linux-user: Add support for a group of btrfs ioctls used for snapshots
[qemu.git] / tools / virtiofsd / passthrough_ll.c
1 /*
2 * FUSE: Filesystem in Userspace
3 * Copyright (C) 2001-2007 Miklos Szeredi <miklos@szeredi.hu>
4 *
5 * This program can be distributed under the terms of the GNU GPLv2.
6 * See the file COPYING.
7 */
8
9 /*
10 *
11 * This file system mirrors the existing file system hierarchy of the
12 * system, starting at the root file system. This is implemented by
13 * just "passing through" all requests to the corresponding user-space
14 * libc functions. In contrast to passthrough.c and passthrough_fh.c,
15 * this implementation uses the low-level API. Its performance should
16 * be the least bad among the three, but many operations are not
17 * implemented. In particular, it is not possible to remove files (or
18 * directories) because the code necessary to defer actual removal
19 * until the file is not opened anymore would make the example much
20 * more complicated.
21 *
22 * When writeback caching is enabled (-o writeback mount option), it
23 * is only possible to write to files for which the mounting user has
24 * read permissions. This is because the writeback cache requires the
25 * kernel to be able to issue read requests for all files (which the
26 * passthrough filesystem cannot satisfy if it can't read the file in
27 * the underlying filesystem).
28 *
29 * Compile with:
30 *
31 * gcc -Wall passthrough_ll.c `pkg-config fuse3 --cflags --libs` -o
32 * passthrough_ll
33 *
34 * ## Source code ##
35 * \include passthrough_ll.c
36 */
37
38 #include "qemu/osdep.h"
39 #include "qemu/timer.h"
40 #include "fuse_virtio.h"
41 #include "fuse_log.h"
42 #include "fuse_lowlevel.h"
43 #include <assert.h>
44 #include <cap-ng.h>
45 #include <dirent.h>
46 #include <errno.h>
47 #include <glib.h>
48 #include <inttypes.h>
49 #include <limits.h>
50 #include <pthread.h>
51 #include <stdbool.h>
52 #include <stddef.h>
53 #include <stdio.h>
54 #include <stdlib.h>
55 #include <string.h>
56 #include <sys/file.h>
57 #include <sys/mount.h>
58 #include <sys/prctl.h>
59 #include <sys/resource.h>
60 #include <sys/syscall.h>
61 #include <sys/types.h>
62 #include <sys/wait.h>
63 #include <sys/xattr.h>
64 #include <syslog.h>
65 #include <unistd.h>
66
67 #include "passthrough_helpers.h"
68 #include "passthrough_seccomp.h"
69
70 /* Keep track of inode posix locks for each owner. */
71 struct lo_inode_plock {
72 uint64_t lock_owner;
73 int fd; /* fd for OFD locks */
74 };
75
76 struct lo_map_elem {
77 union {
78 struct lo_inode *inode;
79 struct lo_dirp *dirp;
80 int fd;
81 ssize_t freelist;
82 };
83 bool in_use;
84 };
85
86 /* Maps FUSE fh or ino values to internal objects */
87 struct lo_map {
88 struct lo_map_elem *elems;
89 size_t nelems;
90 ssize_t freelist;
91 };
92
93 struct lo_key {
94 ino_t ino;
95 dev_t dev;
96 };
97
98 struct lo_inode {
99 int fd;
100
101 /*
102 * Atomic reference count for this object. The nlookup field holds a
103 * reference and release it when nlookup reaches 0.
104 */
105 gint refcount;
106
107 struct lo_key key;
108
109 /*
110 * This counter keeps the inode alive during the FUSE session.
111 * Incremented when the FUSE inode number is sent in a reply
112 * (FUSE_LOOKUP, FUSE_READDIRPLUS, etc). Decremented when an inode is
113 * released by requests like FUSE_FORGET, FUSE_RMDIR, FUSE_RENAME, etc.
114 *
115 * Note that this value is untrusted because the client can manipulate
116 * it arbitrarily using FUSE_FORGET requests.
117 *
118 * Protected by lo->mutex.
119 */
120 uint64_t nlookup;
121
122 fuse_ino_t fuse_ino;
123 pthread_mutex_t plock_mutex;
124 GHashTable *posix_locks; /* protected by lo_inode->plock_mutex */
125
126 mode_t filetype;
127 };
128
129 struct lo_cred {
130 uid_t euid;
131 gid_t egid;
132 };
133
134 enum {
135 CACHE_NONE,
136 CACHE_AUTO,
137 CACHE_ALWAYS,
138 };
139
140 struct lo_data {
141 pthread_mutex_t mutex;
142 int debug;
143 int writeback;
144 int flock;
145 int posix_lock;
146 int xattr;
147 char *source;
148 char *modcaps;
149 double timeout;
150 int cache;
151 int timeout_set;
152 int readdirplus_set;
153 int readdirplus_clear;
154 struct lo_inode root;
155 GHashTable *inodes; /* protected by lo->mutex */
156 struct lo_map ino_map; /* protected by lo->mutex */
157 struct lo_map dirp_map; /* protected by lo->mutex */
158 struct lo_map fd_map; /* protected by lo->mutex */
159
160 /* An O_PATH file descriptor to /proc/self/fd/ */
161 int proc_self_fd;
162 };
163
164 static const struct fuse_opt lo_opts[] = {
165 { "writeback", offsetof(struct lo_data, writeback), 1 },
166 { "no_writeback", offsetof(struct lo_data, writeback), 0 },
167 { "source=%s", offsetof(struct lo_data, source), 0 },
168 { "flock", offsetof(struct lo_data, flock), 1 },
169 { "no_flock", offsetof(struct lo_data, flock), 0 },
170 { "posix_lock", offsetof(struct lo_data, posix_lock), 1 },
171 { "no_posix_lock", offsetof(struct lo_data, posix_lock), 0 },
172 { "xattr", offsetof(struct lo_data, xattr), 1 },
173 { "no_xattr", offsetof(struct lo_data, xattr), 0 },
174 { "modcaps=%s", offsetof(struct lo_data, modcaps), 0 },
175 { "timeout=%lf", offsetof(struct lo_data, timeout), 0 },
176 { "timeout=", offsetof(struct lo_data, timeout_set), 1 },
177 { "cache=none", offsetof(struct lo_data, cache), CACHE_NONE },
178 { "cache=auto", offsetof(struct lo_data, cache), CACHE_AUTO },
179 { "cache=always", offsetof(struct lo_data, cache), CACHE_ALWAYS },
180 { "readdirplus", offsetof(struct lo_data, readdirplus_set), 1 },
181 { "no_readdirplus", offsetof(struct lo_data, readdirplus_clear), 1 },
182 FUSE_OPT_END
183 };
184 static bool use_syslog = false;
185 static int current_log_level;
186 static void unref_inode_lolocked(struct lo_data *lo, struct lo_inode *inode,
187 uint64_t n);
188
189 static struct {
190 pthread_mutex_t mutex;
191 void *saved;
192 } cap;
193 /* That we loaded cap-ng in the current thread from the saved */
194 static __thread bool cap_loaded = 0;
195
196 static struct lo_inode *lo_find(struct lo_data *lo, struct stat *st);
197
198 static int is_dot_or_dotdot(const char *name)
199 {
200 return name[0] == '.' &&
201 (name[1] == '\0' || (name[1] == '.' && name[2] == '\0'));
202 }
203
204 /* Is `path` a single path component that is not "." or ".."? */
205 static int is_safe_path_component(const char *path)
206 {
207 if (strchr(path, '/')) {
208 return 0;
209 }
210
211 return !is_dot_or_dotdot(path);
212 }
213
214 static struct lo_data *lo_data(fuse_req_t req)
215 {
216 return (struct lo_data *)fuse_req_userdata(req);
217 }
218
219 /*
220 * Load capng's state from our saved state if the current thread
221 * hadn't previously been loaded.
222 * returns 0 on success
223 */
224 static int load_capng(void)
225 {
226 if (!cap_loaded) {
227 pthread_mutex_lock(&cap.mutex);
228 capng_restore_state(&cap.saved);
229 /*
230 * restore_state free's the saved copy
231 * so make another.
232 */
233 cap.saved = capng_save_state();
234 if (!cap.saved) {
235 pthread_mutex_unlock(&cap.mutex);
236 fuse_log(FUSE_LOG_ERR, "capng_save_state (thread)\n");
237 return -EINVAL;
238 }
239 pthread_mutex_unlock(&cap.mutex);
240
241 /*
242 * We want to use the loaded state for our pid,
243 * not the original
244 */
245 capng_setpid(syscall(SYS_gettid));
246 cap_loaded = true;
247 }
248 return 0;
249 }
250
251 /*
252 * Helpers for dropping and regaining effective capabilities. Returns 0
253 * on success, error otherwise
254 */
255 static int drop_effective_cap(const char *cap_name, bool *cap_dropped)
256 {
257 int cap, ret;
258
259 cap = capng_name_to_capability(cap_name);
260 if (cap < 0) {
261 ret = errno;
262 fuse_log(FUSE_LOG_ERR, "capng_name_to_capability(%s) failed:%s\n",
263 cap_name, strerror(errno));
264 goto out;
265 }
266
267 if (load_capng()) {
268 ret = errno;
269 fuse_log(FUSE_LOG_ERR, "load_capng() failed\n");
270 goto out;
271 }
272
273 /* We dont have this capability in effective set already. */
274 if (!capng_have_capability(CAPNG_EFFECTIVE, cap)) {
275 ret = 0;
276 goto out;
277 }
278
279 if (capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, cap)) {
280 ret = errno;
281 fuse_log(FUSE_LOG_ERR, "capng_update(DROP,) failed\n");
282 goto out;
283 }
284
285 if (capng_apply(CAPNG_SELECT_CAPS)) {
286 ret = errno;
287 fuse_log(FUSE_LOG_ERR, "drop:capng_apply() failed\n");
288 goto out;
289 }
290
291 ret = 0;
292 if (cap_dropped) {
293 *cap_dropped = true;
294 }
295
296 out:
297 return ret;
298 }
299
300 static int gain_effective_cap(const char *cap_name)
301 {
302 int cap;
303 int ret = 0;
304
305 cap = capng_name_to_capability(cap_name);
306 if (cap < 0) {
307 ret = errno;
308 fuse_log(FUSE_LOG_ERR, "capng_name_to_capability(%s) failed:%s\n",
309 cap_name, strerror(errno));
310 goto out;
311 }
312
313 if (load_capng()) {
314 ret = errno;
315 fuse_log(FUSE_LOG_ERR, "load_capng() failed\n");
316 goto out;
317 }
318
319 if (capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, cap)) {
320 ret = errno;
321 fuse_log(FUSE_LOG_ERR, "capng_update(ADD,) failed\n");
322 goto out;
323 }
324
325 if (capng_apply(CAPNG_SELECT_CAPS)) {
326 ret = errno;
327 fuse_log(FUSE_LOG_ERR, "gain:capng_apply() failed\n");
328 goto out;
329 }
330 ret = 0;
331
332 out:
333 return ret;
334 }
335
336 static void lo_map_init(struct lo_map *map)
337 {
338 map->elems = NULL;
339 map->nelems = 0;
340 map->freelist = -1;
341 }
342
343 static void lo_map_destroy(struct lo_map *map)
344 {
345 free(map->elems);
346 }
347
348 static int lo_map_grow(struct lo_map *map, size_t new_nelems)
349 {
350 struct lo_map_elem *new_elems;
351 size_t i;
352
353 if (new_nelems <= map->nelems) {
354 return 1;
355 }
356
357 new_elems = realloc(map->elems, sizeof(map->elems[0]) * new_nelems);
358 if (!new_elems) {
359 return 0;
360 }
361
362 for (i = map->nelems; i < new_nelems; i++) {
363 new_elems[i].freelist = i + 1;
364 new_elems[i].in_use = false;
365 }
366 new_elems[new_nelems - 1].freelist = -1;
367
368 map->elems = new_elems;
369 map->freelist = map->nelems;
370 map->nelems = new_nelems;
371 return 1;
372 }
373
374 static struct lo_map_elem *lo_map_alloc_elem(struct lo_map *map)
375 {
376 struct lo_map_elem *elem;
377
378 if (map->freelist == -1 && !lo_map_grow(map, map->nelems + 256)) {
379 return NULL;
380 }
381
382 elem = &map->elems[map->freelist];
383 map->freelist = elem->freelist;
384
385 elem->in_use = true;
386
387 return elem;
388 }
389
390 static struct lo_map_elem *lo_map_reserve(struct lo_map *map, size_t key)
391 {
392 ssize_t *prev;
393
394 if (!lo_map_grow(map, key + 1)) {
395 return NULL;
396 }
397
398 for (prev = &map->freelist; *prev != -1;
399 prev = &map->elems[*prev].freelist) {
400 if (*prev == key) {
401 struct lo_map_elem *elem = &map->elems[key];
402
403 *prev = elem->freelist;
404 elem->in_use = true;
405 return elem;
406 }
407 }
408 return NULL;
409 }
410
411 static struct lo_map_elem *lo_map_get(struct lo_map *map, size_t key)
412 {
413 if (key >= map->nelems) {
414 return NULL;
415 }
416 if (!map->elems[key].in_use) {
417 return NULL;
418 }
419 return &map->elems[key];
420 }
421
422 static void lo_map_remove(struct lo_map *map, size_t key)
423 {
424 struct lo_map_elem *elem;
425
426 if (key >= map->nelems) {
427 return;
428 }
429
430 elem = &map->elems[key];
431 if (!elem->in_use) {
432 return;
433 }
434
435 elem->in_use = false;
436
437 elem->freelist = map->freelist;
438 map->freelist = key;
439 }
440
441 /* Assumes lo->mutex is held */
442 static ssize_t lo_add_fd_mapping(fuse_req_t req, int fd)
443 {
444 struct lo_map_elem *elem;
445
446 elem = lo_map_alloc_elem(&lo_data(req)->fd_map);
447 if (!elem) {
448 return -1;
449 }
450
451 elem->fd = fd;
452 return elem - lo_data(req)->fd_map.elems;
453 }
454
455 /* Assumes lo->mutex is held */
456 static ssize_t lo_add_dirp_mapping(fuse_req_t req, struct lo_dirp *dirp)
457 {
458 struct lo_map_elem *elem;
459
460 elem = lo_map_alloc_elem(&lo_data(req)->dirp_map);
461 if (!elem) {
462 return -1;
463 }
464
465 elem->dirp = dirp;
466 return elem - lo_data(req)->dirp_map.elems;
467 }
468
469 /* Assumes lo->mutex is held */
470 static ssize_t lo_add_inode_mapping(fuse_req_t req, struct lo_inode *inode)
471 {
472 struct lo_map_elem *elem;
473
474 elem = lo_map_alloc_elem(&lo_data(req)->ino_map);
475 if (!elem) {
476 return -1;
477 }
478
479 elem->inode = inode;
480 return elem - lo_data(req)->ino_map.elems;
481 }
482
483 static void lo_inode_put(struct lo_data *lo, struct lo_inode **inodep)
484 {
485 struct lo_inode *inode = *inodep;
486
487 if (!inode) {
488 return;
489 }
490
491 *inodep = NULL;
492
493 if (g_atomic_int_dec_and_test(&inode->refcount)) {
494 close(inode->fd);
495 free(inode);
496 }
497 }
498
499 /* Caller must release refcount using lo_inode_put() */
500 static struct lo_inode *lo_inode(fuse_req_t req, fuse_ino_t ino)
501 {
502 struct lo_data *lo = lo_data(req);
503 struct lo_map_elem *elem;
504
505 pthread_mutex_lock(&lo->mutex);
506 elem = lo_map_get(&lo->ino_map, ino);
507 if (elem) {
508 g_atomic_int_inc(&elem->inode->refcount);
509 }
510 pthread_mutex_unlock(&lo->mutex);
511
512 if (!elem) {
513 return NULL;
514 }
515
516 return elem->inode;
517 }
518
519 /*
520 * TODO Remove this helper and force callers to hold an inode refcount until
521 * they are done with the fd. This will be done in a later patch to make
522 * review easier.
