From c9db274e91b7cbdb51776019f866ac8d214ea7d8 Mon Sep 17 00:00:00 2001 From: Luis Henriques Date: Thu, 12 Aug 2021 13:46:20 +0100 Subject: [PATCH] mds: don't allow changing layout on encrypted files/directories Encryption is currently only supported on files/directories with layouts where stripe_count=1. Forbid changing layouts when encryption is involved. Signed-off-by: Luis Henriques --- src/mds/Server.cc | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/src/mds/Server.cc b/src/mds/Server.cc index 2fb1de3a465f..31d8f216b7fc 100644 --- a/src/mds/Server.cc +++ b/src/mds/Server.cc @@ -5632,6 +5632,7 @@ int Server::check_layout_vxattr(MDRequestRef& mdr, void Server::handle_set_vxattr(MDRequestRef& mdr, CInode *cur) { const cref_t &req = mdr->client_request; + MutationImpl::LockOpVec lov; string name(req->get_path2()); bufferlist bl = req->get_data(); string value (bl.c_str(), bl.length()); @@ -5657,6 +5658,18 @@ void Server::handle_set_vxattr(MDRequestRef& mdr, CInode *cur) if (!xlock_policylock(mdr, cur, true)) return; + /* We need 'As' caps for the fscrypt context */ + lov.add_xlock(&cur->authlock); + if (!mds->locker->acquire_locks(mdr, lov)) { + return; + } + + /* encrypted directories can't have their layout changed */ + if (!cur->get_inode()->fscrypt_auth.empty()) { + respond_to_request(mdr, -CEPHFS_EINVAL); + return; + } + file_layout_t layout; if (cur->get_projected_inode()->has_layout()) layout = cur->get_projected_inode()->layout; @@ -5688,11 +5701,16 @@ void Server::handle_set_vxattr(MDRequestRef& mdr, CInode *cur) if (check_layout_vxattr(mdr, rest, value, &layout) < 0) return; - MutationImpl::LockOpVec lov; lov.add_xlock(&cur->filelock); if (!mds->locker->acquire_locks(mdr, lov)) return; + /* encrypted files can't have their layout changed */ + if (!cur->get_inode()->fscrypt_auth.empty()) { + respond_to_request(mdr, -CEPHFS_EINVAL); + return; + } + auto pi = cur->project_inode(mdr); int64_t old_pool = pi.inode->layout.pool_id; pi.inode->add_old_pool(old_pool); @@ -5755,7 +5773,6 @@ void Server::handle_set_vxattr(MDRequestRef& mdr, CInode *cur) */ if (!mdr->more()->rdonly_checks) { if (!(mdr->locking_state & MutationImpl::ALL_LOCKED)) { - MutationImpl::LockOpVec lov; lov.add_rdlock(&cur->snaplock); if (!mds->locker->acquire_locks(mdr, lov)) return; -- 2.47.3