virtiofsd: Terminate capability list
[qemu.git] / tools / virtiofsd / passthrough_ll.c
1 /*
2 * FUSE: Filesystem in Userspace
3 * Copyright (C) 2001-2007 Miklos Szeredi <miklos@szeredi.hu>
4 *
5 * This program can be distributed under the terms of the GNU GPLv2.
6 * See the file COPYING.
7 */
8
9 /*
10 *
11 * This file system mirrors the existing file system hierarchy of the
12 * system, starting at the root file system. This is implemented by
13 * just "passing through" all requests to the corresponding user-space
14 * libc functions. In contrast to passthrough.c and passthrough_fh.c,
15 * this implementation uses the low-level API. Its performance should
16 * be the least bad among the three, but many operations are not
17 * implemented. In particular, it is not possible to remove files (or
18 * directories) because the code necessary to defer actual removal
19 * until the file is not opened anymore would make the example much
20 * more complicated.
21 *
22 * When writeback caching is enabled (-o writeback mount option), it
23 * is only possible to write to files for which the mounting user has
24 * read permissions. This is because the writeback cache requires the
25 * kernel to be able to issue read requests for all files (which the
26 * passthrough filesystem cannot satisfy if it can't read the file in
27 * the underlying filesystem).
28 *
29 * Compile with:
30 *
31 * gcc -Wall passthrough_ll.c `pkg-config fuse3 --cflags --libs` -o
32 * passthrough_ll
33 *
34 * ## Source code ##
35 * \include passthrough_ll.c
36 */
37
38 #include "qemu/osdep.h"
39 #include "qemu/timer.h"
40 #include "fuse_virtio.h"
41 #include "fuse_log.h"
42 #include "fuse_lowlevel.h"
43 #include <assert.h>
44 #include <cap-ng.h>
45 #include <dirent.h>
46 #include <errno.h>
47 #include <glib.h>
48 #include <inttypes.h>
49 #include <limits.h>
50 #include <pthread.h>
51 #include <stdbool.h>
52 #include <stddef.h>
53 #include <stdio.h>
54 #include <stdlib.h>
55 #include <string.h>
56 #include <sys/file.h>
57 #include <sys/mount.h>
58 #include <sys/prctl.h>
59 #include <sys/resource.h>
60 #include <sys/syscall.h>
61 #include <sys/types.h>
62 #include <sys/wait.h>
63 #include <sys/xattr.h>
64 #include <syslog.h>
65 #include <unistd.h>
66
67 #include "passthrough_helpers.h"
68 #include "seccomp.h"
69
70 /* Keep track of inode posix locks for each owner. */
71 struct lo_inode_plock {
72 uint64_t lock_owner;
73 int fd; /* fd for OFD locks */
74 };
75
76 struct lo_map_elem {
77 union {
78 struct lo_inode *inode;
79 struct lo_dirp *dirp;
80 int fd;
81 ssize_t freelist;
82 };
83 bool in_use;
84 };
85
86 /* Maps FUSE fh or ino values to internal objects */
87 struct lo_map {
88 struct lo_map_elem *elems;
89 size_t nelems;
90 ssize_t freelist;
91 };
92
93 struct lo_key {
94 ino_t ino;
95 dev_t dev;
96 };
97
98 struct lo_inode {
99 int fd;
100
101 /*
102 * Atomic reference count for this object. The nlookup field holds a
103 * reference and release it when nlookup reaches 0.
104 */
105 gint refcount;
106
107 struct lo_key key;
108
109 /*
110 * This counter keeps the inode alive during the FUSE session.
111 * Incremented when the FUSE inode number is sent in a reply
112 * (FUSE_LOOKUP, FUSE_READDIRPLUS, etc). Decremented when an inode is
113 * released by requests like FUSE_FORGET, FUSE_RMDIR, FUSE_RENAME, etc.
114 *
115 * Note that this value is untrusted because the client can manipulate
116 * it arbitrarily using FUSE_FORGET requests.
117 *
118 * Protected by lo->mutex.
119 */
120 uint64_t nlookup;
121
122 fuse_ino_t fuse_ino;
123 pthread_mutex_t plock_mutex;
124 GHashTable *posix_locks; /* protected by lo_inode->plock_mutex */
125
126 mode_t filetype;
127 };
128
129 struct lo_cred {
130 uid_t euid;
131 gid_t egid;
132 };
133
134 enum {
135 CACHE_NONE,
136 CACHE_AUTO,
137 CACHE_ALWAYS,
138 };
139
140 struct lo_data {
141 pthread_mutex_t mutex;
142 int debug;
143 int writeback;
144 int flock;
145 int posix_lock;
146 int xattr;
147 char *source;
148 double timeout;
149 int cache;
150 int timeout_set;
151 int readdirplus_set;
152 int readdirplus_clear;
153 struct lo_inode root;
154 GHashTable *inodes; /* protected by lo->mutex */
155 struct lo_map ino_map; /* protected by lo->mutex */
156 struct lo_map dirp_map; /* protected by lo->mutex */
157 struct lo_map fd_map; /* protected by lo->mutex */
158
159 /* An O_PATH file descriptor to /proc/self/fd/ */
160 int proc_self_fd;
161 };
162
163 static const struct fuse_opt lo_opts[] = {
164 { "writeback", offsetof(struct lo_data, writeback), 1 },
165 { "no_writeback", offsetof(struct lo_data, writeback), 0 },
166 { "source=%s", offsetof(struct lo_data, source), 0 },
167 { "flock", offsetof(struct lo_data, flock), 1 },
168 { "no_flock", offsetof(struct lo_data, flock), 0 },
169 { "posix_lock", offsetof(struct lo_data, posix_lock), 1 },
170 { "no_posix_lock", offsetof(struct lo_data, posix_lock), 0 },
171 { "xattr", offsetof(struct lo_data, xattr), 1 },
172 { "no_xattr", offsetof(struct lo_data, xattr), 0 },
173 { "timeout=%lf", offsetof(struct lo_data, timeout), 0 },
174 { "timeout=", offsetof(struct lo_data, timeout_set), 1 },
175 { "cache=none", offsetof(struct lo_data, cache), CACHE_NONE },
176 { "cache=auto", offsetof(struct lo_data, cache), CACHE_AUTO },
177 { "cache=always", offsetof(struct lo_data, cache), CACHE_ALWAYS },
178 { "readdirplus", offsetof(struct lo_data, readdirplus_set), 1 },
179 { "no_readdirplus", offsetof(struct lo_data, readdirplus_clear), 1 },
180 FUSE_OPT_END
181 };
182 static bool use_syslog = false;
183 static int current_log_level;
184 static void unref_inode_lolocked(struct lo_data *lo, struct lo_inode *inode,
185 uint64_t n);
186
187 static struct {
188 pthread_mutex_t mutex;
189 void *saved;
190 } cap;
191 /* That we loaded cap-ng in the current thread from the saved */
192 static __thread bool cap_loaded = 0;
193
194 static struct lo_inode *lo_find(struct lo_data *lo, struct stat *st);
195
196 static int is_dot_or_dotdot(const char *name)
197 {
198 return name[0] == '.' &&
199 (name[1] == '\0' || (name[1] == '.' && name[2] == '\0'));
200 }
201
202 /* Is `path` a single path component that is not "." or ".."? */
203 static int is_safe_path_component(const char *path)
204 {
205 if (strchr(path, '/')) {
206 return 0;
207 }
208
209 return !is_dot_or_dotdot(path);
210 }
211
212 static struct lo_data *lo_data(fuse_req_t req)
213 {
214 return (struct lo_data *)fuse_req_userdata(req);
215 }
216
217 /*
218 * Load capng's state from our saved state if the current thread
219 * hadn't previously been loaded.
