blob: f3cc6f8bd39a7f9c834cb951c854012002d43a4a [file] [log] [blame]
/*
* Copyright (C) 2021 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
use log::warn;
use nix::sys::stat::Mode;
use std::collections::{hash_map, HashMap};
use std::ffi::{CString, OsString};
use std::io;
use std::os::unix::ffi::OsStringExt;
use std::path::{Path, PathBuf};
use super::attr::Attr;
use super::remote_file::RemoteFileEditor;
use super::{validate_basename, VirtFdService, VirtFdServiceStatus};
use crate::fsverity::VerifiedFileEditor;
use crate::fusefs::{AuthFsDirEntry, Inode};
const MAX_ENTRIES: u16 = 100; // Arbitrary limit
struct InodeInfo {
inode: Inode,
// This information is duplicated since it is also available in `AuthFs::inode_table` via the
// type system. But it makes it simple to deal with deletion, where otherwise we need to get a
// mutable parent directory in the table, and query the table for directory/file type checking
// at the same time.
is_dir: bool,
}
/// A remote directory backed by a remote directory FD, where the provider/fd_server is not
/// trusted.
///
/// The directory is assumed empty initially without the trust to the storage. Functionally, when
/// the backing storage is not clean, the fd_server can fail to create a file or directory when
/// there is name collision. From RemoteDirEditor's perspective of security, the creation failure
/// is just one of possible errors that can happen, and what matters is RemoteDirEditor maintains
/// the integrity itself.
///
/// When new files are created through RemoteDirEditor, the file integrity are maintained within the
/// VM. Similarly, integrity (namely the list of entries) of the directory, or new directories
/// created within such a directory, are also maintained within the VM. A compromised fd_server or
/// malicious client can't affect the view to the files and directories within such a directory in
/// the VM.
pub struct RemoteDirEditor {
service: VirtFdService,
remote_dir_fd: i32,
/// Mapping of entry names to the corresponding inode. The actual file/directory is stored in
/// the global pool in fusefs.
entries: HashMap<PathBuf, InodeInfo>,
}
impl RemoteDirEditor {
pub fn new(service: VirtFdService, remote_dir_fd: i32) -> Self {
RemoteDirEditor { service, remote_dir_fd, entries: HashMap::new() }
}
/// Returns the number of entries created.
pub fn number_of_entries(&self) -> u16 {
self.entries.len() as u16 // limited to MAX_ENTRIES
}
/// Creates a remote file named `basename` with corresponding `inode` at the current directory.
pub fn create_file(
&mut self,
basename: &Path,
inode: Inode,
mode: libc::mode_t,
) -> io::Result<(VerifiedFileEditor<RemoteFileEditor>, Attr)> {
let mode = self.validate_arguments(basename, mode)?;
let basename_str =
basename.to_str().ok_or_else(|| io::Error::from_raw_os_error(libc::EINVAL))?;
let new_fd = self
.service
.createFileInDirectory(self.remote_dir_fd, basename_str, mode as i32)
.map_err(into_io_error)?;
let new_remote_file =
VerifiedFileEditor::new(RemoteFileEditor::new(self.service.clone(), new_fd));
self.entries.insert(basename.to_path_buf(), InodeInfo { inode, is_dir: false });
let new_attr = Attr::new_file_with_mode(self.service.clone(), new_fd, mode);
Ok((new_remote_file, new_attr))
}
/// Creates a remote directory named `basename` with corresponding `inode` at the current
/// directory.
pub fn mkdir(
&mut self,
basename: &Path,
inode: Inode,
mode: libc::mode_t,
) -> io::Result<(RemoteDirEditor, Attr)> {
let mode = self.validate_arguments(basename, mode)?;
let basename_str =
basename.to_str().ok_or_else(|| io::Error::from_raw_os_error(libc::EINVAL))?;
let new_fd = self
.service
.createDirectoryInDirectory(self.remote_dir_fd, basename_str, mode as i32)
.map_err(into_io_error)?;
let new_remote_dir = RemoteDirEditor::new(self.service.clone(), new_fd);
self.entries.insert(basename.to_path_buf(), InodeInfo { inode, is_dir: true });
let new_attr = Attr::new_dir_with_mode(self.service.clone(), new_fd, mode);
Ok((new_remote_dir, new_attr))
}
/// Deletes a file
pub fn delete_file(&mut self, basename: &Path) -> io::Result<Inode> {
let inode = self.force_delete_entry(basename, /* expect_dir */ false)?;
let basename_str =
basename.to_str().ok_or_else(|| io::Error::from_raw_os_error(libc::EINVAL))?;
if let Err(e) = self.service.deleteFile(self.remote_dir_fd, basename_str) {
// Ignore the error to honor the local state.
warn!("Deletion on the host is reportedly failed: {:?}", e);
}
Ok(inode)
}
/// Forces to delete a directory. The caller must only call if `basename` is a directory and
/// empty.