523 */
524 static int lo_fd(fuse_req_t req, fuse_ino_t ino)
525 {
526 struct lo_inode *inode = lo_inode(req, ino);
527 int fd;
528
529 if (!inode) {
530 return -1;
531 }
532
533 fd = inode->fd;
534 lo_inode_put(lo_data(req), &inode);
535 return fd;
536 }
537
538 static void lo_init(void *userdata, struct fuse_conn_info *conn)
539 {
540 struct lo_data *lo = (struct lo_data *)userdata;
541
542 if (conn->capable & FUSE_CAP_EXPORT_SUPPORT) {
543 conn->want |= FUSE_CAP_EXPORT_SUPPORT;
544 }
545
546 if (lo->writeback && conn->capable & FUSE_CAP_WRITEBACK_CACHE) {
547 fuse_log(FUSE_LOG_DEBUG, "lo_init: activating writeback\n");
548 conn->want |= FUSE_CAP_WRITEBACK_CACHE;
549 }
550 if (conn->capable & FUSE_CAP_FLOCK_LOCKS) {
551 if (lo->flock) {
552 fuse_log(FUSE_LOG_DEBUG, "lo_init: activating flock locks\n");
553 conn->want |= FUSE_CAP_FLOCK_LOCKS;
554 } else {
555 fuse_log(FUSE_LOG_DEBUG, "lo_init: disabling flock locks\n");
556 conn->want &= ~FUSE_CAP_FLOCK_LOCKS;
557 }
558 }
559
560 if (conn->capable & FUSE_CAP_POSIX_LOCKS) {
561 if (lo->posix_lock) {
562 fuse_log(FUSE_LOG_DEBUG, "lo_init: activating posix locks\n");
563 conn->want |= FUSE_CAP_POSIX_LOCKS;
564 } else {
565 fuse_log(FUSE_LOG_DEBUG, "lo_init: disabling posix locks\n");
566 conn->want &= ~FUSE_CAP_POSIX_LOCKS;
567 }
568 }
569
570 if ((lo->cache == CACHE_NONE && !lo->readdirplus_set) ||
571 lo->readdirplus_clear) {
572 fuse_log(FUSE_LOG_DEBUG, "lo_init: disabling readdirplus\n");
573 conn->want &= ~FUSE_CAP_READDIRPLUS;
574 }
575 }
576
577 static void lo_getattr(fuse_req_t req, fuse_ino_t ino,
578 struct fuse_file_info *fi)
579 {
580 int res;
581 struct stat buf;
582 struct lo_data *lo = lo_data(req);
583
584 (void)fi;
585
586 res =
587 fstatat(lo_fd(req, ino), "", &buf, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
588 if (res == -1) {
589 return (void)fuse_reply_err(req, errno);
590 }
591
592 fuse_reply_attr(req, &buf, lo->timeout);
593 }
594
595 static int lo_fi_fd(fuse_req_t req, struct fuse_file_info *fi)
596 {
597 struct lo_data *lo = lo_data(req);
598 struct lo_map_elem *elem;
599
600 pthread_mutex_lock(&lo->mutex);
601 elem = lo_map_get(&lo->fd_map, fi->fh);
602 pthread_mutex_unlock(&lo->mutex);
603
604 if (!elem) {
605 return -1;
606 }
607
608 return elem->fd;
609 }
610
611 static void lo_setattr(fuse_req_t req, fuse_ino_t ino, struct stat *attr,
612 int valid, struct fuse_file_info *fi)
613 {
614 int saverr;
615 char procname[64];
616 struct lo_data *lo = lo_data(req);
617 struct lo_inode *inode;
618 int ifd;
619 int res;
620 int fd;
621
622 inode = lo_inode(req, ino);
623 if (!inode) {
624 fuse_reply_err(req, EBADF);
625 return;
626 }
627
628 ifd = inode->fd;
629
630 /* If fi->fh is invalid we'll report EBADF later */
631 if (fi) {
632 fd = lo_fi_fd(req, fi);
633 }
634
635 if (valid & FUSE_SET_ATTR_MODE) {
636 if (fi) {
637 res = fchmod(fd, attr->st_mode);
638 } else {
639 sprintf(procname, "%i", ifd);
640 res = fchmodat(lo->proc_self_fd, procname, attr->st_mode, 0);
641 }
642 if (res == -1) {
643 goto out_err;
644 }
645 }
646 if (valid & (FUSE_SET_ATTR_UID | FUSE_SET_ATTR_GID)) {
647 uid_t uid = (valid & FUSE_SET_ATTR_UID) ? attr->st_uid : (uid_t)-1;
648 gid_t gid = (valid & FUSE_SET_ATTR_GID) ? attr->st_gid : (gid_t)-1;
649
650 res = fchownat(ifd, "", uid, gid, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
651 if (res == -1) {
652 goto out_err;
653 }
654 }
655 if (valid & FUSE_SET_ATTR_SIZE) {
656 int truncfd;
657
658 if (fi) {
659 truncfd = fd;
660 } else {
661 sprintf(procname, "%i", ifd);
662 truncfd = openat(lo->proc_self_fd, procname, O_RDWR);
663 if (truncfd < 0) {
664 goto out_err;
665 }
666 }
667
668 res = ftruncate(truncfd, attr->st_size);
669 if (!fi) {
670 saverr = errno;
671 close(truncfd);
672 errno = saverr;
673 }
674 if (res == -1) {
675 goto out_err;
676 }
677 }
678 if (valid & (FUSE_SET_ATTR_ATIME | FUSE_SET_ATTR_MTIME)) {
679 struct timespec tv[2];
680
681 tv[0].tv_sec = 0;
682 tv[1].tv_sec = 0;
683 tv[0].tv_nsec = UTIME_OMIT;
684 tv[1].tv_nsec = UTIME_OMIT;
685
686 if (valid & FUSE_SET_ATTR_ATIME_NOW) {
687 tv[0].tv_nsec = UTIME_NOW;
688 } else if (valid & FUSE_SET_ATTR_ATIME) {
689 tv[0] = attr->st_atim;
690 }
691
692 if (valid & FUSE_SET_ATTR_MTIME_NOW) {
693 tv[1].tv_nsec = UTIME_NOW;
694 } else if (valid & FUSE_SET_ATTR_MTIME) {
695 tv[1] = attr->st_mtim;
696 }
697
698 if (fi) {
699 res = futimens(fd, tv);
700 } else {
701 sprintf(procname, "%i", inode->fd);
702 res = utimensat(lo->proc_self_fd, procname, tv, 0);
703 }
704 if (res == -1) {
705 goto out_err;
706 }
707 }
708 lo_inode_put(lo, &inode);
709
710 return lo_getattr(req, ino, fi);
711
712 out_err:
713 saverr = errno;
714 lo_inode_put(lo, &inode);
715 fuse_reply_err(req, saverr);
716 }
717
718 static struct lo_inode *lo_find(struct lo_data *lo, struct stat *st)
719 {
720 struct lo_inode *p;
721 struct lo_key key = {
722 .ino = st->st_ino,
723 .dev = st->st_dev,
724 };
725
726 pthread_mutex_lock(&lo->mutex);
727 p = g_hash_table_lookup(lo->inodes, &key);
728 if (p) {
729 assert(p->nlookup > 0);
730 p->nlookup++;
731 g_atomic_int_inc(&p->refcount);
732 }
733 pthread_mutex_unlock(&lo->mutex);
734
735 return p;
736 }
737
738 /* value_destroy_func for posix_locks GHashTable */
739 static void posix_locks_value_destroy(gpointer data)
740 {
741 struct lo_inode_plock *plock = data;
742
743 /*
744 * We had used open() for locks and had only one fd. So
745 * closing this fd should release all OFD locks.
746 */
747 close(plock->fd);
748 free(plock);
749 }
750
751 /*
752 * Increments nlookup and caller must release refcount using
753 * lo_inode_put(&parent).
754 */
755 static int lo_do_lookup(fuse_req_t req, fuse_ino_t parent, const char *name,
756 struct fuse_entry_param *e)
757 {
758 int newfd;
759 int res;
760 int saverr;
761 struct lo_data *lo = lo_data(req);
762 struct lo_inode *inode = NULL;
763 struct lo_inode *dir = lo_inode(req, parent);
764
765 /*
766 * name_to_handle_at() and open_by_handle_at() can reach here with fuse
767 * mount point in guest, but we don't have its inode info in the
768 * ino_map.
