84f4db0c4caec37743f2de4c429a 100644 (file)
--- a/fs/f2fs/namei.c
+++ b/fs/f2fs/namei.c
@@ -403,7 +403,7 @@ static int f2fs_symlink(struct inode *dir, struct dentry *dentry,
                        return err;
 
                if (!fscrypt_has_encryption_key(dir))
-                       return -EPERM;
+                       return -ENOKEY;
 
                disk_link.len = (fscrypt_fname_encrypted_size(dir, len) +
                                sizeof(struct fscrypt_symlink_data));
@@ -447,7 +447,7 @@ static int f2fs_symlink(struct inode *dir, struct dentry *dentry,
                        goto err_out;
 
                if (!fscrypt_has_encryption_key(inode)) {
-                       err = -EPERM;
+                       err = -ENOKEY;
                        goto err_out;
                }