View Issue Details

IDProjectCategoryView StatusLast Update
0007369CentOS-7CentOS-7-Pluspublic2018-10-09 21:54
Reporterensc 
PrioritynormalSeverityminorReproducibilityhave not tried
Status assignedResolutionreopened 
Product Version7.0-1406 
Target VersionFixed in Version 
Summary0007369: RFE: please enable ecryptfs kernel module
DescriptionRHEL7 removed support for ecryptfs. Migration guide suggests dm-crypt but this is unsuitable for many tasks which do not work with block encryption (e.g. encrypting files in the cloud, or encrypting files on NFS/CIFS shares).

Unfortunately, ecryptfs requires a kernel module which is not contained in the default and -plus kernel. So, it would be nice when the plus kernel enables this fs module.
TagsNo tags attached.
abrt_hash
URL

Relationships

related to 0015160 acknowledgedtoracat ecryptfs - qemu lxc guest shoots the host in the head 
related to 0015353 acknowledgedtoracat system crash with a simple rsync on ecryptfs's mount 

Activities

toracat

toracat

2014-07-13 17:01

manager   ~0020419

Last edited: 2014-07-13 17:10

View 2 revisions

I will attempt to enable it in the next kernel update:

# CONFIG_ECRYPT_FS is not set

(File systems -> Miscellaneous filesystems)

toracat

toracat

2014-07-31 11:59

manager   ~0020559

The latest kernel-plus (3.10.0-123.4.4.el7.centos.plus) has the requested feature enabled.
derkuci

derkuci

2015-07-02 20:07

reporter   ~0023557

I have the latest (3.10.0-229.7.2.el7.centos.plus) installed but don't see ecryptfs under /lib/modules/3.10.0-229.7.2.el7.centos.plus.x86_64/kernel/fs/
derkuci

derkuci

2015-07-02 20:18

reporter   ~0023558

This page (http://kozlex.blogspot.com/2015/05/building-ecryptfs-on-redhat-7_19.html) has a partial fix for the "has no member named" issues.
toracat

toracat

2015-07-02 21:33

manager   ~0023559

Thanks for reporting this. I will also look into the bug fix you have referenced.
toracat

toracat

2015-07-02 21:50

manager   ~0023560

Patch file uploaded.

--- a/fs/ecryptfs/main.c 2015-03-06 13:45:38.000000000 -0800
+++ b/fs/ecryptfs/main.c 2015-07-02 14:46:37.000000000 -0700
@@ -567,10 +567,10 @@ static struct dentry *ecryptfs_mount(str
        s->s_maxbytes = path.dentry->d_sb->s_maxbytes;
        s->s_blocksize = path.dentry->d_sb->s_blocksize;
        s->s_magic = ECRYPTFS_SUPER_MAGIC;
- s->s_stack_depth = path.dentry->d_sb->s_stack_depth + 1;
+ s_stack_depth = get_s_stack_depth(path.dentry->d_sb);

        rc = -EINVAL;
- if (s->s_stack_depth > FILESYSTEM_MAX_STACK_DEPTH) {
+ if ( *s_stack_depth > FILESYSTEM_MAX_STACK_DEPTH) {
                pr_err("eCryptfs: maximum fs stacking depth exceeded\n");
                goto out_free;
        }
toracat

toracat

2015-08-06 06:04

manager  

centos-linux-3.10-fix-ecryptfs-error-bug7369.patch (1,205 bytes)
https://bugs.centos.org/view.php?id=7369
http://kozlex.blogspot.com/2015/05/building-ecryptfs-on-redhat-7_19.html

To fix ecryptfs and build it in the kernel follow is the partial fix:
This is a fix that will not be proposed to upstream cause it is not 
compatible with other kernels; instead it is a patch to make ecryptfs 
work on Rhel7 only.

--- a/fs/ecryptfs/main.c	2015-03-06 13:45:38.000000000 -0800
+++ b/fs/ecryptfs/main.c	2015-07-02 14:46:37.000000000 -0700
@@ -500,6 +500,7 @@ static struct dentry *ecryptfs_mount(str
 	struct path path;
 	uid_t check_ruid;
 	int rc;
+	int *s_stack_depth;
 
 	sbi = kmem_cache_zalloc(ecryptfs_sb_info_cache, GFP_KERNEL);
 	if (!sbi) {
@@ -567,10 +568,10 @@ static struct dentry *ecryptfs_mount(str
 	s->s_maxbytes = path.dentry->d_sb->s_maxbytes;
 	s->s_blocksize = path.dentry->d_sb->s_blocksize;
 	s->s_magic = ECRYPTFS_SUPER_MAGIC;
-	s->s_stack_depth = path.dentry->d_sb->s_stack_depth + 1;
+	s_stack_depth = get_s_stack_depth(path.dentry->d_sb);
 
 	rc = -EINVAL;
-	if (s->s_stack_depth > FILESYSTEM_MAX_STACK_DEPTH) {
+	if ( *s_stack_depth > FILESYSTEM_MAX_STACK_DEPTH) {
 		pr_err("eCryptfs: maximum fs stacking depth exceeded\n");
 		goto out_free;
 	}
toracat

