On Thu, Sep 22, 2016 at 02:24:35PM +0200, Richard Weinberger wrote: > Hi! > > Both ext4 and f2fs check in the file open code the context of the parent directory too: > > ext4: > if (ext4_encrypted_inode(d_inode(dir)) && > !fscrypt_has_permitted_context(d_inode(dir), inode)) { > ext4_warning(inode->i_sb, > "Inconsistent encryption contexts: %lu/%lu", > (unsigned long) d_inode(dir)->i_ino, > (unsigned long) inode->i_ino); > dput(dir); > return -EPERM; > } > > f2fs: > if (f2fs_encrypted_inode(d_inode(dir)) && > !fscrypt_has_permitted_context(d_inode(dir), inode)) { > dput(dir); > return -EPERM; > } > > Why do we need this check? AFAIK this situation can never happen unless due to > a bug in the filesystem code. Or in the case of a malicious attacker who is trying to achieve an off-line attack on your file system.... applications aren't going to be checking to see if they are writing their file with encryption enabled (and with the correct key), because they will largely be encryption oblivious. So imagine a case where you have a file, say, dissidents.txt. This file is encrypted, and is in a encrypted directory. The bad guy, in an offline attack (e.g., using a tool like debugfs), creates a replacement directory which is unencrypted, and creates a link to the encrypted dissidents.txt file to that replacement directory. You then go back to your hotel room in Beijing, boot your laptop, fire up your editor, and then edit the dissidents.txt file. You have the keys, so it is read in just fine into vi or emacs. But when when you write out the file, the editor writes the file into dissidents.txt.new, calls fsync on it, and then renames dissidents.txt to dissidents.txt~, and renames dissidents.txt.new to dissidents.txt. But since it is now in an unencrypted directory, dissidents.txt is now unencrypted. You then leave the hotel room, and the MSS agent goes back to your room, and completes the exfiltration of dissidents.txt. Cheers, - Ted P.S. If you're from China, replace MSS with FBI, and Beijing with Washington, D.C. :-) The principle is the same in either case. -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html