pub fn force_delete_directory(&mut self, basename: &Path) -> io::Result<Inode> {
let inode = self.force_delete_entry(basename, /* expect_dir */ true)?;
let basename_str =
basename.to_str().ok_or_else(|| io::Error::from_raw_os_error(libc::EINVAL))?;
if let Err(e) = self.service.deleteDirectory(self.remote_dir_fd, basename_str) {
// Ignore the error to honor the local state.
warn!("Deletion on the host is reportedly failed: {:?}", e);
}
Ok(inode)
}
/// Returns the inode number of a file or directory named `name` previously created through
/// `RemoteDirEditor`.
pub fn find_inode(&self, name: &Path) -> io::Result<Inode> {
self.entries
.get(name)
.map(|entry| entry.inode)
.ok_or_else(|| io::Error::from_raw_os_error(libc::ENOENT))
}
/// Returns whether the directory has an entry of the given name.
pub fn has_entry(&self, name: &Path) -> bool {
self.entries.contains_key(name)
}
pub fn retrieve_entries(&self) -> io::Result<Vec<AuthFsDirEntry>> {
self.entries
.iter()
.map(|(name, InodeInfo { inode, is_dir })| {
Ok(AuthFsDirEntry { inode: *inode, name: path_to_cstring(name)?, is_dir: *is_dir })
})
.collect::<io::Result<Vec<_>>>()
}
fn force_delete_entry(&mut self, basename: &Path, expect_dir: bool) -> io::Result<Inode> {
// Kernel should only give us a basename.
debug_assert!(validate_basename(basename).is_ok());
if let Some(entry) = self.entries.get(basename) {
match (expect_dir, entry.is_dir) {
(true, false) => Err(io::Error::from_raw_os_error(libc::ENOTDIR)),
(false, true) => Err(io::Error::from_raw_os_error(libc::EISDIR)),
_ => {
let inode = entry.inode;
let _ = self.entries.remove(basename);
Ok(inode)
}
}
} else {
Err(io::Error::from_raw_os_error(libc::ENOENT))
}
}
fn validate_arguments(&self, basename: &Path, mode: u32) -> io::Result<u32> {
// Kernel should only give us a basename.
debug_assert!(validate_basename(basename).is_ok());
if self.entries.contains_key(basename) {
return Err(io::Error::from_raw_os_error(libc::EEXIST));
}
if self.entries.len() >= MAX_ENTRIES.into() {
return Err(io::Error::from_raw_os_error(libc::EMLINK));
}
Ok(Mode::from_bits_truncate(mode).bits())
}
}
/// An in-memory directory representation of a directory structure.
pub struct InMemoryDir(HashMap<PathBuf, InodeInfo>);
impl InMemoryDir {
/// Creates an empty instance of `InMemoryDir`.
pub fn new() -> Self {
// Hash map is empty since "." and ".." are excluded in entries.
InMemoryDir(HashMap::new())
}
/// Returns the number of entries in the directory (not including "." and "..").
pub fn number_of_entries(&self) -> u16 {
self.0.len() as u16 // limited to MAX_ENTRIES
}
/// Adds a directory name and its inode number to the directory. Fails if already exists. The
/// caller is responsible for ensure the inode uniqueness.
pub fn add_dir(&mut self, basename: &Path, inode: Inode) -> io::Result<()> {
self.add_entry(basename, InodeInfo { inode, is_dir: true })
}
/// Adds a file name and its inode number to the directory. Fails if already exists. The
/// caller is responsible for ensure the inode uniqueness.
pub fn add_file(&mut self, basename: &Path, inode: Inode) -> io::Result<()> {
self.add_entry(basename, InodeInfo { inode, is_dir: false })
}
fn add_entry(&mut self, basename: &Path, dir_entry: InodeInfo) -> io::Result<()> {
validate_basename(basename)?;
if self.0.len() >= MAX_ENTRIES.into() {
return Err(io::Error::from_raw_os_error(libc::EMLINK));
}
if let hash_map::Entry::Vacant(entry) = self.0.entry(basename.to_path_buf()) {
entry.insert(dir_entry);
Ok(())
} else {
Err(io::Error::from_raw_os_error(libc::EEXIST))
}
}
/// Looks up an entry inode by name. `None` if not found.
pub fn lookup_inode(&self, basename: &Path) -> Option<Inode> {
self.0.get(basename).map(|entry| entry.inode)
}
pub fn retrieve_entries(&self) -> io::Result<Vec<AuthFsDirEntry>> {
self.0
.iter()
.map(|(name, InodeInfo { inode, is_dir })| {
Ok(AuthFsDirEntry { inode: *inode, name: path_to_cstring(name)?, is_dir: *is_dir })
})
.collect::<io::Result<Vec<_>>>()
}
}
fn path_to_cstring(path: &Path) -> io::Result<CString> {
let bytes = OsString::from(path).into_vec();
CString::new(bytes).map_err(|_| io::Error::from_raw_os_error(libc::EILSEQ))
}
fn into_io_error(e: VirtFdServiceStatus) -> io::Error {
let maybe_errno = e.service_specific_error();
if maybe_errno > 0 {
io::Error::from_raw_os_error(maybe_errno)
} else {
io::Error::new(io::ErrorKind::Other, e.get_description())
}
}