769 */
770 if (!dir) {
771 return ENOENT;
772 }
773
774 memset(e, 0, sizeof(*e));
775 e->attr_timeout = lo->timeout;
776 e->entry_timeout = lo->timeout;
777
778 /* Do not allow escaping root directory */
779 if (dir == &lo->root && strcmp(name, "..") == 0) {
780 name = ".";
781 }
782
783 newfd = openat(dir->fd, name, O_PATH | O_NOFOLLOW);
784 if (newfd == -1) {
785 goto out_err;
786 }
787
788 res = fstatat(newfd, "", &e->attr, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
789 if (res == -1) {
790 goto out_err;
791 }
792
793 inode = lo_find(lo, &e->attr);
794 if (inode) {
795 close(newfd);
796 } else {
797 inode = calloc(1, sizeof(struct lo_inode));
798 if (!inode) {
799 goto out_err;
800 }
801
802 /* cache only filetype */
803 inode->filetype = (e->attr.st_mode & S_IFMT);
804
805 /*
806 * One for the caller and one for nlookup (released in
807 * unref_inode_lolocked())
808 */
809 g_atomic_int_set(&inode->refcount, 2);
810
811 inode->nlookup = 1;
812 inode->fd = newfd;
813 inode->key.ino = e->attr.st_ino;
814 inode->key.dev = e->attr.st_dev;
815 pthread_mutex_init(&inode->plock_mutex, NULL);
816 inode->posix_locks = g_hash_table_new_full(
817 g_direct_hash, g_direct_equal, NULL, posix_locks_value_destroy);
818
819 pthread_mutex_lock(&lo->mutex);
820 inode->fuse_ino = lo_add_inode_mapping(req, inode);
821 g_hash_table_insert(lo->inodes, &inode->key, inode);
822 pthread_mutex_unlock(&lo->mutex);
823 }
824 e->ino = inode->fuse_ino;
825 lo_inode_put(lo, &inode);
826 lo_inode_put(lo, &dir);
827
828 fuse_log(FUSE_LOG_DEBUG, " %lli/%s -> %lli\n", (unsigned long long)parent,
829 name, (unsigned long long)e->ino);
830
831 return 0;
832
833 out_err:
834 saverr = errno;
835 if (newfd != -1) {
836 close(newfd);
837 }
838 lo_inode_put(lo, &inode);
839 lo_inode_put(lo, &dir);
840 return saverr;
841 }
842
843 static void lo_lookup(fuse_req_t req, fuse_ino_t parent, const char *name)
844 {
845 struct fuse_entry_param e;
846 int err;
847
848 fuse_log(FUSE_LOG_DEBUG, "lo_lookup(parent=%" PRIu64 ", name=%s)\n", parent,
849 name);
850
851 /*
852 * Don't use is_safe_path_component(), allow "." and ".." for NFS export
853 * support.
854 */
855 if (strchr(name, '/')) {
856 fuse_reply_err(req, EINVAL);
857 return;
858 }
859
860 err = lo_do_lookup(req, parent, name, &e);
861 if (err) {
862 fuse_reply_err(req, err);
863 } else {
864 fuse_reply_entry(req, &e);
865 }
866 }
867
868 /*
869 * On some archs, setres*id is limited to 2^16 but they
870 * provide setres*id32 variants that allow 2^32.
871 * Others just let setres*id do 2^32 anyway.
872 */
873 #ifdef SYS_setresgid32
874 #define OURSYS_setresgid SYS_setresgid32
875 #else
876 #define OURSYS_setresgid SYS_setresgid
877 #endif
878
879 #ifdef SYS_setresuid32
880 #define OURSYS_setresuid SYS_setresuid32
881 #else
882 #define OURSYS_setresuid SYS_setresuid
883 #endif
884
885 /*
886 * Change to uid/gid of caller so that file is created with
887 * ownership of caller.
888 * TODO: What about selinux context?
889 */
890 static int lo_change_cred(fuse_req_t req, struct lo_cred *old)
891 {
892 int res;
893
894 old->euid = geteuid();
895 old->egid = getegid();
896
897 res = syscall(OURSYS_setresgid, -1, fuse_req_ctx(req)->gid, -1);
898 if (res == -1) {
899 return errno;
900 }
901
902 res = syscall(OURSYS_setresuid, -1, fuse_req_ctx(req)->uid, -1);
903 if (res == -1) {
904 int errno_save = errno;
905
906 syscall(OURSYS_setresgid, -1, old->egid, -1);
907 return errno_save;
908 }
909
910 return 0;
911 }
912
913 /* Regain Privileges */
914 static void lo_restore_cred(struct lo_cred *old)
915 {
916 int res;
917
918 res = syscall(OURSYS_setresuid, -1, old->euid, -1);
919 if (res == -1) {
920 fuse_log(FUSE_LOG_ERR, "seteuid(%u): %m\n", old->euid);
921 exit(1);
922 }
923
924 res = syscall(OURSYS_setresgid, -1, old->egid, -1);
925 if (res == -1) {
926 fuse_log(FUSE_LOG_ERR, "setegid(%u): %m\n", old->egid);
927 exit(1);
928 }
929 }
930
931 static void lo_mknod_symlink(fuse_req_t req, fuse_ino_t parent,
932 const char *name, mode_t mode, dev_t rdev,
933 const char *link)
934 {
935 int res;
936 int saverr;
937 struct lo_data *lo = lo_data(req);
938 struct lo_inode *dir;
939 struct fuse_entry_param e;
940 struct lo_cred old = {};
941
942 if (!is_safe_path_component(name)) {
943 fuse_reply_err(req, EINVAL);
944 return;
945 }
946
947 dir = lo_inode(req, parent);
948 if (!dir) {
949 fuse_reply_err(req, EBADF);
950 return;
951 }
952
953 saverr = lo_change_cred(req, &old);
954 if (saverr) {
955 goto out;
956 }
957
958 res = mknod_wrapper(dir->fd, name, link, mode, rdev);
959
960 saverr = errno;
961
962 lo_restore_cred(&old);
963
964 if (res == -1) {
965 goto out;
966 }
967
968 saverr = lo_do_lookup(req, parent, name, &e);
969 if (saverr) {
970 goto out;
971 }
972
973 fuse_log(FUSE_LOG_DEBUG, " %lli/%s -> %lli\n", (unsigned long long)parent,
974 name, (unsigned long long)e.ino);
975
976 fuse_reply_entry(req, &e);
977 lo_inode_put(lo, &dir);
978 return;
979
980 out:
981 lo_inode_put(lo, &dir);
982 fuse_reply_err(req, saverr);
983 }
984
985 static void lo_mknod(fuse_req_t req, fuse_ino_t parent, const char *name,
986 mode_t mode, dev_t rdev)
987 {
988 lo_mknod_symlink(req, parent, name, mode, rdev, NULL);
989 }
990
991 static void lo_mkdir(fuse_req_t req, fuse_ino_t parent, const char *name,
992 mode_t mode)
993 {
994 lo_mknod_symlink(req, parent, name, S_IFDIR | mode, 0, NULL);
995 }
996
997 static void lo_symlink(fuse_req_t req, const char *link, fuse_ino_t parent,
998 const char *name)
999 {
1000 lo_mknod_symlink(req, parent, name, S_IFLNK, 0, link);
1001 }
1002
1003 static void lo_link(fuse_req_t req, fuse_ino_t ino, fuse_ino_t parent,
1004 const char *name)
1005 {
1006 int res;
1007 struct lo_data *lo = lo_data(req);
1008 struct lo_inode *parent_inode;
1009 struct lo_inode *inode;
1010 struct fuse_entry_param e;
1011 char procname[64];
1012 int saverr;
1013
1014 if (!is_safe_path_component(name)) {
1015 fuse_reply_err(req, EINVAL);
1016 return;
1017 }
1018
1019 parent_inode = lo_inode(req, parent);
1020 inode = lo_inode(req, ino);
1021 if (!parent_inode || !inode) {
1022 errno = EBADF;
1023 goto out_err;
1024 }
1025
1026 memset(&e, 0, sizeof(struct fuse_entry_param));
1027 e.attr_timeout = lo->timeout;
1028 e.entry_timeout = lo->timeout;
1029
1030 sprintf(procname, "%i", inode->fd);
1031 res = linkat(lo->proc_self_fd, procname, parent_inode->fd, name,
1032 AT_SYMLINK_FOLLOW);
1033 if (res == -1) {
1034 goto out_err;
1035 }
1036
1037 res = fstatat(inode->fd, "", &e.attr, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
1038 if (res == -1) {
1039 goto out_err;
1040 }
1041
1042 pthread_mutex_lock(&lo->mutex);
1043 inode->nlookup++;
1044 pthread_mutex_unlock(&lo->mutex);
1045 e.ino = inode->fuse_ino;
1046
1047 fuse_log(FUSE_LOG_DEBUG, " %lli/%s -> %lli\n", (unsigned long long)parent,
1048 name, (unsigned long long)e.ino);
1049
1050 fuse_reply_entry(req, &e);
1051 lo_inode_put(lo, &parent_inode);
1052 lo_inode_put(lo, &inode);
1053 return;
1054
1055 out_err:
1056 saverr = errno;
1057 lo_inode_put(lo, &parent_inode);
1058 lo_inode_put(lo, &inode);
1059 fuse_reply_err(req, saverr);
1060 }
1061
1062 /* Increments nlookup and caller must release refcount using lo_inode_put() */
1063 static struct lo_inode *lookup_name(fuse_req_t req, fuse_ino_t parent,
1064 const char *name)
1065 {
1066 int res;
1067 struct stat attr;
1068
1069 res = fstatat(lo_fd(req, parent), name, &attr,
1070 AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
1071 if (res == -1) {
1072 return NULL;
1073 }
1074
1075 return lo_find(lo_data(req), &attr);
1076 }
1077
1078 static void lo_rmdir(fuse_req_t req, fuse_ino_t parent, const char *name)
1079 {
1080 int res;
1081 struct lo_inode *inode;
1082 struct lo_data *lo = lo_data(req);
1083
1084 if (!is_safe_path_component(name)) {
1085 fuse_reply_err(req, EINVAL);
1086 return;
1087 }
1088
1089 inode = lookup_name(req, parent, name);
1090 if (!inode) {
1091 fuse_reply_err(req, EIO);
1092 return;
1093 }
1094
1095 res = unlinkat(lo_fd(req, parent), name, AT_REMOVEDIR);
1096
1097 fuse_reply_err(req, res == -1 ? errno : 0);
1098 unref_inode_lolocked(lo, inode, 1);
1099 lo_inode_put(lo, &inode);
1100 }
1101
1102 static void lo_rename(fuse_req_t req, fuse_ino_t parent, const char *name,
1103 fuse_ino_t newparent, const char *newname,
1104 unsigned int flags)
1105 {
1106 int res;
1107 struct lo_inode *parent_inode;
1108 struct lo_inode *newparent_inode;
1109 struct lo_inode *oldinode = NULL;
1110 struct lo_inode *newinode = NULL;
1111 struct lo_data *lo = lo_data(req);
1112
1113 if (!is_safe_path_component(name) || !is_safe_path_component(newname)) {
1114 fuse_reply_err(req, EINVAL);
1115 return;
1116 }
1117
1118 parent_inode = lo_inode(req, parent);
1119 newparent_inode = lo_inode(req, newparent);
1120 if (!parent_inode || !newparent_inode) {
1121 fuse_reply_err(req, EBADF);
1122 goto out;
1123 }
1124
1125 oldinode = lookup_name(req, parent, name);
1126 newinode = lookup_name(req, newparent, newname);
1127
1128 if (!oldinode) {
1129 fuse_reply_err(req, EIO);
1130 goto out;
1131 }
1132
1133 if (flags) {
1134 #ifndef SYS_renameat2
1135 fuse_reply_err(req, EINVAL);
1136 #else
1137 res = syscall(SYS_renameat2, parent_inode->fd, name,
1138 newparent_inode->fd, newname, flags);
1139 if (res == -1 && errno == ENOSYS) {
1140 fuse_reply_err(req, EINVAL);
1141 } else {
1142 fuse_reply_err(req, res == -1 ? errno : 0);
1143 }
1144 #endif
1145 goto out;
1146 }
1147
1148 res = renameat(parent_inode->fd, name, newparent_inode->fd, newname);
1149
1150 fuse_reply_err(req, res == -1 ? errno : 0);
1151 out:
1152 unref_inode_lolocked(lo, oldinode, 1);