220 * returns 0 on success
221 */
222 static int load_capng(void)
223 {
224 if (!cap_loaded) {
225 pthread_mutex_lock(&cap.mutex);
226 capng_restore_state(&cap.saved);
227 /*
228 * restore_state free's the saved copy
229 * so make another.
230 */
231 cap.saved = capng_save_state();
232 if (!cap.saved) {
233 pthread_mutex_unlock(&cap.mutex);
234 fuse_log(FUSE_LOG_ERR, "capng_save_state (thread)\n");
235 return -EINVAL;
236 }
237 pthread_mutex_unlock(&cap.mutex);
238
239 /*
240 * We want to use the loaded state for our pid,
241 * not the original
242 */
243 capng_setpid(syscall(SYS_gettid));
244 cap_loaded = true;
245 }
246 return 0;
247 }
248
249 /*
250 * Helpers for dropping and regaining effective capabilities. Returns 0
251 * on success, error otherwise
252 */
253 static int drop_effective_cap(const char *cap_name, bool *cap_dropped)
254 {
255 int cap, ret;
256
257 cap = capng_name_to_capability(cap_name);
258 if (cap < 0) {
259 ret = errno;
260 fuse_log(FUSE_LOG_ERR, "capng_name_to_capability(%s) failed:%s\n",
261 cap_name, strerror(errno));
262 goto out;
263 }
264
265 if (load_capng()) {
266 ret = errno;
267 fuse_log(FUSE_LOG_ERR, "load_capng() failed\n");
268 goto out;
269 }
270
271 /* We dont have this capability in effective set already. */
272 if (!capng_have_capability(CAPNG_EFFECTIVE, cap)) {
273 ret = 0;
274 goto out;
275 }
276
277 if (capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, cap)) {
278 ret = errno;
279 fuse_log(FUSE_LOG_ERR, "capng_update(DROP,) failed\n");
280 goto out;
281 }
282
283 if (capng_apply(CAPNG_SELECT_CAPS)) {
284 ret = errno;
285 fuse_log(FUSE_LOG_ERR, "drop:capng_apply() failed\n");
286 goto out;
287 }
288
289 ret = 0;
290 if (cap_dropped) {
291 *cap_dropped = true;
292 }
293
294 out:
295 return ret;
296 }
297
298 static int gain_effective_cap(const char *cap_name)
299 {
300 int cap;
301 int ret = 0;
302
303 cap = capng_name_to_capability(cap_name);
304 if (cap < 0) {
305 ret = errno;
306 fuse_log(FUSE_LOG_ERR, "capng_name_to_capability(%s) failed:%s\n",
307 cap_name, strerror(errno));
308 goto out;
309 }
310
311 if (load_capng()) {
312 ret = errno;
313 fuse_log(FUSE_LOG_ERR, "load_capng() failed\n");
314 goto out;
315 }
316
317 if (capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, cap)) {
318 ret = errno;
319 fuse_log(FUSE_LOG_ERR, "capng_update(ADD,) failed\n");
320 goto out;
321 }
322
323 if (capng_apply(CAPNG_SELECT_CAPS)) {
324 ret = errno;
325 fuse_log(FUSE_LOG_ERR, "gain:capng_apply() failed\n");
326 goto out;
327 }
328 ret = 0;
329
330 out:
331 return ret;
332 }
333
334 static void lo_map_init(struct lo_map *map)
335 {
336 map->elems = NULL;
337 map->nelems = 0;
338 map->freelist = -1;
339 }
340
341 static void lo_map_destroy(struct lo_map *map)
342 {
343 free(map->elems);
344 }
345
346 static int lo_map_grow(struct lo_map *map, size_t new_nelems)
347 {
348 struct lo_map_elem *new_elems;
349 size_t i;
350
351 if (new_nelems <= map->nelems) {
352 return 1;
353 }
354
355 new_elems = realloc(map->elems, sizeof(map->elems[0]) * new_nelems);
356 if (!new_elems) {
357 return 0;
358 }
359
360 for (i = map->nelems; i < new_nelems; i++) {
361 new_elems[i].freelist = i + 1;
362 new_elems[i].in_use = false;
363 }
364 new_elems[new_nelems - 1].freelist = -1;
365
366 map->elems = new_elems;
367 map->freelist = map->nelems;
368 map->nelems = new_nelems;
369 return 1;
370 }
371
372 static struct lo_map_elem *lo_map_alloc_elem(struct lo_map *map)
373 {
374 struct lo_map_elem *elem;
375
376 if (map->freelist == -1 && !lo_map_grow(map, map->nelems + 256)) {
377 return NULL;
378 }
379
380 elem = &map->elems[map->freelist];
381 map->freelist = elem->freelist;
382
383 elem->in_use = true;
384
385 return elem;
386 }
387
388 static struct lo_map_elem *lo_map_reserve(struct lo_map *map, size_t key)
389 {
390 ssize_t *prev;
391
392 if (!lo_map_grow(map, key + 1)) {
393 return NULL;
394 }
395
396 for (prev = &map->freelist; *prev != -1;
397 prev = &map->elems[*prev].freelist) {
398 if (*prev == key) {
399 struct lo_map_elem *elem = &map->elems[key];
400
401 *prev = elem->freelist;
402 elem->in_use = true;
403 return elem;
404 }
405 }
406 return NULL;
407 }
408
409 static struct lo_map_elem *lo_map_get(struct lo_map *map, size_t key)
410 {
411 if (key >= map->nelems) {
412 return NULL;
413 }
414 if (!map->elems[key].in_use) {
415 return NULL;
416 }
417 return &map->elems[key];
418 }
419
420 static void lo_map_remove(struct lo_map *map, size_t key)
421 {
422 struct lo_map_elem *elem;
423
424 if (key >= map->nelems) {
425 return;
426 }
427
428 elem = &map->elems[key];
429 if (!elem->in_use) {
430 return;
431 }
432
433 elem->in_use = false;
434
435 elem->freelist = map->freelist;
436 map->freelist = key;
437 }
438
439 /* Assumes lo->mutex is held */
440 static ssize_t lo_add_fd_mapping(fuse_req_t req, int fd)
441 {
442 struct lo_map_elem *elem;
443
444 elem = lo_map_alloc_elem(&lo_data(req)->fd_map);
445 if (!elem) {
446 return -1;
447 }
448
449 elem->fd = fd;
450 return elem - lo_data(req)->fd_map.elems;
451 }
452
453 /* Assumes lo->mutex is held */
454 static ssize_t lo_add_dirp_mapping(fuse_req_t req, struct lo_dirp *dirp)
455 {
456 struct lo_map_elem *elem;
457
458 elem = lo_map_alloc_elem(&lo_data(req)->dirp_map);
459 if (!elem) {
460 return -1;
461 }
462
463 elem->dirp = dirp;
464 return elem - lo_data(req)->dirp_map.elems;
465 }
466
467 /* Assumes lo->mutex is held */
468 static ssize_t lo_add_inode_mapping(fuse_req_t req, struct lo_inode *inode)
469 {
470 struct lo_map_elem *elem;
471
472 elem = lo_map_alloc_elem(&lo_data(req)->ino_map);
473 if (!elem) {
474 return -1;
475 }
476
477 elem->inode = inode;
478 return elem - lo_data(req)->ino_map.elems;
479 }
480
481 static void lo_inode_put(struct lo_data *lo, struct lo_inode **inodep)
482 {
483 struct lo_inode *inode = *inodep;
484
485 if (!inode) {
486 return;
487 }
488
489 *inodep = NULL;
490
491 if (g_atomic_int_dec_and_test(&inode->refcount)) {
492 close(inode->fd);
493 free(inode);
494 }
495 }
496
497 /* Caller must release refcount using lo_inode_put() */
498 static struct lo_inode *lo_inode(fuse_req_t req, fuse_ino_t ino)
499 {
500 struct lo_data *lo = lo_data(req);
501 struct lo_map_elem *elem;
502
503 pthread_mutex_lock(&lo->mutex);
504 elem = lo_map_get(&lo->ino_map, ino);
505 if (elem) {
506 g_atomic_int_inc(&elem->inode->refcount);
507 }
508 pthread_mutex_unlock(&lo->mutex);
509
510 if (!elem) {
511 return NULL;
512 }
513
514 return elem->inode;
515 }
516
517 /*
518 * TODO Remove this helper and force callers to hold an inode refcount until
519 * they are done with the fd. This will be done in a later patch to make
520 * review easier.
