2 # SPDX-License-Identifier: GPL-2.0
3 # Copyright (c) 2016 Google, Inc. All Rights Reserved.
5 # FS QA Test generic/398
7 # Filesystem encryption is designed to enforce that a consistent encryption
8 # policy is used within a given encrypted directory tree and that an encrypted
9 # directory tree does not contain any unencrypted files. This test verifies
10 # that filesystem operations that would violate this constraint fail with EPERM.
11 # This does not test enforcement of this constraint on lookup, which is still
12 # needed to detect offline changes.
15 seqres=$RESULT_DIR/$seq
16 echo "QA output created by $seq"
20 status=1 # failure is the default!
21 trap "_cleanup; exit \$status" 0 1 2 3 15
31 # rename without key can also fail with EPERM instead of ENOKEY
32 sed -e "s/Required key not available/Operation not permitted/g"
35 # get standard environment, filters and checks
41 # remove previous $seqres.full before test
44 # real QA test starts here
47 _require_scratch_encryption
48 _require_xfs_io_command "set_encpolicy"
52 _scratch_mkfs_encrypted &>> $seqres.full
55 # Set up two encrypted directories, with different encryption policies,
56 # and one unencrypted directory.
57 edir1=$SCRATCH_MNT/edir1
58 edir2=$SCRATCH_MNT/edir2
59 udir=$SCRATCH_MNT/udir
60 mkdir $edir1 $edir2 $udir
61 keydesc1=$(_generate_encryption_key)
62 keydesc2=$(_generate_encryption_key)
63 $XFS_IO_PROG -c "set_encpolicy $keydesc1" $edir1
64 $XFS_IO_PROG -c "set_encpolicy $keydesc2" $edir2
70 # Test linking and moving an encrypted file into an encrypted directory with a
71 # different encryption policy. Should fail with EPERM.
73 echo -e "\n*** Link encrypted <= encrypted ***"
74 ln $edir1/efile1 $edir2/efile1 |& _filter_scratch
76 echo -e "\n*** Rename encrypted => encrypted ***"
77 mv $edir1/efile1 $edir2/efile1 |& _filter_scratch
80 # Test linking and moving an unencrypted file into an encrypted directory.
81 # Should fail with EPERM.
83 echo -e "\n\n*** Link unencrypted <= encrypted ***"
84 ln $udir/ufile $edir1/ufile |& _filter_scratch
86 echo -e "\n*** Rename unencrypted => encrypted ***"
87 mv $udir/ufile $edir1/ufile |& _filter_scratch
90 # Test linking and moving an encrypted file into an unencrypted directory.
93 echo -e "\n\n*** Link encrypted <= unencrypted ***"
94 ln -v $edir1/efile1 $udir/efile1 |& _filter_scratch
95 rm $udir/efile1 # undo
97 echo -e "\n*** Rename encrypted => unencrypted ***"
98 mv -v $edir1/efile1 $udir/efile1 |& _filter_scratch
99 mv $udir/efile1 $edir1/efile1 # undo
102 # Test moving a forbidden (unencrypted, or encrypted with a different encryption
103 # policy) file into an encrypted directory via an exchange (cross rename)
104 # operation. Should fail with EPERM.
106 echo -e "\n\n*** Exchange encrypted <=> encrypted ***"
107 src/renameat2 -x $edir1/efile1 $edir2/efile2 |& _filter_scratch
109 echo -e "\n*** Exchange unencrypted <=> encrypted ***"
110 src/renameat2 -x $udir/ufile $edir1/efile1 |& _filter_scratch
112 echo -e "\n*** Exchange encrypted <=> unencrypted ***"
113 src/renameat2 -x $edir1/efile1 $udir/ufile |& _filter_scratch
116 # Test a file with a special type, i.e. not regular, directory, or symlink.
117 # Since such files are not subject to encryption, there should be no
118 # restrictions on linking or moving them into encrypted directories.
120 echo -e "\n\n*** Special file tests ***"
122 mv -v $edir1/fifo $edir2/fifo | _filter_scratch
123 mv -v $edir2/fifo $udir/fifo | _filter_scratch
124 mv -v $udir/fifo $edir1/fifo | _filter_scratch
126 src/renameat2 -x $udir/fifo $edir1/fifo
127 ln -v $edir1/fifo $edir2/fifo | _filter_scratch
128 rm $edir1/fifo $edir2/fifo $udir/fifo
131 # Now test that *without* access to the encrypted key, we cannot use an exchange
132 # (cross rename) operation to move a forbidden file into an encrypted directory.
134 _unlink_encryption_key $keydesc1
135 _unlink_encryption_key $keydesc2
137 efile1=$(find $edir1 -type f)
138 efile2=$(find $edir2 -type f)
140 echo -e "\n\n*** Exchange encrypted <=> encrypted without key ***"
141 src/renameat2 -x $efile1 $efile2 |& filter_enokey
142 echo -e "\n*** Exchange encrypted <=> unencrypted without key ***"
143 src/renameat2 -x $efile1 $udir/ufile |& filter_enokey