1153 unref_inode_lolocked(lo, newinode, 1);
1154 lo_inode_put(lo, &oldinode);
1155 lo_inode_put(lo, &newinode);
1156 lo_inode_put(lo, &parent_inode);
1157 lo_inode_put(lo, &newparent_inode);
1158 }
1159
1160 static void lo_unlink(fuse_req_t req, fuse_ino_t parent, const char *name)
1161 {
1162 int res;
1163 struct lo_inode *inode;
1164 struct lo_data *lo = lo_data(req);
1165
1166 if (!is_safe_path_component(name)) {
1167 fuse_reply_err(req, EINVAL);
1168 return;
1169 }
1170
1171 inode = lookup_name(req, parent, name);
1172 if (!inode) {
1173 fuse_reply_err(req, EIO);
1174 return;
1175 }
1176
1177 res = unlinkat(lo_fd(req, parent), name, 0);
1178
1179 fuse_reply_err(req, res == -1 ? errno : 0);
1180 unref_inode_lolocked(lo, inode, 1);
1181 lo_inode_put(lo, &inode);
1182 }
1183
1184 /* To be called with lo->mutex held */
1185 static void unref_inode(struct lo_data *lo, struct lo_inode *inode, uint64_t n)
1186 {
1187 if (!inode) {
1188 return;
1189 }
1190
1191 assert(inode->nlookup >= n);
1192 inode->nlookup -= n;
1193 if (!inode->nlookup) {
1194 lo_map_remove(&lo->ino_map, inode->fuse_ino);
1195 g_hash_table_remove(lo->inodes, &inode->key);
1196 if (g_hash_table_size(inode->posix_locks)) {
1197 fuse_log(FUSE_LOG_WARNING, "Hash table is not empty\n");
1198 }
1199 g_hash_table_destroy(inode->posix_locks);
1200 pthread_mutex_destroy(&inode->plock_mutex);
1201
1202 /* Drop our refcount from lo_do_lookup() */
1203 lo_inode_put(lo, &inode);
1204 }
1205 }
1206
1207 static void unref_inode_lolocked(struct lo_data *lo, struct lo_inode *inode,
1208 uint64_t n)
1209 {
1210 if (!inode) {
1211 return;
1212 }
1213
1214 pthread_mutex_lock(&lo->mutex);
1215 unref_inode(lo, inode, n);
1216 pthread_mutex_unlock(&lo->mutex);
1217 }
1218
1219 static void lo_forget_one(fuse_req_t req, fuse_ino_t ino, uint64_t nlookup)
1220 {
1221 struct lo_data *lo = lo_data(req);
1222 struct lo_inode *inode;
1223
1224 inode = lo_inode(req, ino);
1225 if (!inode) {
1226 return;
1227 }
1228
1229 fuse_log(FUSE_LOG_DEBUG, " forget %lli %lli -%lli\n",
1230 (unsigned long long)ino, (unsigned long long)inode->nlookup,
1231 (unsigned long long)nlookup);
1232
1233 unref_inode_lolocked(lo, inode, nlookup);
1234 lo_inode_put(lo, &inode);
1235 }
1236
1237 static void lo_forget(fuse_req_t req, fuse_ino_t ino, uint64_t nlookup)
1238 {
1239 lo_forget_one(req, ino, nlookup);
1240 fuse_reply_none(req);
1241 }
1242
1243 static void lo_forget_multi(fuse_req_t req, size_t count,
1244 struct fuse_forget_data *forgets)
1245 {
1246 int i;
1247
1248 for (i = 0; i < count; i++) {
1249 lo_forget_one(req, forgets[i].ino, forgets[i].nlookup);
1250 }
1251 fuse_reply_none(req);
1252 }
1253
1254 static void lo_readlink(fuse_req_t req, fuse_ino_t ino)
1255 {
1256 char buf[PATH_MAX + 1];
1257 int res;
1258
1259 res = readlinkat(lo_fd(req, ino), "", buf, sizeof(buf));
1260 if (res == -1) {
1261 return (void)fuse_reply_err(req, errno);
1262 }
1263
1264 if (res == sizeof(buf)) {
1265 return (void)fuse_reply_err(req, ENAMETOOLONG);
1266 }
1267
1268 buf[res] = '\0';
1269
1270 fuse_reply_readlink(req, buf);
1271 }
1272
1273 struct lo_dirp {
1274 gint refcount;
1275 DIR *dp;
1276 struct dirent *entry;
1277 off_t offset;
1278 };
1279
1280 static void lo_dirp_put(struct lo_dirp **dp)
1281 {
1282 struct lo_dirp *d = *dp;
1283
1284 if (!d) {
1285 return;
1286 }
1287 *dp = NULL;
1288
1289 if (g_atomic_int_dec_and_test(&d->refcount)) {
1290 closedir(d->dp);
1291 free(d);
1292 }
1293 }
1294
1295 /* Call lo_dirp_put() on the return value when no longer needed */
1296 static struct lo_dirp *lo_dirp(fuse_req_t req, struct fuse_file_info *fi)
1297 {
1298 struct lo_data *lo = lo_data(req);
1299 struct lo_map_elem *elem;
1300
1301 pthread_mutex_lock(&lo->mutex);
1302 elem = lo_map_get(&lo->dirp_map, fi->fh);
1303 if (elem) {
1304 g_atomic_int_inc(&elem->dirp->refcount);
1305 }
1306 pthread_mutex_unlock(&lo->mutex);
1307 if (!elem) {
1308 return NULL;
1309 }
1310
1311 return elem->dirp;
1312 }
1313
1314 static void lo_opendir(fuse_req_t req, fuse_ino_t ino,
1315 struct fuse_file_info *fi)
1316 {
1317 int error = ENOMEM;
1318 struct lo_data *lo = lo_data(req);
1319 struct lo_dirp *d;
1320 int fd;
1321 ssize_t fh;
1322
1323 d = calloc(1, sizeof(struct lo_dirp));
1324 if (d == NULL) {
1325 goto out_err;
1326 }
1327
1328 fd = openat(lo_fd(req, ino), ".", O_RDONLY);
1329 if (fd == -1) {
1330 goto out_errno;
1331 }
1332
1333 d->dp = fdopendir(fd);
1334 if (d->dp == NULL) {
1335 goto out_errno;
1336 }
1337
1338 d->offset = 0;
1339 d->entry = NULL;
1340
1341 g_atomic_int_set(&d->refcount, 1); /* paired with lo_releasedir() */
1342 pthread_mutex_lock(&lo->mutex);
1343 fh = lo_add_dirp_mapping(req, d);
1344 pthread_mutex_unlock(&lo->mutex);
1345 if (fh == -1) {
1346 goto out_err;
1347 }
1348
1349 fi->fh = fh;
1350 if (lo->cache == CACHE_ALWAYS) {
1351 fi->cache_readdir = 1;
1352 }
1353 fuse_reply_open(req, fi);
1354 return;
1355
1356 out_errno:
1357 error = errno;
1358 out_err:
1359 if (d) {
1360 if (d->dp) {
1361 closedir(d->dp);
1362 } else if (fd != -1) {
1363 close(fd);
1364 }
1365 free(d);
1366 }
1367 fuse_reply_err(req, error);
1368 }
1369
1370 static void lo_do_readdir(fuse_req_t req, fuse_ino_t ino, size_t size,
1371 off_t offset, struct fuse_file_info *fi, int plus)
1372 {
1373 struct lo_data *lo = lo_data(req);
1374 struct lo_dirp *d = NULL;
1375 struct lo_inode *dinode;
1376 char *buf = NULL;
1377 char *p;
1378 size_t rem = size;
1379 int err = EBADF;
1380
1381 dinode = lo_inode(req, ino);
1382 if (!dinode) {
1383 goto error;
1384 }
1385
1386 d = lo_dirp(req, fi);
1387 if (!d) {
1388 goto error;
1389 }
1390
1391 err = ENOMEM;
1392 buf = calloc(1, size);
1393 if (!buf) {
1394 goto error;
1395 }
1396 p = buf;
1397
1398 if (offset != d->offset) {
1399 seekdir(d->dp, offset);
1400 d->entry = NULL;
1401 d->offset = offset;
1402 }
1403 while (1) {
1404 size_t entsize;
1405 off_t nextoff;
1406 const char *name;
1407
1408 if (!d->entry) {
1409 errno = 0;
1410 d->entry = readdir(d->dp);
1411 if (!d->entry) {
1412 if (errno) { /* Error */
1413 err = errno;
1414 goto error;
1415 } else { /* End of stream */
1416 break;
1417 }
1418 }
1419 }
1420 nextoff = d->entry->d_off;
1421 name = d->entry->d_name;
1422
1423 fuse_ino_t entry_ino = 0;
1424 struct fuse_entry_param e = (struct fuse_entry_param){
1425 .attr.st_ino = d->entry->d_ino,
1426 .attr.st_mode = d->entry->d_type << 12,
1427 };
1428
1429 /* Hide root's parent directory */
1430 if (dinode == &lo->root && strcmp(name, "..") == 0) {
1431 e.attr.st_ino = lo->root.key.ino;
1432 e.attr.st_mode = DT_DIR << 12;
1433 }
1434
1435 if (plus) {
1436 if (!is_dot_or_dotdot(name)) {
1437 err = lo_do_lookup(req, ino, name, &e);
1438 if (err) {
1439 goto error;
1440 }
1441 entry_ino = e.ino;
1442 }
1443
1444 entsize = fuse_add_direntry_plus(req, p, rem, name, &e, nextoff);
1445 } else {
1446 entsize = fuse_add_direntry(req, p, rem, name, &e.attr, nextoff);
1447 }
1448 if (entsize > rem) {
1449 if (entry_ino != 0) {
1450 lo_forget_one(req, entry_ino, 1);
1451 }
1452 break;
1453 }
1454
1455 p += entsize;
1456 rem -= entsize;
1457
1458 d->entry = NULL;
1459 d->offset = nextoff;
1460 }
1461
1462 err = 0;
1463 error:
1464 lo_dirp_put(&d);
1465 lo_inode_put(lo, &dinode);
1466
1467 /*
1468 * If there's an error, we can only signal it if we haven't stored
1469 * any entries yet - otherwise we'd end up with wrong lookup
1470 * counts for the entries that are already in the buffer. So we
1471 * return what we've collected until that point.
1472 */
1473 if (err && rem == size) {
1474 fuse_reply_err(req, err);
1475 } else {
1476 fuse_reply_buf(req, buf, size - rem);
1477 }
1478 free(buf);
1479 }
1480
1481 static void lo_readdir(fuse_req_t req, fuse_ino_t ino, size_t size,
1482 off_t offset, struct fuse_file_info *fi)
1483 {
1484 lo_do_readdir(req, ino, size, offset, fi, 0);
1485 }
1486
1487 static void lo_readdirplus(fuse_req_t req, fuse_ino_t ino, size_t size,
1488 off_t offset, struct fuse_file_info *fi)
1489 {
1490 lo_do_readdir(req, ino, size, offset, fi, 1);
1491 }
1492
1493 static void lo_releasedir(fuse_req_t req, fuse_ino_t ino,
1494 struct fuse_file_info *fi)
1495 {
1496 struct lo_data *lo = lo_data(req);
1497 struct lo_map_elem *elem;
1498 struct lo_dirp *d;
1499
1500 (void)ino;
1501
1502 pthread_mutex_lock(&lo->mutex);
1503 elem = lo_map_get(&lo->dirp_map, fi->fh);
1504 if (!elem) {
1505 pthread_mutex_unlock(&lo->mutex);
1506 fuse_reply_err(req, EBADF);
1507 return;
1508 }
1509
1510 d = elem->dirp;
1511 lo_map_remove(&lo->dirp_map, fi->fh);
1512 pthread_mutex_unlock(&lo->mutex);
1513
1514 lo_dirp_put(&d); /* paired with lo_opendir() */
1515
1516 fuse_reply_err(req, 0);
1517 }
1518
1519 static void update_open_flags(int writeback, struct fuse_file_info *fi)
1520 {
1521 /*
1522 * With writeback cache, kernel may send read requests even
1523 * when userspace opened write-only
1524 */
1525 if (writeback && (fi->flags & O_ACCMODE) == O_WRONLY) {
1526 fi->flags &= ~O_ACCMODE;
1527 fi->flags |= O_RDWR;
1528 }
1529
1530 /*
1531 * With writeback cache, O_APPEND is handled by the kernel.
1532 * This breaks atomicity (since the file may change in the
1533 * underlying filesystem, so that the kernel's idea of the
1534 * end of the file isn't accurate anymore). In this example,
1535 * we just accept that. A more rigorous filesystem may want
1536 * to return an error here
1537 */
1538 if (writeback && (fi->flags & O_APPEND)) {
1539 fi->flags &= ~O_APPEND;
1540 }
1541
1542 /*
1543 * O_DIRECT in guest should not necessarily mean bypassing page
1544 * cache on host as well. If somebody needs that behavior, it
1545 * probably should be a configuration knob in daemon.