521 */
522 static int lo_fd(fuse_req_t req, fuse_ino_t ino)
523 {
524 struct lo_inode *inode = lo_inode(req, ino);
525 int fd;
526
527 if (!inode) {
528 return -1;
529 }
530
531 fd = inode->fd;
532 lo_inode_put(lo_data(req), &inode);
533 return fd;
534 }
535
536 static void lo_init(void *userdata, struct fuse_conn_info *conn)
537 {
538 struct lo_data *lo = (struct lo_data *)userdata;
539
540 if (conn->capable & FUSE_CAP_EXPORT_SUPPORT) {
541 conn->want |= FUSE_CAP_EXPORT_SUPPORT;
542 }
543
544 if (lo->writeback && conn->capable & FUSE_CAP_WRITEBACK_CACHE) {
545 fuse_log(FUSE_LOG_DEBUG, "lo_init: activating writeback\n");
546 conn->want |= FUSE_CAP_WRITEBACK_CACHE;
547 }
548 if (conn->capable & FUSE_CAP_FLOCK_LOCKS) {
549 if (lo->flock) {
550 fuse_log(FUSE_LOG_DEBUG, "lo_init: activating flock locks\n");
551 conn->want |= FUSE_CAP_FLOCK_LOCKS;
552 } else {
553 fuse_log(FUSE_LOG_DEBUG, "lo_init: disabling flock locks\n");
554 conn->want &= ~FUSE_CAP_FLOCK_LOCKS;
555 }
556 }
557
558 if (conn->capable & FUSE_CAP_POSIX_LOCKS) {
559 if (lo->posix_lock) {
560 fuse_log(FUSE_LOG_DEBUG, "lo_init: activating posix locks\n");
561 conn->want |= FUSE_CAP_POSIX_LOCKS;
562 } else {
563 fuse_log(FUSE_LOG_DEBUG, "lo_init: disabling posix locks\n");
564 conn->want &= ~FUSE_CAP_POSIX_LOCKS;
565 }
566 }
567
568 if ((lo->cache == CACHE_NONE && !lo->readdirplus_set) ||
569 lo->readdirplus_clear) {
570 fuse_log(FUSE_LOG_DEBUG, "lo_init: disabling readdirplus\n");
571 conn->want &= ~FUSE_CAP_READDIRPLUS;
572 }
573 }
574
575 static void lo_getattr(fuse_req_t req, fuse_ino_t ino,
576 struct fuse_file_info *fi)
577 {
578 int res;
579 struct stat buf;
580 struct lo_data *lo = lo_data(req);
581
582 (void)fi;
583
584 res =
585 fstatat(lo_fd(req, ino), "", &buf, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
586 if (res == -1) {
587 return (void)fuse_reply_err(req, errno);
588 }
589
590 fuse_reply_attr(req, &buf, lo->timeout);
591 }
592
593 static int lo_fi_fd(fuse_req_t req, struct fuse_file_info *fi)
594 {
595 struct lo_data *lo = lo_data(req);
596 struct lo_map_elem *elem;
597
598 pthread_mutex_lock(&lo->mutex);
599 elem = lo_map_get(&lo->fd_map, fi->fh);
600 pthread_mutex_unlock(&lo->mutex);
601
602 if (!elem) {
603 return -1;
604 }
605
606 return elem->fd;
607 }
608
609 static void lo_setattr(fuse_req_t req, fuse_ino_t ino, struct stat *attr,
610 int valid, struct fuse_file_info *fi)
611 {
612 int saverr;
613 char procname[64];
614 struct lo_data *lo = lo_data(req);
615 struct lo_inode *inode;
616 int ifd;
617 int res;
618 int fd;
619
620 inode = lo_inode(req, ino);
621 if (!inode) {
622 fuse_reply_err(req, EBADF);
623 return;
624 }
625
626 ifd = inode->fd;
627
628 /* If fi->fh is invalid we'll report EBADF later */
629 if (fi) {
630 fd = lo_fi_fd(req, fi);
631 }
632
633 if (valid & FUSE_SET_ATTR_MODE) {
634 if (fi) {
635 res = fchmod(fd, attr->st_mode);
636 } else {
637 sprintf(procname, "%i", ifd);
638 res = fchmodat(lo->proc_self_fd, procname, attr->st_mode, 0);
639 }
640 if (res == -1) {
641 goto out_err;
642 }
643 }
644 if (valid & (FUSE_SET_ATTR_UID | FUSE_SET_ATTR_GID)) {
645 uid_t uid = (valid & FUSE_SET_ATTR_UID) ? attr->st_uid : (uid_t)-1;
646 gid_t gid = (valid & FUSE_SET_ATTR_GID) ? attr->st_gid : (gid_t)-1;
647
648 res = fchownat(ifd, "", uid, gid, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
649 if (res == -1) {
650 goto out_err;
651 }
652 }
653 if (valid & FUSE_SET_ATTR_SIZE) {
654 int truncfd;
655
656 if (fi) {
657 truncfd = fd;
658 } else {
659 sprintf(procname, "%i", ifd);
660 truncfd = openat(lo->proc_self_fd, procname, O_RDWR);
661 if (truncfd < 0) {
662 goto out_err;
663 }
664 }
665
666 res = ftruncate(truncfd, attr->st_size);
667 if (!fi) {
668 saverr = errno;
669 close(truncfd);
670 errno = saverr;
671 }
672 if (res == -1) {
673 goto out_err;
674 }
675 }
676 if (valid & (FUSE_SET_ATTR_ATIME | FUSE_SET_ATTR_MTIME)) {
677 struct timespec tv[2];
678
679 tv[0].tv_sec = 0;
680 tv[1].tv_sec = 0;
681 tv[0].tv_nsec = UTIME_OMIT;
682 tv[1].tv_nsec = UTIME_OMIT;
683
684 if (valid & FUSE_SET_ATTR_ATIME_NOW) {
685 tv[0].tv_nsec = UTIME_NOW;
686 } else if (valid & FUSE_SET_ATTR_ATIME) {
687 tv[0] = attr->st_atim;
688 }
689
690 if (valid & FUSE_SET_ATTR_MTIME_NOW) {
691 tv[1].tv_nsec = UTIME_NOW;
692 } else if (valid & FUSE_SET_ATTR_MTIME) {
693 tv[1] = attr->st_mtim;
694 }
695
696 if (fi) {
697 res = futimens(fd, tv);
698 } else {
699 sprintf(procname, "%i", inode->fd);
700 res = utimensat(lo->proc_self_fd, procname, tv, 0);
701 }
702 if (res == -1) {
703 goto out_err;
704 }
705 }
706 lo_inode_put(lo, &inode);
707
708 return lo_getattr(req, ino, fi);
709
710 out_err:
711 saverr = errno;
712 lo_inode_put(lo, &inode);
713 fuse_reply_err(req, saverr);
714 }
715
716 static struct lo_inode *lo_find(struct lo_data *lo, struct stat *st)
717 {
718 struct lo_inode *p;
719 struct lo_key key = {
720 .ino = st->st_ino,
721 .dev = st->st_dev,
722 };
723
724 pthread_mutex_lock(&lo->mutex);
725 p = g_hash_table_lookup(lo->inodes, &key);
726 if (p) {
727 assert(p->nlookup > 0);
728 p->nlookup++;
729 g_atomic_int_inc(&p->refcount);
730 }
731 pthread_mutex_unlock(&lo->mutex);
732
733 return p;
734 }
735
736 /* value_destroy_func for posix_locks GHashTable */
737 static void posix_locks_value_destroy(gpointer data)
738 {
739 struct lo_inode_plock *plock = data;
740
741 /*
742 * We had used open() for locks and had only one fd. So
743 * closing this fd should release all OFD locks.
