blob: 2e1bc33d81e45f038e30319f4e4ff1b365ca4d57 [file] [log] [blame]
Victor Hsieh45636232021-10-15 17:52:51 -07001/*
2 * Copyright (C) 2021 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17use std::collections::HashMap;
18use std::io;
19use std::path::{Path, PathBuf};
20
21use super::remote_file::RemoteFileEditor;
22use super::{VirtFdService, VirtFdServiceStatus};
23use crate::fsverity::VerifiedFileEditor;
24use crate::fusefs::Inode;
25
26const MAX_ENTRIES: u16 = 100; // Arbitrary limit
27
28/// A remote directory backed by a remote directory FD, where the provider/fd_server is not
29/// trusted.
30///
31/// The directory is assumed empty initially without the trust to the storage. Functionally, when
32/// the backing storage is not clean, the fd_server can fail to create a file or directory when
33/// there is name collision. From RemoteDirEditor's perspective of security, the creation failure
34/// is just one of possible errors that can happen, and what matters is RemoteDirEditor maintains
35/// the integrity itself.
36///
37/// When new files are created through RemoteDirEditor, the file integrity are maintained within the
38/// VM. Similarly, integrity (namely the list of entries) of the directory, or new directories
39/// created within such a directory, are also maintained within the VM. A compromised fd_server or
40/// malicious client can't affect the view to the files and directories within such a directory in
41/// the VM.
42pub struct RemoteDirEditor {
43 service: VirtFdService,
44 remote_dir_fd: i32,
45
46 /// Mapping of entry names to the corresponding inode number. The actual file/directory is
47 /// stored in the global pool in fusefs.
48 entries: HashMap<PathBuf, Inode>,
49}
50
51impl RemoteDirEditor {
52 pub fn new(service: VirtFdService, remote_dir_fd: i32) -> Self {
53 RemoteDirEditor { service, remote_dir_fd, entries: HashMap::new() }
54 }
55
56 /// Returns the number of entries created.
57 pub fn number_of_entries(&self) -> u16 {
58 self.entries.len() as u16 // limited to MAX_ENTRIES
59 }
60
61 /// Creates a remote file at the current directory. If succeed, the returned remote FD is
62 /// stored in `entries` as the inode number.
63 pub fn create_file(
64 &mut self,
65 basename: &Path,
66 ) -> io::Result<(Inode, VerifiedFileEditor<RemoteFileEditor>)> {
67 self.validate_argument(basename)?;
68
69 let basename_str =
70 basename.to_str().ok_or_else(|| io::Error::from_raw_os_error(libc::EINVAL))?;
71 let new_fd = self
72 .service
73 .createFileInDirectory(self.remote_dir_fd, basename_str)
74 .map_err(into_io_error)?;
75 let new_inode = new_fd as Inode;
76
77 let new_remote_file =
78 VerifiedFileEditor::new(RemoteFileEditor::new(self.service.clone(), new_fd));
79 self.entries.insert(basename.to_path_buf(), new_inode);
80 Ok((new_inode, new_remote_file))
81 }
82
83 /// Creates a remote directory at the current directory. If succeed, the returned remote FD is
84 /// stored in `entries` as the inode number.
85 pub fn mkdir(&mut self, basename: &Path) -> io::Result<(Inode, RemoteDirEditor)> {
86 self.validate_argument(basename)?;
87
88 let basename_str =
89 basename.to_str().ok_or_else(|| io::Error::from_raw_os_error(libc::EINVAL))?;
90 let new_fd = self
91 .service
92 .createDirectoryInDirectory(self.remote_dir_fd, basename_str)
93 .map_err(into_io_error)?;
94 let new_inode = new_fd as Inode;
95
96 let new_remote_dir = RemoteDirEditor::new(self.service.clone(), new_fd);
97 self.entries.insert(basename.to_path_buf(), new_inode);
98 Ok((new_inode, new_remote_dir))
99 }
100
101 /// Returns the inode number of a file or directory named `name` previously created through
102 /// `RemoteDirEditor`.
103 pub fn find_inode(&self, name: &Path) -> Option<Inode> {
104 self.entries.get(name).copied()
105 }
106
107 fn validate_argument(&self, basename: &Path) -> io::Result<()> {
108 // Kernel should only give us a basename.
109 debug_assert!(basename.parent().is_none());
110 if self.entries.contains_key(basename) {
111 Err(io::Error::from_raw_os_error(libc::EEXIST))
112 } else if self.entries.len() >= MAX_ENTRIES.into() {
113 Err(io::Error::from_raw_os_error(libc::EMLINK))
114 } else {
115 Ok(())
116 }
117 }
118}
119
120fn into_io_error(e: VirtFdServiceStatus) -> io::Error {
121 let maybe_errno = e.service_specific_error();
122 if maybe_errno > 0 {
123 io::Error::from_raw_os_error(maybe_errno)
124 } else {
125 io::Error::new(io::ErrorKind::Other, e.get_description())
126 }
127}