1546 */
1547 fi->flags &= ~O_DIRECT;
1548 }
1549
1550 static void lo_create(fuse_req_t req, fuse_ino_t parent, const char *name,
1551 mode_t mode, struct fuse_file_info *fi)
1552 {
1553 int fd;
1554 struct lo_data *lo = lo_data(req);
1555 struct lo_inode *parent_inode;
1556 struct fuse_entry_param e;
1557 int err;
1558 struct lo_cred old = {};
1559
1560 fuse_log(FUSE_LOG_DEBUG, "lo_create(parent=%" PRIu64 ", name=%s)\n", parent,
1561 name);
1562
1563 if (!is_safe_path_component(name)) {
1564 fuse_reply_err(req, EINVAL);
1565 return;
1566 }
1567
1568 parent_inode = lo_inode(req, parent);
1569 if (!parent_inode) {
1570 fuse_reply_err(req, EBADF);
1571 return;
1572 }
1573
1574 err = lo_change_cred(req, &old);
1575 if (err) {
1576 goto out;
1577 }
1578
1579 update_open_flags(lo->writeback, fi);
1580
1581 fd = openat(parent_inode->fd, name, (fi->flags | O_CREAT) & ~O_NOFOLLOW,
1582 mode);
1583 err = fd == -1 ? errno : 0;
1584 lo_restore_cred(&old);
1585
1586 if (!err) {
1587 ssize_t fh;
1588
1589 pthread_mutex_lock(&lo->mutex);
1590 fh = lo_add_fd_mapping(req, fd);
1591 pthread_mutex_unlock(&lo->mutex);
1592 if (fh == -1) {
1593 close(fd);
1594 err = ENOMEM;
1595 goto out;
1596 }
1597
1598 fi->fh = fh;
1599 err = lo_do_lookup(req, parent, name, &e);
1600 }
1601 if (lo->cache == CACHE_NONE) {
1602 fi->direct_io = 1;
1603 } else if (lo->cache == CACHE_ALWAYS) {
1604 fi->keep_cache = 1;
1605 }
1606
1607 out:
1608 lo_inode_put(lo, &parent_inode);
1609
1610 if (err) {
1611 fuse_reply_err(req, err);
1612 } else {
1613 fuse_reply_create(req, &e, fi);
1614 }
1615 }
1616
1617 /* Should be called with inode->plock_mutex held */
1618 static struct lo_inode_plock *lookup_create_plock_ctx(struct lo_data *lo,
1619 struct lo_inode *inode,
1620 uint64_t lock_owner,
1621 pid_t pid, int *err)
1622 {
1623 struct lo_inode_plock *plock;
1624 char procname[64];
1625 int fd;
1626
1627 plock =
1628 g_hash_table_lookup(inode->posix_locks, GUINT_TO_POINTER(lock_owner));
1629
1630 if (plock) {
1631 return plock;
1632 }
1633
1634 plock = malloc(sizeof(struct lo_inode_plock));
1635 if (!plock) {
1636 *err = ENOMEM;
1637 return NULL;
1638 }
1639
1640 /* Open another instance of file which can be used for ofd locks. */
1641 sprintf(procname, "%i", inode->fd);
1642
1643 /* TODO: What if file is not writable? */
1644 fd = openat(lo->proc_self_fd, procname, O_RDWR);
1645 if (fd == -1) {
1646 *err = errno;
1647 free(plock);
1648 return NULL;
1649 }
1650
1651 plock->lock_owner = lock_owner;
1652 plock->fd = fd;
1653 g_hash_table_insert(inode->posix_locks, GUINT_TO_POINTER(plock->lock_owner),
1654 plock);
1655 return plock;
1656 }
1657
1658 static void lo_getlk(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi,
1659 struct flock *lock)
1660 {
1661 struct lo_data *lo = lo_data(req);
1662 struct lo_inode *inode;
1663 struct lo_inode_plock *plock;
1664 int ret, saverr = 0;
1665
1666 fuse_log(FUSE_LOG_DEBUG,
1667 "lo_getlk(ino=%" PRIu64 ", flags=%d)"
1668 " owner=0x%lx, l_type=%d l_start=0x%lx"
1669 " l_len=0x%lx\n",
1670 ino, fi->flags, fi->lock_owner, lock->l_type, lock->l_start,
1671 lock->l_len);
1672
1673 inode = lo_inode(req, ino);
1674 if (!inode) {
1675 fuse_reply_err(req, EBADF);
1676 return;
1677 }
1678
1679 pthread_mutex_lock(&inode->plock_mutex);
1680 plock =
1681 lookup_create_plock_ctx(lo, inode, fi->lock_owner, lock->l_pid, &ret);
1682 if (!plock) {
1683 saverr = ret;
1684 goto out;
1685 }
1686
1687 ret = fcntl(plock->fd, F_OFD_GETLK, lock);
1688 if (ret == -1) {
1689 saverr = errno;
1690 }
1691
1692 out:
1693 pthread_mutex_unlock(&inode->plock_mutex);
1694 lo_inode_put(lo, &inode);
1695
1696 if (saverr) {
1697 fuse_reply_err(req, saverr);
1698 } else {
1699 fuse_reply_lock(req, lock);
1700 }
1701 }
1702
1703 static void lo_setlk(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi,
1704 struct flock *lock, int sleep)
1705 {
1706 struct lo_data *lo = lo_data(req);
1707 struct lo_inode *inode;
1708 struct lo_inode_plock *plock;
1709 int ret, saverr = 0;
1710
1711 fuse_log(FUSE_LOG_DEBUG,
1712 "lo_setlk(ino=%" PRIu64 ", flags=%d)"
1713 " cmd=%d pid=%d owner=0x%lx sleep=%d l_whence=%d"
1714 " l_start=0x%lx l_len=0x%lx\n",
1715 ino, fi->flags, lock->l_type, lock->l_pid, fi->lock_owner, sleep,
1716 lock->l_whence, lock->l_start, lock->l_len);
1717
1718 if (sleep) {
1719 fuse_reply_err(req, EOPNOTSUPP);
1720 return;
1721 }
1722
1723 inode = lo_inode(req, ino);
1724 if (!inode) {
1725 fuse_reply_err(req, EBADF);
1726 return;
1727 }
1728
1729 pthread_mutex_lock(&inode->plock_mutex);
1730 plock =
1731 lookup_create_plock_ctx(lo, inode, fi->lock_owner, lock->l_pid, &ret);
1732
1733 if (!plock) {
1734 saverr = ret;
1735 goto out;
1736 }
1737
1738 /* TODO: Is it alright to modify flock? */
1739 lock->l_pid = 0;
1740 ret = fcntl(plock->fd, F_OFD_SETLK, lock);
1741 if (ret == -1) {
1742 saverr = errno;
1743 }
1744
1745 out:
1746 pthread_mutex_unlock(&inode->plock_mutex);
1747 lo_inode_put(lo, &inode);
1748
1749 fuse_reply_err(req, saverr);
1750 }
1751
1752 static void lo_fsyncdir(fuse_req_t req, fuse_ino_t ino, int datasync,
1753 struct fuse_file_info *fi)
1754 {
1755 int res;
1756 struct lo_dirp *d;
1757 int fd;
1758
1759 (void)ino;
1760
1761 d = lo_dirp(req, fi);
1762 if (!d) {
1763 fuse_reply_err(req, EBADF);
1764 return;
1765 }
1766
1767 fd = dirfd(d->dp);
1768 if (datasync) {
1769 res = fdatasync(fd);
1770 } else {
1771 res = fsync(fd);
1772 }
1773
1774 lo_dirp_put(&d);
1775
1776 fuse_reply_err(req, res == -1 ? errno : 0);
1777 }
1778
1779 static void lo_open(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi)
1780 {
1781 int fd;
1782 ssize_t fh;
1783 char buf[64];
1784 struct lo_data *lo = lo_data(req);
1785
1786 fuse_log(FUSE_LOG_DEBUG, "lo_open(ino=%" PRIu64 ", flags=%d)\n", ino,
1787 fi->flags);
1788
1789 update_open_flags(lo->writeback, fi);
1790
1791 sprintf(buf, "%i", lo_fd(req, ino));
1792 fd = openat(lo->proc_self_fd, buf, fi->flags & ~O_NOFOLLOW);
1793 if (fd == -1) {
1794 return (void)fuse_reply_err(req, errno);
1795 }
1796
1797 pthread_mutex_lock(&lo->mutex);
1798 fh = lo_add_fd_mapping(req, fd);
1799 pthread_mutex_unlock(&lo->mutex);
1800 if (fh == -1) {
1801 close(fd);
1802 fuse_reply_err(req, ENOMEM);
1803 return;
1804 }
1805
1806 fi->fh = fh;
1807 if (lo->cache == CACHE_NONE) {
1808 fi->direct_io = 1;
1809 } else if (lo->cache == CACHE_ALWAYS) {
1810 fi->keep_cache = 1;
1811 }
1812 fuse_reply_open(req, fi);
1813 }
1814
1815 static void lo_release(fuse_req_t req, fuse_ino_t ino,
1816 struct fuse_file_info *fi)
1817 {
1818 struct lo_data *lo = lo_data(req);
1819 struct lo_map_elem *elem;
1820 int fd = -1;
1821
1822 (void)ino;
1823
1824 pthread_mutex_lock(&lo->mutex);
1825 elem = lo_map_get(&lo->fd_map, fi->fh);
1826 if (elem) {
1827 fd = elem->fd;
1828 elem = NULL;
1829 lo_map_remove(&lo->fd_map, fi->fh);
1830 }
1831 pthread_mutex_unlock(&lo->mutex);
1832
1833 close(fd);
1834 fuse_reply_err(req, 0);
1835 }
1836
1837 static void lo_flush(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi)
1838 {
1839 int res;
1840 (void)ino;
1841 struct lo_inode *inode;
1842
1843 inode = lo_inode(req, ino);
1844 if (!inode) {
1845 fuse_reply_err(req, EBADF);
1846 return;
1847 }
1848
1849 /* An fd is going away. Cleanup associated posix locks */
1850 pthread_mutex_lock(&inode->plock_mutex);
1851 g_hash_table_remove(inode->posix_locks, GUINT_TO_POINTER(fi->lock_owner));
1852 pthread_mutex_unlock(&inode->plock_mutex);
1853
1854 res = close(dup(lo_fi_fd(req, fi)));
1855 lo_inode_put(lo_data(req), &inode);
1856 fuse_reply_err(req, res == -1 ? errno : 0);
1857 }
1858
1859 static void lo_fsync(fuse_req_t req, fuse_ino_t ino, int datasync,
1860 struct fuse_file_info *fi)
1861 {
1862 int res;
1863 int fd;
1864 char *buf;
1865
1866 fuse_log(FUSE_LOG_DEBUG, "lo_fsync(ino=%" PRIu64 ", fi=0x%p)\n", ino,
1867 (void *)fi);
1868
1869 if (!fi) {
1870 struct lo_data *lo = lo_data(req);
1871
1872 res = asprintf(&buf, "%i", lo_fd(req, ino));
1873 if (res == -1) {
1874 return (void)fuse_reply_err(req, errno);
1875 }
1876
1877 fd = openat(lo->proc_self_fd, buf, O_RDWR);
1878 free(buf);
1879 if (fd == -1) {
1880 return (void)fuse_reply_err(req, errno);
1881 }
1882 } else {
1883 fd = lo_fi_fd(req, fi);
1884 }
1885
1886 if (datasync) {
1887 res = fdatasync(fd);
1888 } else {
1889 res = fsync(fd);
1890 }
1891 if (!fi) {
1892 close(fd);
1893 }
1894 fuse_reply_err(req, res == -1 ? errno : 0);
1895 }
1896
1897 static void lo_read(fuse_req_t req, fuse_ino_t ino, size_t size, off_t offset,
1898 struct fuse_file_info *fi)
1899 {
1900 struct fuse_bufvec buf = FUSE_BUFVEC_INIT(size);
1901
1902 fuse_log(FUSE_LOG_DEBUG,
1903 "lo_read(ino=%" PRIu64 ", size=%zd, "
1904 "off=%lu)\n",
1905 ino, size, (unsigned long)offset);
1906
1907 buf.buf[0].flags = FUSE_BUF_IS_FD | FUSE_BUF_FD_SEEK;
1908 buf.buf[0].fd = lo_fi_fd(req, fi);
1909 buf.buf[0].pos = offset;
1910
1911 fuse_reply_data(req, &buf);
1912 }
1913
1914 static void lo_write_buf(fuse_req_t req, fuse_ino_t ino,
1915 struct fuse_bufvec *in_buf, off_t off,
1916 struct fuse_file_info *fi)
1917 {
1918 (void)ino;
1919 ssize_t res;
1920 struct fuse_bufvec out_buf = FUSE_BUFVEC_INIT(fuse_buf_size(in_buf));
1921 bool cap_fsetid_dropped = false;
1922
1923 out_buf.buf[0].flags = FUSE_BUF_IS_FD | FUSE_BUF_FD_SEEK;
1924 out_buf.buf[0].fd = lo_fi_fd(req, fi);
1925 out_buf.buf[0].pos = off;
1926
1927 fuse_log(FUSE_LOG_DEBUG,
1928 "lo_write_buf(ino=%" PRIu64 ", size=%zd, off=%lu)\n", ino,
1929 out_buf.buf[0].size, (unsigned long)off);
1930
1931 /*
1932 * If kill_priv is set, drop CAP_FSETID which should lead to kernel
1933 * clearing setuid/setgid on file.