744 */
745 close(plock->fd);
746 free(plock);
747 }
748
749 /*
750 * Increments nlookup and caller must release refcount using
751 * lo_inode_put(&parent).
752 */
753 static int lo_do_lookup(fuse_req_t req, fuse_ino_t parent, const char *name,
754 struct fuse_entry_param *e)
755 {
756 int newfd;
757 int res;
758 int saverr;
759 struct lo_data *lo = lo_data(req);
760 struct lo_inode *inode = NULL;
761 struct lo_inode *dir = lo_inode(req, parent);
762
763 /*
764 * name_to_handle_at() and open_by_handle_at() can reach here with fuse
765 * mount point in guest, but we don't have its inode info in the
766 * ino_map.
767 */
768 if (!dir) {
769 return ENOENT;
770 }
771
772 memset(e, 0, sizeof(*e));
773 e->attr_timeout = lo->timeout;
774 e->entry_timeout = lo->timeout;
775
776 /* Do not allow escaping root directory */
777 if (dir == &lo->root && strcmp(name, "..") == 0) {
778 name = ".";
779 }
780
781 newfd = openat(dir->fd, name, O_PATH | O_NOFOLLOW);
782 if (newfd == -1) {
783 goto out_err;
784 }
785
786 res = fstatat(newfd, "", &e->attr, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
787 if (res == -1) {
788 goto out_err;
789 }
790
791 inode = lo_find(lo, &e->attr);
792 if (inode) {
793 close(newfd);
794 } else {
795 inode = calloc(1, sizeof(struct lo_inode));
796 if (!inode) {
797 goto out_err;
798 }
799
800 /* cache only filetype */
801 inode->filetype = (e->attr.st_mode & S_IFMT);
802
803 /*
804 * One for the caller and one for nlookup (released in
805 * unref_inode_lolocked())
806 */
807 g_atomic_int_set(&inode->refcount, 2);
808
809 inode->nlookup = 1;
810 inode->fd = newfd;
811 inode->key.ino = e->attr.st_ino;
812 inode->key.dev = e->attr.st_dev;
813 pthread_mutex_init(&inode->plock_mutex, NULL);
814 inode->posix_locks = g_hash_table_new_full(
815 g_direct_hash, g_direct_equal, NULL, posix_locks_value_destroy);
816
817 pthread_mutex_lock(&lo->mutex);
818 inode->fuse_ino = lo_add_inode_mapping(req, inode);
819 g_hash_table_insert(lo->inodes, &inode->key, inode);
820 pthread_mutex_unlock(&lo->mutex);
821 }
822 e->ino = inode->fuse_ino;
823 lo_inode_put(lo, &inode);
824 lo_inode_put(lo, &dir);
825
826 fuse_log(FUSE_LOG_DEBUG, " %lli/%s -> %lli\n", (unsigned long long)parent,
827 name, (unsigned long long)e->ino);
828
829 return 0;
830
831 out_err:
832 saverr = errno;
833 if (newfd != -1) {
834 close(newfd);
835 }
836 lo_inode_put(lo, &inode);
837 lo_inode_put(lo, &dir);
838 return saverr;
839 }
840
841 static void lo_lookup(fuse_req_t req, fuse_ino_t parent, const char *name)
842 {
843 struct fuse_entry_param e;
844 int err;
845
846 fuse_log(FUSE_LOG_DEBUG, "lo_lookup(parent=%" PRIu64 ", name=%s)\n", parent,
847 name);
848
849 /*
850 * Don't use is_safe_path_component(), allow "." and ".." for NFS export
851 * support.
852 */
853 if (strchr(name, '/')) {
854 fuse_reply_err(req, EINVAL);
855 return;
856 }
857
858 err = lo_do_lookup(req, parent, name, &e);
859 if (err) {
860 fuse_reply_err(req, err);
861 } else {
862 fuse_reply_entry(req, &e);
863 }
864 }
865
866 /*
867 * On some archs, setres*id is limited to 2^16 but they
868 * provide setres*id32 variants that allow 2^32.
869 * Others just let setres*id do 2^32 anyway.
870 */
871 #ifdef SYS_setresgid32
872 #define OURSYS_setresgid SYS_setresgid32
873 #else
874 #define OURSYS_setresgid SYS_setresgid
875 #endif
876
877 #ifdef SYS_setresuid32
878 #define OURSYS_setresuid SYS_setresuid32
879 #else
880 #define OURSYS_setresuid SYS_setresuid
881 #endif
882
883 /*
884 * Change to uid/gid of caller so that file is created with
885 * ownership of caller.
886 * TODO: What about selinux context?