toracat

2015-08-06 06:06

manager   ~0023787

The actual patch uploaded: centos-linux-3.10-fix-ecryptfs-error-bug7369.patch
toracat

toracat

2015-08-06 15:48

manager   ~0023796

kernel-3.10.0-229.11.1.el7 is out. The plus kernel now has CONFIG_ECRYPT_FS enabled with the patch in this bug report.
toracat

toracat

2018-10-04 15:24

manager   ~0032859

There are at least two reports that indicate some issue with ecryptfs ( for example https://bugs.centos.org/view.php?id=15353 ). We may have to disable ECRYPT_FS unless a fix is found.
pgreco

pgreco

2018-10-04 16:42

developer   ~0032861

Attempt to fix this problem by updating ecryptfs to 3.10.108, + cherry pick from upstream.

centos-linux-3.10-ecryptfs-3.10.108.patch (4,447 bytes)
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index f71ec125290d..1da2446bf6b0 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -2102,7 +2102,6 @@ ecryptfs_decode_from_filename(unsigned char *dst, size_t *dst_size,
 			break;
 		case 2:
 			dst[dst_byte_offset++] |= (src_byte);
-			dst[dst_byte_offset] = 0;
 			current_bit_offset = 0;
 			break;
 		}
diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
index a7abbea2c096..d4644cc938ba 100644
--- a/fs/ecryptfs/file.c
+++ b/fs/ecryptfs/file.c
@@ -183,6 +183,19 @@ out:
 	return rc;
 }
 
+static int ecryptfs_mmap(struct file *file, struct vm_area_struct *vma)
+{
+	struct file *lower_file = ecryptfs_file_to_lower(file);
+	/*
+	 * Don't allow mmap on top of file systems that don't support it
+	 * natively.  If FILESYSTEM_MAX_STACK_DEPTH > 2 or ecryptfs
+	 * allows recursive mounting, this will need to be extended.
+	 */
+	if (!lower_file->f_op->mmap)
+		return -ENODEV;
+	return generic_file_mmap(file, vma);
+}
+
 /**
  * ecryptfs_open
  * @inode: inode speciying file to open
@@ -196,23 +209,11 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
 {
 	int rc = 0;
 	struct ecryptfs_crypt_stat *crypt_stat = NULL;
-	struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
 	struct dentry *ecryptfs_dentry = file->f_path.dentry;
 	/* Private value of ecryptfs_dentry allocated in
 	 * ecryptfs_lookup() */
 	struct ecryptfs_file_info *file_info;
 
-	mount_crypt_stat = &ecryptfs_superblock_to_private(
-		ecryptfs_dentry->d_sb)->mount_crypt_stat;
-	if ((mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED)
-	    && ((file->f_flags & O_WRONLY) || (file->f_flags & O_RDWR)
-		|| (file->f_flags & O_CREAT) || (file->f_flags & O_TRUNC)
-		|| (file->f_flags & O_APPEND))) {
-		printk(KERN_WARNING "Mount has encrypted view enabled; "
-		       "files may only be read\n");
-		rc = -EPERM;
-		goto out;
-	}
 	/* Released in ecryptfs_release or end of function if failure */
 	file_info = kmem_cache_zalloc(ecryptfs_file_info_cache, GFP_KERNEL);
 	ecryptfs_set_file_private(file, file_info);
@@ -370,7 +371,7 @@ const struct file_operations ecryptfs_main_fops = {
 #ifdef CONFIG_COMPAT
 	.compat_ioctl = ecryptfs_compat_ioctl,
 #endif
-	.mmap = generic_file_mmap,
+	.mmap = ecryptfs_mmap,
 	.open = ecryptfs_open,
 	.flush = ecryptfs_flush,
 	.release = ecryptfs_release,
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index 5eab400e2590..41baf8b5e0eb 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -1051,7 +1051,7 @@ ecryptfs_setxattr(struct dentry *dentry, const char *name, const void *value,
 	}
 
 	rc = vfs_setxattr(lower_dentry, name, value, size, flags);
-	if (!rc)
+	if (!rc && dentry->d_inode)
 		fsstack_copy_attr_all(dentry->d_inode, lower_dentry->d_inode);
 out:
 	return rc;
diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
index e924cf45aad9..329a9cc2b2eb 100644
--- a/fs/ecryptfs/main.c
+++ b/fs/ecryptfs/main.c
@@ -494,6 +494,7 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags
 {
 	struct super_block *s;
 	struct ecryptfs_sb_info *sbi;
+	struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
 	struct ecryptfs_dentry_info *root_info;
 	const char *err = "Getting sb failed";
 	struct inode *inode;
@@ -512,6 +513,7 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags
 		err = "Error parsing options";
 		goto out;
 	}
+	mount_crypt_stat = &sbi->mount_crypt_stat;
 
 	s = sget(fs_type, NULL, set_anon_super, flags, NULL);
 	if (IS_ERR(s)) {
@@ -558,11 +560,19 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags
 