1934 */
1935 if (fi->kill_priv) {
1936 res = drop_effective_cap("FSETID", &cap_fsetid_dropped);
1937 if (res != 0) {
1938 fuse_reply_err(req, res);
1939 return;
1940 }
1941 }
1942
1943 res = fuse_buf_copy(&out_buf, in_buf);
1944 if (res < 0) {
1945 fuse_reply_err(req, -res);
1946 } else {
1947 fuse_reply_write(req, (size_t)res);
1948 }
1949
1950 if (cap_fsetid_dropped) {
1951 res = gain_effective_cap("FSETID");
1952 if (res) {
1953 fuse_log(FUSE_LOG_ERR, "Failed to gain CAP_FSETID\n");
1954 }
1955 }
1956 }
1957
1958 static void lo_statfs(fuse_req_t req, fuse_ino_t ino)
1959 {
1960 int res;
1961 struct statvfs stbuf;
1962
1963 res = fstatvfs(lo_fd(req, ino), &stbuf);
1964 if (res == -1) {
1965 fuse_reply_err(req, errno);
1966 } else {
1967 fuse_reply_statfs(req, &stbuf);
1968 }
1969 }
1970
1971 static void lo_fallocate(fuse_req_t req, fuse_ino_t ino, int mode, off_t offset,
1972 off_t length, struct fuse_file_info *fi)
1973 {
1974 int err = EOPNOTSUPP;
1975 (void)ino;
1976
1977 #ifdef CONFIG_FALLOCATE
1978 err = fallocate(lo_fi_fd(req, fi), mode, offset, length);
1979 if (err < 0) {
1980 err = errno;
1981 }
1982
1983 #elif defined(CONFIG_POSIX_FALLOCATE)
1984 if (mode) {
1985 fuse_reply_err(req, EOPNOTSUPP);
1986 return;
1987 }
1988
1989 err = posix_fallocate(lo_fi_fd(req, fi), offset, length);
1990 #endif
1991
1992 fuse_reply_err(req, err);
1993 }
1994
1995 static void lo_flock(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi,
1996 int op)
1997 {
1998 int res;
1999 (void)ino;
2000
2001 res = flock(lo_fi_fd(req, fi), op);
2002
2003 fuse_reply_err(req, res == -1 ? errno : 0);
2004 }
2005
2006 static void lo_getxattr(fuse_req_t req, fuse_ino_t ino, const char *name,
2007 size_t size)
2008 {
2009 struct lo_data *lo = lo_data(req);
2010 char *value = NULL;
2011 char procname[64];
2012 struct lo_inode *inode;
2013 ssize_t ret;
2014 int saverr;
2015 int fd = -1;
2016
2017 inode = lo_inode(req, ino);
2018 if (!inode) {
2019 fuse_reply_err(req, EBADF);
2020 return;
2021 }
2022
2023 saverr = ENOSYS;
2024 if (!lo_data(req)->xattr) {
2025 goto out;
2026 }
2027
2028 fuse_log(FUSE_LOG_DEBUG, "lo_getxattr(ino=%" PRIu64 ", name=%s size=%zd)\n",
2029 ino, name, size);
2030
2031 if (size) {
2032 value = malloc(size);
2033 if (!value) {
2034 goto out_err;
2035 }
2036 }
2037
2038 sprintf(procname, "%i", inode->fd);
2039 /*
2040 * It is not safe to open() non-regular/non-dir files in file server
2041 * unless O_PATH is used, so use that method for regular files/dir
2042 * only (as it seems giving less performance overhead).
2043 * Otherwise, call fchdir() to avoid open().
2044 */
2045 if (S_ISREG(inode->filetype) || S_ISDIR(inode->filetype)) {
2046 fd = openat(lo->proc_self_fd, procname, O_RDONLY);
2047 if (fd < 0) {
2048 goto out_err;
2049 }
2050 ret = fgetxattr(fd, name, value, size);
2051 } else {
2052 /* fchdir should not fail here */
2053 assert(fchdir(lo->proc_self_fd) == 0);
2054 ret = getxattr(procname, name, value, size);
2055 assert(fchdir(lo->root.fd) == 0);
2056 }
2057
2058 if (ret == -1) {
2059 goto out_err;
2060 }
2061 if (size) {
2062 saverr = 0;
2063 if (ret == 0) {
2064 goto out;
2065 }
2066 fuse_reply_buf(req, value, ret);
2067 } else {
2068 fuse_reply_xattr(req, ret);
2069 }
2070 out_free:
2071 free(value);
2072
2073 if (fd >= 0) {
2074 close(fd);
2075 }
2076
2077 lo_inode_put(lo, &inode);
2078 return;
2079
2080 out_err:
2081 saverr = errno;
2082 out:
2083 fuse_reply_err(req, saverr);
2084 goto out_free;
2085 }
2086
2087 static void lo_listxattr(fuse_req_t req, fuse_ino_t ino, size_t size)
2088 {
2089 struct lo_data *lo = lo_data(req);
2090 char *value = NULL;
2091 char procname[64];
2092 struct lo_inode *inode;
2093 ssize_t ret;
2094 int saverr;
2095 int fd = -1;
2096
2097 inode = lo_inode(req, ino);
2098 if (!inode) {
2099 fuse_reply_err(req, EBADF);
2100 return;
2101 }
2102
2103 saverr = ENOSYS;
2104 if (!lo_data(req)->xattr) {
2105 goto out;
2106 }
2107
2108 fuse_log(FUSE_LOG_DEBUG, "lo_listxattr(ino=%" PRIu64 ", size=%zd)\n", ino,
2109 size);
2110
2111 if (size) {
2112 value = malloc(size);
2113 if (!value) {
2114 goto out_err;
2115 }
2116 }
2117
2118 sprintf(procname, "%i", inode->fd);
2119 if (S_ISREG(inode->filetype) || S_ISDIR(inode->filetype)) {
2120 fd = openat(lo->proc_self_fd, procname, O_RDONLY);
2121 if (fd < 0) {
2122 goto out_err;
2123 }
2124 ret = flistxattr(fd, value, size);
2125 } else {
2126 /* fchdir should not fail here */
2127 assert(fchdir(lo->proc_self_fd) == 0);
2128 ret = listxattr(procname, value, size);
2129 assert(fchdir(lo->root.fd) == 0);
2130 }
2131
2132 if (ret == -1) {
2133 goto out_err;
2134 }
2135 if (size) {
2136 saverr = 0;
2137 if (ret == 0) {
2138 goto out;
2139 }
2140 fuse_reply_buf(req, value, ret);
2141 } else {
2142 fuse_reply_xattr(req, ret);
2143 }
2144 out_free:
2145 free(value);
2146
2147 if (fd >= 0) {
2148 close(fd);
2149 }
2150
2151 lo_inode_put(lo, &inode);
2152 return;
2153
2154 out_err:
2155 saverr = errno;
2156 out:
2157 fuse_reply_err(req, saverr);
2158 goto out_free;
2159 }
2160
2161 static void lo_setxattr(fuse_req_t req, fuse_ino_t ino, const char *name,
2162 const char *value, size_t size, int flags)
2163 {
2164 char procname[64];
2165 struct lo_data *lo = lo_data(req);
2166 struct lo_inode *inode;
2167 ssize_t ret;
2168 int saverr;
2169 int fd = -1;
2170
2171 inode = lo_inode(req, ino);
2172 if (!inode) {
2173 fuse_reply_err(req, EBADF);
2174 return;
2175 }
2176
2177 saverr = ENOSYS;
2178 if (!lo_data(req)->xattr) {
2179 goto out;
2180 }
2181
2182 fuse_log(FUSE_LOG_DEBUG, "lo_setxattr(ino=%" PRIu64
2183 ", name=%s value=%s size=%zd)\n", ino, name, value, size);
2184
2185 sprintf(procname, "%i", inode->fd);
2186 if (S_ISREG(inode->filetype) || S_ISDIR(inode->filetype)) {
2187 fd = openat(lo->proc_self_fd, procname, O_RDONLY);
2188 if (fd < 0) {
2189 saverr = errno;
2190 goto out;
2191 }
2192 ret = fsetxattr(fd, name, value, size, flags);
2193 } else {
2194 /* fchdir should not fail here */
2195 assert(fchdir(lo->proc_self_fd) == 0);
2196 ret = setxattr(procname, name, value, size, flags);
2197 assert(fchdir(lo->root.fd) == 0);
2198 }
2199
2200 saverr = ret == -1 ? errno : 0;
2201
2202 out:
2203 if (fd >= 0) {
2204 close(fd);
2205 }
2206
2207 lo_inode_put(lo, &inode);
2208 fuse_reply_err(req, saverr);
2209 }
2210
2211 static void lo_removexattr(fuse_req_t req, fuse_ino_t ino, const char *name)
2212 {
2213 char procname[64];
2214 struct lo_data *lo = lo_data(req);
2215 struct lo_inode *inode;
2216 ssize_t ret;
2217 int saverr;
2218 int fd = -1;
2219
2220 inode = lo_inode(req, ino);
2221 if (!inode) {
2222 fuse_reply_err(req, EBADF);
2223 return;
2224 }
2225
2226 saverr = ENOSYS;
2227 if (!lo_data(req)->xattr) {
2228 goto out;
2229 }
2230
2231 fuse_log(FUSE_LOG_DEBUG, "lo_removexattr(ino=%" PRIu64 ", name=%s)\n", ino,
2232 name);
2233
2234 sprintf(procname, "%i", inode->fd);
2235 if (S_ISREG(inode->filetype) || S_ISDIR(inode->filetype)) {
2236 fd = openat(lo->proc_self_fd, procname, O_RDONLY);
2237 if (fd < 0) {
2238 saverr = errno;
2239 goto out;
2240 }
2241 ret = fremovexattr(fd, name);
2242 } else {
2243 /* fchdir should not fail here */
2244 assert(fchdir(lo->proc_self_fd) == 0);
2245 ret = removexattr(procname, name);
2246 assert(fchdir(lo->root.fd) == 0);
2247 }
2248
2249 saverr = ret == -1 ? errno : 0;
2250
2251 out:
2252 if (fd >= 0) {
2253 close(fd);
2254 }
2255
2256 lo_inode_put(lo, &inode);
2257 fuse_reply_err(req, saverr);
2258 }
2259
2260 #ifdef HAVE_COPY_FILE_RANGE
2261 static void lo_copy_file_range(fuse_req_t req, fuse_ino_t ino_in, off_t off_in,
2262 struct fuse_file_info *fi_in, fuse_ino_t ino_out,
2263 off_t off_out, struct fuse_file_info *fi_out,
2264 size_t len, int flags)
2265 {
2266 int in_fd, out_fd;
2267 ssize_t res;
2268
2269 in_fd = lo_fi_fd(req, fi_in);
2270 out_fd = lo_fi_fd(req, fi_out);
2271
2272 fuse_log(FUSE_LOG_DEBUG,
2273 "lo_copy_file_range(ino=%" PRIu64 "/fd=%d, "
2274 "off=%lu, ino=%" PRIu64 "/fd=%d, "
2275 "off=%lu, size=%zd, flags=0x%x)\n",
2276 ino_in, in_fd, off_in, ino_out, out_fd, off_out, len, flags);
2277
2278 res = copy_file_range(in_fd, &off_in, out_fd, &off_out, len, flags);
2279 if (res < 0) {
2280 fuse_reply_err(req, errno);
2281 } else {
2282 fuse_reply_write(req, res);
2283 }
2284 }
2285 #endif
2286
2287 static void lo_lseek(fuse_req_t req, fuse_ino_t ino, off_t off, int whence,
2288 struct fuse_file_info *fi)
2289 {
2290 off_t res;
2291
2292 (void)ino;
2293 res = lseek(lo_fi_fd(req, fi), off, whence);
2294 if (res != -1) {
2295 fuse_reply_lseek(req, res);
2296 } else {
2297 fuse_reply_err(req, errno);
2298 }
2299 }
2300
2301 static void lo_destroy(void *userdata)
2302 {
2303 struct lo_data *lo = (struct lo_data *)userdata;
2304
2305 pthread_mutex_lock(&lo->mutex);
2306 while (true) {
2307 GHashTableIter iter;
2308 gpointer key, value;
2309
2310 g_hash_table_iter_init(&iter, lo->inodes);
2311 if (!g_hash_table_iter_next(&iter, &key, &value)) {
2312 break;
2313 }
2314
2315 struct lo_inode *inode = value;
2316 unref_inode(lo, inode, inode->nlookup);
2317 }
2318 pthread_mutex_unlock(&lo->mutex);
2319 }
2320
2321 static struct fuse_lowlevel_ops lo_oper = {
2322 .init = lo_init,
2323 .lookup = lo_lookup,
2324 .mkdir = lo_mkdir,
2325 .mknod = lo_mknod,
2326 .symlink = lo_symlink,
2327 .link = lo_link,
2328 .unlink = lo_unlink,
2329 .rmdir = lo_rmdir,
2330 .rename = lo_rename,
2331 .forget = lo_forget,
2332 .forget_multi = lo_forget_multi,
2333 .getattr = lo_getattr,
2334 .setattr = lo_setattr,
2335 .readlink = lo_readlink,
2336 .opendir = lo_opendir,
2337 .readdir = lo_readdir,
2338 .readdirplus = lo_readdirplus,
2339 .releasedir = lo_releasedir,
2340 .fsyncdir = lo_fsyncdir,
2341 .create = lo_create,
2342 .getlk = lo_getlk,
2343 .setlk = lo_setlk,
2344 .open = lo_open,
2345 .release = lo_release,
2346 .flush = lo_flush,
2347 .fsync = lo_fsync,
2348 .read = lo_read,
2349 .write_buf = lo_write_buf,
2350 .statfs = lo_statfs,
2351 .fallocate = lo_fallocate,
2352 .flock = lo_flock,
2353 .getxattr = lo_getxattr,
2354 .listxattr = lo_listxattr,
2355 .setxattr = lo_setxattr,
2356 .removexattr = lo_removexattr,
2357 #ifdef HAVE_COPY_FILE_RANGE
2358 .copy_file_range = lo_copy_file_range,
2359 #endif
2360 .lseek = lo_lseek,
2361 .destroy = lo_destroy,
2362 };
2363
2364 /* Print vhost-user.json backend program capabilities */
2365 static void print_capabilities(void)
2366 {
2367 printf("{\n");
2368 printf(" \"type\": \"fs\"\n");
2369 printf("}\n");
2370 }
2371
2372 /*
2373 * Drop all Linux capabilities because the wait parent process only needs to
2374 * sit in waitpid(2) and terminate.