887 */
888 static int lo_change_cred(fuse_req_t req, struct lo_cred *old)
889 {
890 int res;
891
892 old->euid = geteuid();
893 old->egid = getegid();
894
895 res = syscall(OURSYS_setresgid, -1, fuse_req_ctx(req)->gid, -1);
896 if (res == -1) {
897 return errno;
898 }
899
900 res = syscall(OURSYS_setresuid, -1, fuse_req_ctx(req)->uid, -1);
901 if (res == -1) {
902 int errno_save = errno;
903
904 syscall(OURSYS_setresgid, -1, old->egid, -1);
905 return errno_save;
906 }
907
908 return 0;
909 }
910
911 /* Regain Privileges */
912 static void lo_restore_cred(struct lo_cred *old)
913 {
914 int res;
915
916 res = syscall(OURSYS_setresuid, -1, old->euid, -1);
917 if (res == -1) {
918 fuse_log(FUSE_LOG_ERR, "seteuid(%u): %m\n", old->euid);
919 exit(1);
920 }
921
922 res = syscall(OURSYS_setresgid, -1, old->egid, -1);
923 if (res == -1) {
924 fuse_log(FUSE_LOG_ERR, "setegid(%u): %m\n", old->egid);
925 exit(1);
926 }
927 }
928
929 static void lo_mknod_symlink(fuse_req_t req, fuse_ino_t parent,
930 const char *name, mode_t mode, dev_t rdev,
931 const char *link)
932 {
933 int res;
934 int saverr;
935 struct lo_data *lo = lo_data(req);
936 struct lo_inode *dir;
937 struct fuse_entry_param e;
938 struct lo_cred old = {};
939
940 if (!is_safe_path_component(name)) {
941 fuse_reply_err(req, EINVAL);
942 return;
943 }
944
945 dir = lo_inode(req, parent);
946 if (!dir) {
947 fuse_reply_err(req, EBADF);
948 return;
949 }
950
951 saverr = lo_change_cred(req, &old);
952 if (saverr) {
953 goto out;
954 }
955
956 res = mknod_wrapper(dir->fd, name, link, mode, rdev);
957
958 saverr = errno;
959
960 lo_restore_cred(&old);
961
962 if (res == -1) {
963 goto out;
964 }
965
966 saverr = lo_do_lookup(req, parent, name, &e);
967 if (saverr) {
968 goto out;
969 }
970
971 fuse_log(FUSE_LOG_DEBUG, " %lli/%s -> %lli\n", (unsigned long long)parent,
972 name, (unsigned long long)e.ino);
973
974 fuse_reply_entry(req, &e);
975 lo_inode_put(lo, &dir);
976 return;
977
978 out:
979 lo_inode_put(lo, &dir);
980 fuse_reply_err(req, saverr);
981 }
982
983 static void lo_mknod(fuse_req_t req, fuse_ino_t parent, const char *name,
984 mode_t mode, dev_t rdev)
985 {
986 lo_mknod_symlink(req, parent, name, mode, rdev, NULL);
987 }
988
989 static void lo_mkdir(fuse_req_t req, fuse_ino_t parent, const char *name,
990 mode_t mode)
991 {
992 lo_mknod_symlink(req, parent, name, S_IFDIR | mode, 0, NULL);
993 }
994
995 static void lo_symlink(fuse_req_t req, const char *link, fuse_ino_t parent,
996 const char *name)
997 {
998 lo_mknod_symlink(req, parent, name, S_IFLNK, 0, link);
999 }
1000
1001 static void lo_link(fuse_req_t req, fuse_ino_t ino, fuse_ino_t parent,
1002 const char *name)
1003 {
1004 int res;
1005 struct lo_data *lo = lo_data(req);
1006 struct lo_inode *parent_inode;
1007 struct lo_inode *inode;
1008 struct fuse_entry_param e;
1009 char procname[64];
1010 int saverr;
1011
1012 if (!is_safe_path_component(name)) {
1013 fuse_reply_err(req, EINVAL);
1014 return;
1015 }
1016
1017 parent_inode = lo_inode(req, parent);
1018 inode = lo_inode(req, ino);
1019 if (!parent_inode || !inode) {
1020 errno = EBADF;
1021 goto out_err;
1022 }
1023
1024 memset(&e, 0, sizeof(struct fuse_entry_param));
1025 e.attr_timeout = lo->timeout;
1026 e.entry_timeout = lo->timeout;
1027
1028 sprintf(procname, "%i", inode->fd);
1029 res = linkat(lo->proc_self_fd, procname, parent_inode->fd, name,
1030 AT_SYMLINK_FOLLOW);
1031 if (res == -1) {
1032 goto out_err;
1033 }
1034
1035 res = fstatat(inode->fd, "", &e.attr, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
1036 if (res == -1) {
1037 goto out_err;
1038 }
1039
1040 pthread_mutex_lock(&lo->mutex);
1041 inode->nlookup++;
1042 pthread_mutex_unlock(&lo->mutex);
1043 e.ino = inode->fuse_ino;
1044
1045 fuse_log(FUSE_LOG_DEBUG, " %lli/%s -> %lli\n", (unsigned long long)parent,
1046 name, (unsigned long long)e.ino);
1047
1048 fuse_reply_entry(req, &e);
1049 lo_inode_put(lo, &parent_inode);
1050 lo_inode_put(lo, &inode);
1051 return;
1052
1053 out_err:
1054 saverr = errno;
1055 lo_inode_put(lo, &parent_inode);
1056 lo_inode_put(lo, &inode);
1057 fuse_reply_err(req, saverr);
1058 }
1059
1060 /* Increments nlookup and caller must release refcount using lo_inode_put() */
1061 static struct lo_inode *lookup_name(fuse_req_t req, fuse_ino_t parent,
1062 const char *name)
1063 {
1064 int res;
1065 struct stat attr;
1066
1067 res = fstatat(lo_fd(req, parent), name, &attr,
1068 AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
1069 if (res == -1) {
1070 return NULL;
1071 }
1072
1073 return lo_find(lo_data(req), &attr);
1074 }
1075
1076 static void lo_rmdir(fuse_req_t req, fuse_ino_t parent, const char *name)
1077 {
1078 int res;
1079 struct lo_inode *inode;
1080 struct lo_data *lo = lo_data(req);
1081
1082 if (!is_safe_path_component(name)) {
1083 fuse_reply_err(req, EINVAL);
1084 return;
1085 }
1086
1087 inode = lookup_name(req, parent, name);
1088 if (!inode) {
1089 fuse_reply_err(req, EIO);
1090 return;
1091 }
1092
1093 res = unlinkat(lo_fd(req, parent), name, AT_REMOVEDIR);
1094
1095 fuse_reply_err(req, res == -1 ? errno : 0);
1096 unref_inode_lolocked(lo, inode, 1);
1097 lo_inode_put(lo, &inode);
1098 }
1099
1100 static void lo_rename(fuse_req_t req, fuse_ino_t parent, const char *name,
1101 fuse_ino_t newparent, const char *newname,
1102 unsigned int flags)
1103 {
1104 int res;
1105 struct lo_inode *parent_inode;
1106 struct lo_inode *newparent_inode;
1107 struct lo_inode *oldinode = NULL;
1108 struct lo_inode *newinode = NULL;
1109 struct lo_data *lo = lo_data(req);
1110
1111 if (!is_safe_path_component(name) || !is_safe_path_component(newname)) {
1112 fuse_reply_err(req, EINVAL);
1113 return;
1114 }
1115
1116 parent_inode = lo_inode(req, parent);
1117 newparent_inode = lo_inode(req, newparent);
1118 if (!parent_inode || !newparent_inode) {
1119 fuse_reply_err(req, EBADF);