 	/**
 	 * Set the POSIX ACL flag based on whether they're enabled in the lower
-	 * mount. Force a read-only eCryptfs mount if the lower mount is ro.
-	 * Allow a ro eCryptfs mount even when the lower mount is rw.
+	 * mount.
 	 */
 	s->s_flags = flags & ~MS_POSIXACL;
-	s->s_flags |= path.dentry->d_sb->s_flags & (MS_RDONLY | MS_POSIXACL);
+	s->s_flags |= path.dentry->d_sb->s_flags & MS_POSIXACL;
+
+	/**
+	 * Force a read-only eCryptfs mount when:
+	 *   1) The lower mount is ro
+	 *   2) The ecryptfs_encrypted_view mount option is specified
+	 */
+	if (path.dentry->d_sb->s_flags & MS_RDONLY ||
+	    mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED)
+		s->s_flags |= MS_RDONLY;
 
 	s->s_maxbytes = path.dentry->d_sb->s_maxbytes;
 	s->s_blocksize = path.dentry->d_sb->s_blocksize;
centos-linux-3.10-ecryptfs-4.4-LTS.patch (1,474 bytes)
From 9c093a258350e86f781f23fbbef4e3d761c6b1e3 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 22 Aug 2017 23:41:28 +0300
Subject: eCryptfs: use after free in ecryptfs_release_messaging()

commit db86be3a12d0b6e5c5b51c2ab2a48f06329cb590 upstream.

We're freeing the list iterator so we should be using the _safe()
version of hlist_for_each_entry().

Fixes: 88b4a07e6610 ("[PATCH] eCryptfs: Public key transport mechanism")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ecryptfs/messaging.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/fs/ecryptfs/messaging.c b/fs/ecryptfs/messaging.c
index 286f10b0363b..4f457d5c4933 100644
--- a/fs/ecryptfs/messaging.c
+++ b/fs/ecryptfs/messaging.c
@@ -442,15 +442,16 @@ void ecryptfs_release_messaging(void)
 	}
 	if (ecryptfs_daemon_hash) {
 		struct ecryptfs_daemon *daemon;
+		struct hlist_node *n;
 		int i;
 
 		mutex_lock(&ecryptfs_daemon_hash_mux);
 		for (i = 0; i < (1 << ecryptfs_hash_bits); i++) {
 			int rc;
 
-			hlist_for_each_entry(daemon,
-					     &ecryptfs_daemon_hash[i],
-					     euid_chain) {
+			hlist_for_each_entry_safe(daemon, n,
+						  &ecryptfs_daemon_hash[i],
+						  euid_chain) {
 				rc = ecryptfs_exorcise_daemon(daemon);
 				if (rc)
 					printk(KERN_ERR "%s: Error whilst "
-- 
cgit 1.2-0.3.lf.el7

toracat

toracat

2018-10-04 16:59

manager   ~0032862

A set of the patched kernel-plus package (kernel-plus-3.10.0-862.14.4.el7.centos.plus.1) is now available for testing:

https://people.centos.org/toracat/kernel/7/plus/bug_ecrypt/

Please test and report back.
toracat

toracat

2018-10-09 21:54

manager   ~0032888

A new kernel set has been built with a new patch submitted by @pgreco.
The test kernel is here https://people.centos.org/toracat/kernel/7/plus/bug_ecrypt_3/
@pgreco managed to replicate the bug locally, and with the fix applied, it doesn't crash anymore.
See https://bugs.centos.org/view.php?id=15353#c32886 for details.

Issue History

Date Modified Username Field Change
2014-07-13 16:45 ensc New Issue
2014-07-13 17:01 toracat Note Added: 0020419
2014-07-13 17:01 toracat Status new => assigned
2014-07-13 17:10 toracat Note Edited: 0020419 View Revisions
2014-07-31 11:59 toracat Note Added: 0020559
2015-07-02 20:07 derkuci Note Added: 0023557
2015-07-02 20:18 derkuci Note Added: 0023558
2015-07-02 21:33 toracat Note Added: 0023559
2015-07-02 21:50 toracat File Added: ecryptfs.patch
2015-07-02 21:50 toracat Note Added: 0023560
2015-08-06 06:04 toracat File Added: centos-linux-3.10-fix-ecryptfs-error-bug7369.patch
2015-08-06 06:05 toracat File Deleted: ecryptfs.patch
2015-08-06 06:06 toracat Note Added: 0023787
2015-08-06 15:48 toracat Note Added: 0023796
2015-10-19 00:13 toracat Status assigned => resolved
2015-10-19 00:13 toracat Resolution open => fixed
2018-10-04 15:24 toracat Note Added: 0032859
2018-10-04 15:24 toracat Status resolved => assigned
2018-10-04 15:24 toracat Resolution fixed => reopened
2018-10-04 15:27 toracat Relationship added related to 0015353
2018-10-04 15:39 toracat Relationship added related to 0015160
2018-10-04 16:42 pgreco File Added: centos-linux-3.10-ecryptfs-3.10.108.patch
2018-10-04 16:42 pgreco File Added: centos-linux-3.10-ecryptfs-4.4-LTS.patch
2018-10-04 16:42 pgreco Note Added: 0032861
2018-10-04 16:59 toracat Note Added: 0032862
2018-10-09 21:54 toracat Note Added: 0032888