2375 */
2376 static void setup_wait_parent_capabilities(void)
2377 {
2378 capng_setpid(syscall(SYS_gettid));
2379 capng_clear(CAPNG_SELECT_BOTH);
2380 capng_apply(CAPNG_SELECT_BOTH);
2381 }
2382
2383 /*
2384 * Move to a new mount, net, and pid namespaces to isolate this process.
2385 */
2386 static void setup_namespaces(struct lo_data *lo, struct fuse_session *se)
2387 {
2388 pid_t child;
2389 char template[] = "virtiofsd-XXXXXX";
2390 char *tmpdir;
2391
2392 /*
2393 * Create a new pid namespace for *child* processes. We'll have to
2394 * fork in order to enter the new pid namespace. A new mount namespace
2395 * is also needed so that we can remount /proc for the new pid
2396 * namespace.
2397 *
2398 * Our UNIX domain sockets have been created. Now we can move to
2399 * an empty network namespace to prevent TCP/IP and other network
2400 * activity in case this process is compromised.
2401 */
2402 if (unshare(CLONE_NEWPID | CLONE_NEWNS | CLONE_NEWNET) != 0) {
2403 fuse_log(FUSE_LOG_ERR, "unshare(CLONE_NEWPID | CLONE_NEWNS): %m\n");
2404 exit(1);
2405 }
2406
2407 child = fork();
2408 if (child < 0) {
2409 fuse_log(FUSE_LOG_ERR, "fork() failed: %m\n");
2410 exit(1);
2411 }
2412 if (child > 0) {
2413 pid_t waited;
2414 int wstatus;
2415
2416 setup_wait_parent_capabilities();
2417
2418 /* The parent waits for the child */
2419 do {
2420 waited = waitpid(child, &wstatus, 0);
2421 } while (waited < 0 && errno == EINTR && !se->exited);
2422
2423 /* We were terminated by a signal, see fuse_signals.c */
2424 if (se->exited) {
2425 exit(0);
2426 }
2427
2428 if (WIFEXITED(wstatus)) {
2429 exit(WEXITSTATUS(wstatus));
2430 }
2431
2432 exit(1);
2433 }
2434
2435 /* Send us SIGTERM when the parent thread terminates, see prctl(2) */
2436 prctl(PR_SET_PDEATHSIG, SIGTERM);
2437
2438 /*
2439 * If the mounts have shared propagation then we want to opt out so our
2440 * mount changes don't affect the parent mount namespace.
2441 */
2442 if (mount(NULL, "/", NULL, MS_REC | MS_SLAVE, NULL) < 0) {
2443 fuse_log(FUSE_LOG_ERR, "mount(/, MS_REC|MS_SLAVE): %m\n");
2444 exit(1);
2445 }
2446
2447 /* The child must remount /proc to use the new pid namespace */
2448 if (mount("proc", "/proc", "proc",
2449 MS_NODEV | MS_NOEXEC | MS_NOSUID | MS_RELATIME, NULL) < 0) {
2450 fuse_log(FUSE_LOG_ERR, "mount(/proc): %m\n");
2451 exit(1);
2452 }
2453
2454 tmpdir = mkdtemp(template);
2455 if (!tmpdir) {
2456 fuse_log(FUSE_LOG_ERR, "tmpdir(%s): %m\n", template);
2457 exit(1);
2458 }
2459
2460 if (mount("/proc/self/fd", tmpdir, NULL, MS_BIND, NULL) < 0) {
2461 fuse_log(FUSE_LOG_ERR, "mount(/proc/self/fd, %s, MS_BIND): %m\n",
2462 tmpdir);
2463 exit(1);
2464 }
2465
2466 /* Now we can get our /proc/self/fd directory file descriptor */
2467 lo->proc_self_fd = open(tmpdir, O_PATH);
2468 if (lo->proc_self_fd == -1) {
2469 fuse_log(FUSE_LOG_ERR, "open(%s, O_PATH): %m\n", tmpdir);
2470 exit(1);
2471 }
2472
2473 if (umount2(tmpdir, MNT_DETACH) < 0) {
2474 fuse_log(FUSE_LOG_ERR, "umount2(%s, MNT_DETACH): %m\n", tmpdir);
2475 exit(1);
2476 }
2477
2478 if (rmdir(tmpdir) < 0) {
2479 fuse_log(FUSE_LOG_ERR, "rmdir(%s): %m\n", tmpdir);
2480 }
2481 }
2482
2483 /*
2484 * Capture the capability state, we'll need to restore this for individual
2485 * threads later; see load_capng.
2486 */
2487 static void setup_capng(void)
2488 {
2489 /* Note this accesses /proc so has to happen before the sandbox */
2490 if (capng_get_caps_process()) {
2491 fuse_log(FUSE_LOG_ERR, "capng_get_caps_process\n");
2492 exit(1);
2493 }
2494 pthread_mutex_init(&cap.mutex, NULL);
2495 pthread_mutex_lock(&cap.mutex);
2496 cap.saved = capng_save_state();
2497 if (!cap.saved) {
2498 fuse_log(FUSE_LOG_ERR, "capng_save_state\n");
2499 exit(1);
2500 }
2501 pthread_mutex_unlock(&cap.mutex);
2502 }
2503
2504 static void cleanup_capng(void)
2505 {
2506 free(cap.saved);
2507 cap.saved = NULL;
2508 pthread_mutex_destroy(&cap.mutex);
2509 }
2510
2511
2512 /*
2513 * Make the source directory our root so symlinks cannot escape and no other
2514 * files are accessible. Assumes unshare(CLONE_NEWNS) was already called.
2515 */
2516 static void setup_mounts(const char *source)
2517 {
2518 int oldroot;
2519 int newroot;
2520
2521 if (mount(source, source, NULL, MS_BIND | MS_REC, NULL) < 0) {
2522 fuse_log(FUSE_LOG_ERR, "mount(%s, %s, MS_BIND): %m\n", source, source);
2523 exit(1);
2524 }
2525
2526 /* This magic is based on lxc's lxc_pivot_root() */
2527 oldroot = open("/", O_DIRECTORY | O_RDONLY | O_CLOEXEC);
2528 if (oldroot < 0) {
2529 fuse_log(FUSE_LOG_ERR, "open(/): %m\n");
2530 exit(1);
2531 }
2532
2533 newroot = open(source, O_DIRECTORY | O_RDONLY | O_CLOEXEC);
2534 if (newroot < 0) {
2535 fuse_log(FUSE_LOG_ERR, "open(%s): %m\n", source);
2536 exit(1);
2537 }
2538
2539 if (fchdir(newroot) < 0) {
2540 fuse_log(FUSE_LOG_ERR, "fchdir(newroot): %m\n");
2541 exit(1);
2542 }
2543
2544 if (syscall(__NR_pivot_root, ".", ".") < 0) {
2545 fuse_log(FUSE_LOG_ERR, "pivot_root(., .): %m\n");
2546 exit(1);
2547 }
2548
2549 if (fchdir(oldroot) < 0) {
2550 fuse_log(FUSE_LOG_ERR, "fchdir(oldroot): %m\n");
2551 exit(1);
2552 }
2553
2554 if (mount("", ".", "", MS_SLAVE | MS_REC, NULL) < 0) {
2555 fuse_log(FUSE_LOG_ERR, "mount(., MS_SLAVE | MS_REC): %m\n");
2556 exit(1);
2557 }
2558
2559 if (umount2(".", MNT_DETACH) < 0) {
2560 fuse_log(FUSE_LOG_ERR, "umount2(., MNT_DETACH): %m\n");
2561 exit(1);
2562 }
2563
2564 if (fchdir(newroot) < 0) {
2565 fuse_log(FUSE_LOG_ERR, "fchdir(newroot): %m\n");
2566 exit(1);
2567 }
2568
2569 close(newroot);
2570 close(oldroot);
2571 }
2572
2573 /*
2574 * Only keep whitelisted capabilities that are needed for file system operation
2575 * The (possibly NULL) modcaps_in string passed in is free'd before exit.
2576 */
2577 static void setup_capabilities(char *modcaps_in)
2578 {
2579 char *modcaps = modcaps_in;
2580 pthread_mutex_lock(&cap.mutex);
2581 capng_restore_state(&cap.saved);
2582
2583 /*
2584 * Whitelist file system-related capabilities that are needed for a file
2585 * server to act like root. Drop everything else like networking and
2586 * sysadmin capabilities.
2587 *
2588 * Exclusions:
2589 * 1. CAP_LINUX_IMMUTABLE is not included because it's only used via ioctl
2590 * and we don't support that.
2591 * 2. CAP_MAC_OVERRIDE is not included because it only seems to be
2592 * used by the Smack LSM. Omit it until there is demand for it.