1120 goto out;
1121 }
1122
1123 oldinode = lookup_name(req, parent, name);
1124 newinode = lookup_name(req, newparent, newname);
1125
1126 if (!oldinode) {
1127 fuse_reply_err(req, EIO);
1128 goto out;
1129 }
1130
1131 if (flags) {
1132 #ifndef SYS_renameat2
1133 fuse_reply_err(req, EINVAL);
1134 #else
1135 res = syscall(SYS_renameat2, parent_inode->fd, name,
1136 newparent_inode->fd, newname, flags);
1137 if (res == -1 && errno == ENOSYS) {
1138 fuse_reply_err(req, EINVAL);
1139 } else {
1140 fuse_reply_err(req, res == -1 ? errno : 0);
1141 }
1142 #endif
1143 goto out;
1144 }
1145
1146 res = renameat(parent_inode->fd, name, newparent_inode->fd, newname);
1147
1148 fuse_reply_err(req, res == -1 ? errno : 0);
1149 out:
1150 unref_inode_lolocked(lo, oldinode, 1);
1151 unref_inode_lolocked(lo, newinode, 1);
1152 lo_inode_put(lo, &oldinode);
1153 lo_inode_put(lo, &newinode);
1154 lo_inode_put(lo, &parent_inode);
1155 lo_inode_put(lo, &newparent_inode);
1156 }
1157
1158 static void lo_unlink(fuse_req_t req, fuse_ino_t parent, const char *name)
1159 {
1160 int res;
1161 struct lo_inode *inode;
1162 struct lo_data *lo = lo_data(req);
1163
1164 if (!is_safe_path_component(name)) {
1165 fuse_reply_err(req, EINVAL);
1166 return;
1167 }
1168
1169 inode = lookup_name(req, parent, name);
1170 if (!inode) {
1171 fuse_reply_err(req, EIO);
1172 return;
1173 }
1174
1175 res = unlinkat(lo_fd(req, parent), name, 0);
1176
1177 fuse_reply_err(req, res == -1 ? errno : 0);
1178 unref_inode_lolocked(lo, inode, 1);
1179 lo_inode_put(lo, &inode);
1180 }
1181
1182 /* To be called with lo->mutex held */
1183 static void unref_inode(struct lo_data *lo, struct lo_inode *inode, uint64_t n)
1184 {
1185 if (!inode) {
1186 return;
1187 }
1188
1189 assert(inode->nlookup >= n);
1190 inode->nlookup -= n;
1191 if (!inode->nlookup) {
1192 lo_map_remove(&lo->ino_map, inode->fuse_ino);
1193 g_hash_table_remove(lo->inodes, &inode->key);
1194 if (g_hash_table_size(inode->posix_locks)) {
1195 fuse_log(FUSE_LOG_WARNING, "Hash table is not empty\n");
1196 }
1197 g_hash_table_destroy(inode->posix_locks);
1198 pthread_mutex_destroy(&inode->plock_mutex);
1199
1200 /* Drop our refcount from lo_do_lookup() */
1201 lo_inode_put(lo, &inode);
1202 }
1203 }
1204
1205 static void unref_inode_lolocked(struct lo_data *lo, struct lo_inode *inode,
1206 uint64_t n)
1207 {
1208 if (!inode) {
1209 return;
1210 }
1211
1212 pthread_mutex_lock(&lo->mutex);
1213 unref_inode(lo, inode, n);
1214 pthread_mutex_unlock(&lo->mutex);
1215 }
1216
1217 static void lo_forget_one(fuse_req_t req, fuse_ino_t ino, uint64_t nlookup)
1218 {
1219 struct lo_data *lo = lo_data(req);
1220 struct lo_inode *inode;
1221
1222 inode = lo_inode(req, ino);
1223 if (!inode) {
1224 return;
1225 }
1226
1227 fuse_log(FUSE_LOG_DEBUG, " forget %lli %lli -%lli\n",
1228 (unsigned long long)ino, (unsigned long long)inode->nlookup,
1229 (unsigned long long)nlookup);
1230
1231 unref_inode_lolocked(lo, inode, nlookup);
1232 lo_inode_put(lo, &inode);
1233 }
1234
1235 static void lo_forget(fuse_req_t req, fuse_ino_t ino, uint64_t nlookup)
1236 {
1237 lo_forget_one(req, ino, nlookup);
1238 fuse_reply_none(req);
1239 }
1240
1241 static void lo_forget_multi(fuse_req_t req, size_t count,
1242 struct fuse_forget_data *forgets)
1243 {
1244 int i;
1245
1246 for (i = 0; i < count; i++) {
1247 lo_forget_one(req, forgets[i].ino, forgets[i].nlookup);
1248 }
1249 fuse_reply_none(req);
1250 }
1251
1252 static void lo_readlink(fuse_req_t req, fuse_ino_t ino)
1253 {
1254 char buf[PATH_MAX + 1];
1255 int res;
1256
1257 res = readlinkat(lo_fd(req, ino), "", buf, sizeof(buf));
1258 if (res == -1) {
1259 return (void)fuse_reply_err(req, errno);
1260 }
1261
1262 if (res == sizeof(buf)) {
1263 return (void)fuse_reply_err(req, ENAMETOOLONG);
1264 }
1265
1266 buf[res] = '\0';
1267
1268 fuse_reply_readlink(req, buf);
1269 }
1270
1271 struct lo_dirp {
1272 gint refcount;
1273 DIR *dp;
1274 struct dirent *entry;
1275 off_t offset;
1276 };
1277
1278 static void lo_dirp_put(struct lo_dirp **dp)
1279 {
1280 struct lo_dirp *d = *dp;
1281
1282 if (!d) {
1283 return;
1284 }
1285 *dp = NULL;
1286
1287 if (g_atomic_int_dec_and_test(&d->refcount)) {
1288 closedir(d->dp);
1289 free(d);
1290 }
1291 }
1292
1293 /* Call lo_dirp_put() on the return value when no longer needed */
1294 static struct lo_dirp *lo_dirp(fuse_req_t req, struct fuse_file_info *fi)
1295 {
1296 struct lo_data *lo = lo_data(req);
1297 struct lo_map_elem *elem;
1298
1299 pthread_mutex_lock(&lo->mutex);
1300 elem = lo_map_get(&lo->dirp_map, fi->fh);
1301 if (elem) {
1302 g_atomic_int_inc(&elem->dirp->refcount);
1303 }
1304 pthread_mutex_unlock(&lo->mutex);
1305 if (!elem) {
1306 return NULL;
1307 }
1308
1309 return elem->dirp;
1310 }
1311
1312 static void lo_opendir(fuse_req_t req, fuse_ino_t ino,
1313 struct fuse_file_info *fi)
1314 {
1315 int error = ENOMEM;
1316 struct lo_data *lo = lo_data(req);
1317 struct lo_dirp *d;
1318 int fd;
1319 ssize_t fh;
1320
1321 d = calloc(1, sizeof(struct lo_dirp));
1322 if (d == NULL) {
1323 goto out_err;
1324 }
1325
1326 fd = openat(lo_fd(req, ino), ".", O_RDONLY);
1327 if (fd == -1) {
1328 goto out_errno;
1329 }
1330
1331 d->dp = fdopendir(fd);
1332 if (d->dp == NULL) {
1333 goto out_errno;
1334 }
1335
1336 d->offset = 0;
1337 d->entry = NULL;
1338
1339 g_atomic_int_set(&d->refcount, 1); /* paired with lo_releasedir() */
1340 pthread_mutex_lock(&lo->mutex);
1341 fh = lo_add_dirp_mapping(req, d);
1342 pthread_mutex_unlock(&lo->mutex);
1343 if (fh == -1) {
1344 goto out_err;
1345 }
1346
1347 fi->fh = fh;
1348 if (lo->cache == CACHE_ALWAYS) {
1349 fi->cache_readdir = 1;
1350 }
1351 fuse_reply_open(req, fi);
1352 return;
1353
1354 out_errno:
1355 error = errno;
1356 out_err:
1357 if (d) {
1358 if (d->dp) {
1359 closedir(d->dp);
1360 } else if (fd != -1) {
1361 close(fd);
1362 }
