Received: by 2002:a25:1506:0:0:0:0:0 with SMTP id 6csp3708593ybv; Mon, 10 Feb 2020 05:06:04 -0800 (PST) X-Google-Smtp-Source: APXvYqyfTWRhzeZK8DgXkh8ZE4S+fyPC67bTjDIdunSdgamW+nZbg8T0VbkpEPaahtntrelHzjiG X-Received: by 2002:a9d:7508:: with SMTP id r8mr994811otk.116.1581339964313; Mon, 10 Feb 2020 05:06:04 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1581339964; cv=none; d=google.com; s=arc-20160816; b=kbt6bmHGEWEhP1rjWdy/NvwAJw2eNOvQBr1tVXugfai2IdMC2cNUxIVHD3oX/dogOs PIM3RrtDFuqY6+lkdmMfwqJWJocPrmsDLQXSjgxZzrrSoOX3QBWfp4GV8gwNzsR95T0Y nU+PZdb1bKGeG4m2SFNTLoPJX4TEYIldBOYqirPxDTexSbVGbMorv3cGAkTThwLx1UVr vZ3pwUa/xwZkHLLn6OR6CxBWQ5w1thaJuBJLWEVhJzCxaSt4uGrVbX2n43aWgj1Txkfz AmOsiAyfrYDmh+6Ksf7tmG/td/IoipZtocnO3L7Pl6ruzvvjenS3J8qObvnxAyLNEDvl tk6g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=hWx4kyLoTldh8+FwfcYNtK5a6+b2SD/ukbw3ycCU7w4=; b=XFTAd/OOsXeur9wnzYKWEPKYt5WKnzkra/58hTsonTYMJPqBPQe2FekJnw7/iOARDk 0toAaVYPaR+qGMo2vOxHQi9p3TAQ8/xAIOuT1YkGT1X5hfvpZVHqUQW1TiRUDZUvQ+Qn 7YDYiFFNVd/LmvVA9uaY9O6txOvbpK56ILdq527XTHYZmkiS0QFhxxlTZin0MU7wBmzX nn7bLhlqHQFFY08QEQnDQgaLf/5ls0d4FkrwEgvDr9ExVW0ARGcdyOwmUlxXdPoQEAz8 /gKDMDsQW5Yl4d53uQBaEcwmX1x1hk/xXidzRE/M3M4DnE4OkegFK8CPCg8jWta3Kl9I aT0g== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=Xw2S4PS2; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id f4si143151oto.169.2020.02.10.05.05.51; Mon, 10 Feb 2020 05:06:04 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=Xw2S4PS2; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730819AbgBJNF3 (ORCPT + 99 others); Mon, 10 Feb 2020 08:05:29 -0500 Received: from mail.kernel.org ([198.145.29.99]:39160 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727895AbgBJMkC (ORCPT ); Mon, 10 Feb 2020 07:40:02 -0500 Received: from localhost (unknown [209.37.97.194]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id DF1562173E; Mon, 10 Feb 2020 12:40:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1581338402; bh=bX7GnoWQ6l6nAAzkQaHSk/xwhKV1gQokzvDLbi/ZR5M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Xw2S4PS2s+QODCTK4UEkCfK4XdMYL2OiJb8joDijcIGAV5x3tOK7Ei07dfZ1z+H9w TN8De6OpNKunDwWbZow4adRW0VHvfo+OWZdvOcrCpEV+d3ZfTUOsqeQoMHrcoDolm+ xE7IbsDb0maQuT+FHQevbm7GHtHSDSw3rXmTOgIg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Biggers Subject: [PATCH 5.5 101/367] fscrypt: dont print name of busy file when removing key Date: Mon, 10 Feb 2020 04:30:14 -0800 Message-Id: <20200210122433.696258343@linuxfoundation.org> X-Mailer: git-send-email 2.25.0 In-Reply-To: <20200210122423.695146547@linuxfoundation.org> References: <20200210122423.695146547@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Eric Biggers commit 13a10da94615d81087e718517794f2868a8b3fab upstream. When an encryption key can't be fully removed due to file(s) protected by it still being in-use, we shouldn't really print the path to one of these files to the kernel log, since parts of this path are likely to be encrypted on-disk, and (depending on how the system is set up) the confidentiality of this path might be lost by printing it to the log. This is a trade-off: a single file path often doesn't matter at all, especially if it's a directory; the kernel log might still be protected in some way; and I had originally hoped that any "inode(s) still busy" bugs (which are security weaknesses in their own right) would be quickly fixed and that to do so it would be super helpful to always know the file path and not have to run 'find dir -inum $inum' after the fact. But in practice, these bugs can be hard to fix (e.g. due to asynchronous process killing that is difficult to eliminate, for performance reasons), and also not tied to specific files, so knowing a file path doesn't necessarily help. So to be safe, for now let's just show the inode number, not the path. If someone really wants to know a path they can use 'find -inum'. Fixes: b1c0ec3599f4 ("fscrypt: add FS_IOC_REMOVE_ENCRYPTION_KEY ioctl") Cc: # v5.4+ Link: https://lore.kernel.org/r/20200120060732.390362-1-ebiggers@kernel.org Signed-off-by: Eric Biggers Signed-off-by: Greg Kroah-Hartman --- fs/crypto/keyring.c | 15 ++------------- 1 file changed, 2 insertions(+), 13 deletions(-) --- a/fs/crypto/keyring.c +++ b/fs/crypto/keyring.c @@ -666,9 +666,6 @@ static int check_for_busy_inodes(struct struct list_head *pos; size_t busy_count = 0; unsigned long ino; - struct dentry *dentry; - char _path[256]; - char *path = NULL; spin_lock(&mk->mk_decrypted_inodes_lock); @@ -687,22 +684,14 @@ static int check_for_busy_inodes(struct struct fscrypt_info, ci_master_key_link)->ci_inode; ino = inode->i_ino; - dentry = d_find_alias(inode); } spin_unlock(&mk->mk_decrypted_inodes_lock); - if (dentry) { - path = dentry_path(dentry, _path, sizeof(_path)); - dput(dentry); - } - if (IS_ERR_OR_NULL(path)) - path = "(unknown)"; - fscrypt_warn(NULL, - "%s: %zu inode(s) still busy after removing key with %s %*phN, including ino %lu (%s)", + "%s: %zu inode(s) still busy after removing key with %s %*phN, including ino %lu", sb->s_id, busy_count, master_key_spec_type(&mk->mk_spec), master_key_spec_len(&mk->mk_spec), (u8 *)&mk->mk_spec.u, - ino, path); + ino); return -EBUSY; }