2593 */
2594 capng_setpid(syscall(SYS_gettid));
2595 capng_clear(CAPNG_SELECT_BOTH);
2596 if (capng_updatev(CAPNG_ADD, CAPNG_PERMITTED | CAPNG_EFFECTIVE,
2597 CAP_CHOWN,
2598 CAP_DAC_OVERRIDE,
2599 CAP_FOWNER,
2600 CAP_FSETID,
2601 CAP_SETGID,
2602 CAP_SETUID,
2603 CAP_MKNOD,
2604 CAP_SETFCAP,
2605 -1)) {
2606 fuse_log(FUSE_LOG_ERR, "%s: capng_updatev failed\n", __func__);
2607 exit(1);
2608 }
2609
2610 /*
2611 * The modcaps option is a colon separated list of caps,
2612 * each preceded by either + or -.
2613 */
2614 while (modcaps) {
2615 capng_act_t action;
2616 int cap;
2617
2618 char *next = strchr(modcaps, ':');
2619 if (next) {
2620 *next = '\0';
2621 next++;
2622 }
2623
2624 switch (modcaps[0]) {
2625 case '+':
2626 action = CAPNG_ADD;
2627 break;
2628
2629 case '-':
2630 action = CAPNG_DROP;
2631 break;
2632
2633 default:
2634 fuse_log(FUSE_LOG_ERR,
2635 "%s: Expecting '+'/'-' in modcaps but found '%c'\n",
2636 __func__, modcaps[0]);
2637 exit(1);
2638 }
2639 cap = capng_name_to_capability(modcaps + 1);
2640 if (cap < 0) {
2641 fuse_log(FUSE_LOG_ERR, "%s: Unknown capability '%s'\n", __func__,
2642 modcaps);
2643 exit(1);
2644 }
2645 if (capng_update(action, CAPNG_PERMITTED | CAPNG_EFFECTIVE, cap)) {
2646 fuse_log(FUSE_LOG_ERR, "%s: capng_update failed for '%s'\n",
2647 __func__, modcaps);
2648 exit(1);
2649 }
2650
2651 modcaps = next;
2652 }
2653 g_free(modcaps_in);
2654
2655 if (capng_apply(CAPNG_SELECT_BOTH)) {
2656 fuse_log(FUSE_LOG_ERR, "%s: capng_apply failed\n", __func__);
2657 exit(1);
2658 }
2659
2660 cap.saved = capng_save_state();
2661 if (!cap.saved) {
2662 fuse_log(FUSE_LOG_ERR, "%s: capng_save_state failed\n", __func__);
2663 exit(1);
2664 }
2665 pthread_mutex_unlock(&cap.mutex);
2666 }
2667
2668 /*
2669 * Lock down this process to prevent access to other processes or files outside
2670 * source directory. This reduces the impact of arbitrary code execution bugs.
2671 */
2672 static void setup_sandbox(struct lo_data *lo, struct fuse_session *se,
2673 bool enable_syslog)
2674 {
2675 setup_namespaces(lo, se);
2676 setup_mounts(lo->source);
2677 setup_seccomp(enable_syslog);
2678 setup_capabilities(g_strdup(lo->modcaps));
2679 }
2680
2681 /* Set the maximum number of open file descriptors */
2682 static void setup_nofile_rlimit(unsigned long rlimit_nofile)
2683 {
2684 struct rlimit rlim = {
2685 .rlim_cur = rlimit_nofile,
2686 .rlim_max = rlimit_nofile,
2687 };
2688
2689 if (rlimit_nofile == 0) {
2690 return; /* nothing to do */
2691 }
2692
2693 if (setrlimit(RLIMIT_NOFILE, &rlim) < 0) {
2694 /* Ignore SELinux denials */
2695 if (errno == EPERM) {
2696 return;
2697 }
2698
2699 fuse_log(FUSE_LOG_ERR, "setrlimit(RLIMIT_NOFILE): %m\n");
2700 exit(1);
2701 }
2702 }
2703
2704 static void log_func(enum fuse_log_level level, const char *fmt, va_list ap)
2705 {
2706 g_autofree char *localfmt = NULL;
2707
2708 if (current_log_level < level) {
2709 return;
2710 }
2711
2712 if (current_log_level == FUSE_LOG_DEBUG) {
2713 if (!use_syslog) {
2714 localfmt = g_strdup_printf("[%" PRId64 "] [ID: %08ld] %s",
2715 get_clock(), syscall(__NR_gettid), fmt);
2716 } else {
2717 localfmt = g_strdup_printf("[ID: %08ld] %s", syscall(__NR_gettid),
2718 fmt);
2719 }
2720 fmt = localfmt;
2721 }
2722
2723 if (use_syslog) {
2724 int priority = LOG_ERR;
2725 switch (level) {
2726 case FUSE_LOG_EMERG:
2727 priority = LOG_EMERG;
2728 break;
2729 case FUSE_LOG_ALERT:
2730 priority = LOG_ALERT;
2731 break;
2732 case FUSE_LOG_CRIT:
2733 priority = LOG_CRIT;
2734 break;
2735 case FUSE_LOG_ERR:
2736 priority = LOG_ERR;
2737 break;
2738 case FUSE_LOG_WARNING:
2739 priority = LOG_WARNING;
2740 break;
2741 case FUSE_LOG_NOTICE:
2742 priority = LOG_NOTICE;
2743 break;
2744 case FUSE_LOG_INFO:
2745 priority = LOG_INFO;
2746 break;
2747 case FUSE_LOG_DEBUG:
2748 priority = LOG_DEBUG;
2749 break;
2750 }
2751 vsyslog(priority, fmt, ap);
2752 } else {
2753 vfprintf(stderr, fmt, ap);
2754 }
2755 }
2756
2757 static void setup_root(struct lo_data *lo, struct lo_inode *root)
2758 {
2759 int fd, res;
2760 struct stat stat;
2761
2762 fd = open("/", O_PATH);
2763 if (fd == -1) {
2764 fuse_log(FUSE_LOG_ERR, "open(%s, O_PATH): %m\n", lo->source);
2765 exit(1);
2766 }
2767
2768 res = fstatat(fd, "", &stat, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
2769 if (res == -1) {
2770 fuse_log(FUSE_LOG_ERR, "fstatat(%s): %m\n", lo->source);
2771 exit(1);
2772 }
2773
2774 root->filetype = S_IFDIR;
2775 root->fd = fd;
2776 root->key.ino = stat.st_ino;
2777 root->key.dev = stat.st_dev;
2778 root->nlookup = 2;
2779 g_atomic_int_set(&root->refcount, 2);
2780 }
2781
2782 static guint lo_key_hash(gconstpointer key)
2783 {
2784 const struct lo_key *lkey = key;
2785
2786 return (guint)lkey->ino + (guint)lkey->dev;
2787 }
2788
2789 static gboolean lo_key_equal(gconstpointer a, gconstpointer b)
2790 {
2791 const struct lo_key *la = a;
2792 const struct lo_key *lb = b;
2793
2794 return la->ino == lb->ino && la->dev == lb->dev;
2795 }
2796
2797 static void fuse_lo_data_cleanup(struct lo_data *lo)
2798 {
2799 if (lo->inodes) {
2800 g_hash_table_destroy(lo->inodes);
2801 }
2802 lo_map_destroy(&lo->fd_map);
2803 lo_map_destroy(&lo->dirp_map);
2804 lo_map_destroy(&lo->ino_map);
2805
2806 if (lo->proc_self_fd >= 0) {
2807 close(lo->proc_self_fd);
2808 }
2809
2810 if (lo->root.fd >= 0) {
2811 close(lo->root.fd);
2812 }
2813
2814 free(lo->source);
2815 }
2816
2817 int main(int argc, char *argv[])
2818 {
2819 struct fuse_args args = FUSE_ARGS_INIT(argc, argv);
2820 struct fuse_session *se;
2821 struct fuse_cmdline_opts opts;
2822 struct lo_data lo = {
2823 .debug = 0,
2824 .writeback = 0,
2825 .posix_lock = 0,
2826 .proc_self_fd = -1,
2827 };
2828 struct lo_map_elem *root_elem;
2829 int ret = -1;
2830
2831 /* Don't mask creation mode, kernel already did that */
2832 umask(0);
2833
2834 pthread_mutex_init(&lo.mutex, NULL);
2835 lo.inodes = g_hash_table_new(lo_key_hash, lo_key_equal);
2836 lo.root.fd = -1;
2837 lo.root.fuse_ino = FUSE_ROOT_ID;
2838 lo.cache = CACHE_AUTO;
2839
2840 /*
2841 * Set up the ino map like this:
2842 * [0] Reserved (will not be used)
2843 * [1] Root inode
2844 */
2845 lo_map_init(&lo.ino_map);
2846 lo_map_reserve(&lo.ino_map, 0)->in_use = false;
2847 root_elem = lo_map_reserve(&lo.ino_map, lo.root.fuse_ino);
2848 root_elem->inode = &lo.root;
2849
2850 lo_map_init(&lo.dirp_map);
2851 lo_map_init(&lo.fd_map);
2852
2853 if (fuse_parse_cmdline(&args, &opts) != 0) {
2854 goto err_out1;
2855 }
2856 fuse_set_log_func(log_func);
2857 use_syslog = opts.syslog;
2858 if (use_syslog) {
2859 openlog("virtiofsd", LOG_PID, LOG_DAEMON);
2860 }
2861
2862 if (opts.show_help) {
2863 printf("usage: %s [options]\n\n", argv[0]);
2864 fuse_cmdline_help();
2865 printf(" -o source=PATH shared directory tree\n");
2866 fuse_lowlevel_help();
2867 ret = 0;
2868 goto err_out1;
2869 } else if (opts.show_version) {
2870 fuse_lowlevel_version();
2871 ret = 0;
2872 goto err_out1;
2873 } else if (opts.print_capabilities) {
2874 print_capabilities();
2875 ret = 0;
2876 goto err_out1;
2877 }
2878
2879 if (fuse_opt_parse(&args, &lo, lo_opts, NULL) == -1) {
2880 goto err_out1;
2881 }
2882
2883 /*
2884 * log_level is 0 if not configured via cmd options (0 is LOG_EMERG,
2885 * and we don't use this log level).
2886 */
2887 if (opts.log_level != 0) {
2888 current_log_level = opts.log_level;
2889 }
2890 lo.debug = opts.debug;
2891 if (lo.debug) {
2892 current_log_level = FUSE_LOG_DEBUG;
2893 }
2894 if (lo.source) {
2895 struct stat stat;
2896 int res;
2897
2898 res = lstat(lo.source, &stat);
2899 if (res == -1) {
2900 fuse_log(FUSE_LOG_ERR, "failed to stat source (\"%s\"): %m\n",
2901 lo.source);
2902 exit(1);
2903 }
2904 if (!S_ISDIR(stat.st_mode)) {
2905 fuse_log(FUSE_LOG_ERR, "source is not a directory\n");
2906 exit(1);
2907 }
2908 } else {
2909 lo.source = strdup("/");
2910 }
2911 if (!lo.timeout_set) {
2912 switch (lo.cache) {
2913 case CACHE_NONE:
2914 lo.timeout = 0.0;
2915 break;
2916
2917 case CACHE_AUTO:
2918 lo.timeout = 1.0;
2919 break;
2920
2921 case CACHE_ALWAYS:
2922 lo.timeout = 86400.0;
2923 break;
2924 }
2925 } else if (lo.timeout < 0) {
2926 fuse_log(FUSE_LOG_ERR, "timeout is negative (%lf)\n", lo.timeout);
2927 exit(1);
2928 }
2929
2930 se = fuse_session_new(&args, &lo_oper, sizeof(lo_oper), &lo);
2931 if (se == NULL) {
2932 goto err_out1;
2933 }
2934
2935 if (fuse_set_signal_handlers(se) != 0) {
2936 goto err_out2;
2937 }
2938
2939 if (fuse_session_mount(se) != 0) {
2940 goto err_out3;
2941 }
2942
2943 fuse_daemonize(opts.foreground);
2944
2945 setup_nofile_rlimit(opts.rlimit_nofile);
2946
2947 /* Must be before sandbox since it wants /proc */
2948 setup_capng();
2949
2950 setup_sandbox(&lo, se, opts.syslog);
2951
2952 setup_root(&lo, &lo.root);
2953 /* Block until ctrl+c or fusermount -u */
2954 ret = virtio_loop(se);
2955
2956 fuse_session_unmount(se);
2957 cleanup_capng();
2958 err_out3:
2959 fuse_remove_signal_handlers(se);
2960 err_out2:
2961 fuse_session_destroy(se);
2962 err_out1:
2963 fuse_opt_free_args(&args);
2964
2965 fuse_lo_data_cleanup(&lo);
2966
2967 return ret ? 1 : 0;
2968 }