1363 free(d);
1364 }
1365 fuse_reply_err(req, error);
1366 }
1367
1368 static void lo_do_readdir(fuse_req_t req, fuse_ino_t ino, size_t size,
1369 off_t offset, struct fuse_file_info *fi, int plus)
1370 {
1371 struct lo_data *lo = lo_data(req);
1372 struct lo_dirp *d = NULL;
1373 struct lo_inode *dinode;
1374 char *buf = NULL;
1375 char *p;
1376 size_t rem = size;
1377 int err = EBADF;
1378
1379 dinode = lo_inode(req, ino);
1380 if (!dinode) {
1381 goto error;
1382 }
1383
1384 d = lo_dirp(req, fi);
1385 if (!d) {
1386 goto error;
1387 }
1388
1389 err = ENOMEM;
1390 buf = calloc(1, size);
1391 if (!buf) {
1392 goto error;
1393 }
1394 p = buf;
1395
1396 if (offset != d->offset) {
1397 seekdir(d->dp, offset);
1398 d->entry = NULL;
1399 d->offset = offset;
1400 }
1401 while (1) {
1402 size_t entsize;
1403 off_t nextoff;
1404 const char *name;
1405
1406 if (!d->entry) {
1407 errno = 0;
1408 d->entry = readdir(d->dp);
1409 if (!d->entry) {
1410 if (errno) { /* Error */
1411 err = errno;
1412 goto error;
1413 } else { /* End of stream */
1414 break;
1415 }
1416 }
1417 }
1418 nextoff = d->entry->d_off;
1419 name = d->entry->d_name;
1420
1421 fuse_ino_t entry_ino = 0;
1422 struct fuse_entry_param e = (struct fuse_entry_param){
1423 .attr.st_ino = d->entry->d_ino,
1424 .attr.st_mode = d->entry->d_type << 12,
1425 };
1426
1427 /* Hide root's parent directory */
1428 if (dinode == &lo->root && strcmp(name, "..") == 0) {
1429 e.attr.st_ino = lo->root.key.ino;
1430 e.attr.st_mode = DT_DIR << 12;
1431 }
1432
1433 if (plus) {
1434 if (!is_dot_or_dotdot(name)) {
1435 err = lo_do_lookup(req, ino, name, &e);
1436 if (err) {
1437 goto error;
1438 }
1439 entry_ino = e.ino;
1440 }
1441
1442 entsize = fuse_add_direntry_plus(req, p, rem, name, &e, nextoff);
1443 } else {
1444 entsize = fuse_add_direntry(req, p, rem, name, &e.attr, nextoff);
1445 }
1446 if (entsize > rem) {
1447 if (entry_ino != 0) {
1448 lo_forget_one(req, entry_ino, 1);
1449 }
1450 break;
1451 }
1452
1453 p += entsize;
1454 rem -= entsize;
1455
1456 d->entry = NULL;
1457 d->offset = nextoff;
1458 }
1459
1460 err = 0;
1461 error:
1462 lo_dirp_put(&d);
1463 lo_inode_put(lo, &dinode);
1464
1465 /*
1466 * If there's an error, we can only signal it if we haven't stored
1467 * any entries yet - otherwise we'd end up with wrong lookup
1468 * counts for the entries that are already in the buffer. So we
1469 * return what we've collected until that point.
1470 */
1471 if (err && rem == size) {
1472 fuse_reply_err(req, err);
1473 } else {
1474 fuse_reply_buf(req, buf, size - rem);
1475 }
1476 free(buf);
1477 }
1478
1479 static void lo_readdir(fuse_req_t req, fuse_ino_t ino, size_t size,
1480 off_t offset, struct fuse_file_info *fi)
1481 {
1482 lo_do_readdir(req, ino, size, offset, fi, 0);
1483 }
1484
1485 static void lo_readdirplus(fuse_req_t req, fuse_ino_t ino, size_t size,
1486 off_t offset, struct fuse_file_info *fi)
1487 {
1488 lo_do_readdir(req, ino, size, offset, fi, 1);
1489 }
1490
1491 static void lo_releasedir(fuse_req_t req, fuse_ino_t ino,
1492 struct fuse_file_info *fi)
1493 {
1494 struct lo_data *lo = lo_data(req);
1495 struct lo_map_elem *elem;
1496 struct lo_dirp *d;
1497
1498 (void)ino;
1499
1500 pthread_mutex_lock(&lo->mutex);
1501 elem = lo_map_get(&lo->dirp_map, fi->fh);
1502 if (!elem) {
1503 pthread_mutex_unlock(&lo->mutex);
1504 fuse_reply_err(req, EBADF);
1505 return;
1506 }
1507
1508 d = elem->dirp;
1509 lo_map_remove(&lo->dirp_map, fi->fh);
1510 pthread_mutex_unlock(&lo->mutex);
1511
1512 lo_dirp_put(&d); /* paired with lo_opendir() */
1513
1514 fuse_reply_err(req, 0);
1515 }
1516
1517 static void update_open_flags(int writeback, struct fuse_file_info *fi)
1518 {
1519 /*
1520 * With writeback cache, kernel may send read requests even
1521 * when userspace opened write-only
1522 */
1523 if (writeback && (fi->flags & O_ACCMODE) == O_WRONLY) {
1524 fi->flags &= ~O_ACCMODE;
1525 fi->flags |= O_RDWR;
1526 }
1527
1528 /*
1529 * With writeback cache, O_APPEND is handled by the kernel.
1530 * This breaks atomicity (since the file may change in the
1531 * underlying filesystem, so that the kernel's idea of the
1532 * end of the file isn't accurate anymore). In this example,
1533 * we just accept that. A more rigorous filesystem may want
1534 * to return an error here
1535 */
1536 if (writeback && (fi->flags & O_APPEND)) {
1537 fi->flags &= ~O_APPEND;
1538 }
1539
1540 /*
1541 * O_DIRECT in guest should not necessarily mean bypassing page
1542 * cache on host as well. If somebody needs that behavior, it
1543 * probably should be a configuration knob in daemon.
1544 */
1545 fi->flags &= ~O_DIRECT;
1546 }
1547
1548 static void lo_create(fuse_req_t req, fuse_ino_t parent, const char *name,
1549 mode_t mode, struct fuse_file_info *fi)
1550 {
1551 int fd;
1552 struct lo_data *lo = lo_data(req);
1553 struct lo_inode *parent_inode;
1554 struct fuse_entry_param e;
1555 int err;
1556 struct lo_cred old = {};
1557
1558 fuse_log(FUSE_LOG_DEBUG, "lo_create(parent=%" PRIu64 ", name=%s)\n", parent,
1559 name);
1560
1561 if (!is_safe_path_component(name)) {
1562 fuse_reply_err(req, EINVAL);
1563 return;
1564 }
1565
1566 parent_inode = lo_inode(req, parent);
1567 if (!parent_inode) {
1568 fuse_reply_err(req, EBADF);
1569 return;
1570 }
1571
1572 err = lo_change_cred(req, &old);
1573 if (err) {
1574 goto out;
1575 }
1576
1577 update_open_flags(lo->writeback, fi);
1578
1579 fd = openat(parent_inode->fd, name, (fi->flags | O_CREAT) & ~O_NOFOLLOW,
1580 mode);
1581 err = fd == -1 ? errno : 0;
1582 lo_restore_cred(&old);
1583
1584 if (!err) {
1585 ssize_t fh;
1586
1587 pthread_mutex_lock(&lo->mutex);
1588 fh = lo_add_fd_mapping(req, fd);
1589 pthread_mutex_unlock(&lo->mutex);
1590 if (fh == -1) {
1591 close(fd);
1592 err = ENOMEM;
1593 goto out;
1594 }
1595
1596 fi->fh = fh;
1597 err = lo_do_lookup(req, parent, name, &e);
1598 }
1599 if (lo->cache == CACHE_NONE) {
1600 fi->direct_io = 1;
1601 } else if (lo->cache == CACHE_ALWAYS) {
1602 fi->keep_cache = 1;
1603 }
1604
1605 out:
1606 lo_inode_put(lo, &parent_inode);
1607
1608 if (err) {
1609 fuse_reply_err(req, err);
1610 } else {
1611 fuse_reply_create(req, &e, fi);
1612 }
1613 }
1614
1615 /* Should be called with inode->plock_mutex held */
1616 static struct lo_inode_plock *lookup_create_plock_ctx(struct lo_data *lo,
1617 struct lo_inode *inode,
1618 uint64_t lock_owner,
1619 pid_t pid, int *err)
1620 {
1621 struct lo_inode_plock *plock;
1622 char procname[64];
1623 int fd;
1624
1625 plock =
1626 g_hash_table_lookup(inode->posix_locks, GUINT_TO_POINTER(lock_owner));
1627
1628 if (plock) {
1629 return plock;
1630 }
1631
1632 plock = malloc(sizeof(struct lo_inode_plock));
1633 if (!plock) {
1634 *err = ENOMEM;
1635 return NULL;
1636 }
1637
1638 /* Open another instance of file which can be used for ofd locks. */
1639 sprintf(procname, "%i", inode->fd);
1640
1641 /* TODO: What if file is not writable? */
1642 fd = openat(lo->proc_self_fd, procname, O_RDWR);
1643 if (fd == -1) {
1644 *err = errno;
1645 free(plock);
1646 return NULL;
1647 }
1648
1649 plock->lock_owner = lock_owner;
1650 plock->fd = fd;
1651 g_hash_table_insert(inode->posix_locks, GUINT_TO_POINTER(plock->lock_owner),
1652 plock);
1653 return plock;
1654 }
1655
1656 static void lo_getlk(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi,
1657 struct flock *lock)
1658 {
1659 struct lo_data *lo = lo_data(req);
1660 struct lo_inode *inode;
1661 struct lo_inode_plock *plock;
1662 int ret, saverr = 0;
1663
1664 fuse_log(FUSE_LOG_DEBUG,
1665 "lo_getlk(ino=%" PRIu64 ", flags=%d)"
1666 " owner=0x%lx, l_type=%d l_start=0x%lx"
1667 " l_len=0x%lx\n",
1668 ino, fi->flags, fi->lock_owner, lock->l_type, lock->l_start,
1669 lock->l_len);
1670
1671 inode = lo_inode(req, ino);
1672 if (!inode) {
1673 fuse_reply_err(req, EBADF);
1674 return;
1675 }
1676
1677 pthread_mutex_lock(&inode->plock_mutex);
1678 plock =
1679 lookup_create_plock_ctx(lo, inode, fi->lock_owner, lock->l_pid, &ret);
1680 if (!plock) {
1681 saverr = ret;
1682 goto out;
1683 }
1684
1685 ret = fcntl(plock->fd, F_OFD_GETLK, lock);
1686 if (ret == -1) {
1687 saverr = errno;
1688 }
1689
1690 out:
1691 pthread_mutex_unlock(&inode->plock_mutex);
1692 lo_inode_put(lo, &inode);
1693
1694 if (saverr) {
1695 fuse_reply_err(req, saverr);
1696 } else {
1697 fuse_reply_lock(req, lock);
1698 }
1699 }
1700
1701 static void lo_setlk(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi,
1702 struct flock *lock, int sleep)
1703 {
1704 struct lo_data *lo = lo_data(req);
1705 struct lo_inode *inode;
1706 struct lo_inode_plock *plock;
1707 int ret, saverr = 0;
1708
1709 fuse_log(FUSE_LOG_DEBUG,
1710 "lo_setlk(ino=%" PRIu64 ", flags=%d)"
1711 " cmd=%d pid=%d owner=0x%lx sleep=%d l_whence=%d"
1712 " l_start=0x%lx l_len=0x%lx\n",
1713 ino, fi->flags, lock->l_type, lock->l_pid, fi->lock_owner, sleep,
1714 lock->l_whence, lock->l_start, lock->l_len);
1715
1716 if (sleep) {
1717 fuse_reply_err(req, EOPNOTSUPP);
1718 return;
1719 }
1720
1721 inode = lo_inode(req, ino);
1722 if (!inode) {
1723 fuse_reply_err(req, EBADF);
1724 return;
1725 }
1726
1727 pthread_mutex_lock(&inode->plock_mutex);
1728 plock =
1729 lookup_create_plock_ctx(lo, inode, fi->lock_owner, lock->l_pid, &ret);
1730
1731 if (!plock) {
1732 saverr = ret;
1733 goto out;
1734 }
1735
1736 /* TODO: Is it alright to modify flock? */
1737 lock->l_pid = 0;
1738 ret = fcntl(plock->fd, F_OFD_SETLK, lock);
1739 if (ret == -1) {
1740 saverr = errno;
1741 }
1742
1743 out:
1744 pthread_mutex_unlock(&inode->plock_mutex);
1745 lo_inode_put(lo, &inode);
1746
1747 fuse_reply_err(req, saverr);
1748 }
1749
1750 static void lo_fsyncdir(fuse_req_t req, fuse_ino_t ino, int datasync,
1751 struct fuse_file_info *fi)
1752 {
1753 int res;
1754 struct lo_dirp *d;
1755 int fd;
1756
1757 (void)ino;
1758
1759 d = lo_dirp(req, fi);
1760 if (!d) {
1761 fuse_reply_err(req, EBADF);
1762 return;
1763 }
1764
1765 fd = dirfd(d->dp);
1766 if (datasync) {
1767 res = fdatasync(fd);
1768 } else {
1769 res = fsync(fd);
1770 }
1771
1772 lo_dirp_put(&d);
1773
1774 fuse_reply_err(req, res == -1 ? errno : 0);
1775 }
1776
1777 static void lo_open(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi)
1778 {
1779 int fd;
1780 ssize_t fh;
1781 char buf[64];
1782 struct lo_data *lo = lo_data(req);
1783
1784 fuse_log(FUSE_LOG_DEBUG, "lo_open(ino=%" PRIu64 ", flags=%d)\n", ino,
1785 fi->flags);
1786
1787 update_open_flags(lo->writeback, fi);
1788
1789 sprintf(buf, "%i", lo_fd(req, ino));
1790 fd = openat(lo->proc_self_fd, buf, fi->flags & ~O_NOFOLLOW);
1791 if (fd == -1) {
1792 return (void)fuse_reply_err(req, errno);
1793 }
1794
1795 pthread_mutex_lock(&lo->mutex);
1796 fh = lo_add_fd_mapping(req, fd);
1797 pthread_mutex_unlock(&lo->mutex);
1798 if (fh == -1) {
1799 close(fd);
1800 fuse_reply_err(req, ENOMEM);
1801 return;
1802 }
1803
1804 fi->fh = fh;
1805 if (lo->cache == CACHE_NONE) {
1806 fi->direct_io = 1;
1807 } else if (lo->cache == CACHE_ALWAYS) {
1808 fi->keep_cache = 1;
1809 }
1810 fuse_reply_open(req, fi);
1811 }
1812
1813 static void lo_release(fuse_req_t req, fuse_ino_t ino,
1814 struct fuse_file_info *fi)
1815 {
1816 struct lo_data *lo = lo_data(req);
1817 struct lo_map_elem *elem;
1818 int fd = -1;
1819
1820 (void)ino;
1821
1822 pthread_mutex_lock(&lo->mutex);
1823 elem = lo_map_get(&lo->fd_map, fi->fh);
1824 if (elem) {
1825 fd = elem->fd;
1826 elem = NULL;
1827 lo_map_remove(&lo->fd_map, fi->fh);
1828 }
1829 pthread_mutex_unlock(&lo->mutex);
1830
1831 close(fd);
1832 fuse_reply_err(req, 0);
1833 }
1834
1835 static void lo_flush(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi)
1836 {
1837 int res;
1838 (void)ino;
1839 struct lo_inode *inode;
1840
1841 inode = lo_inode(req, ino);
1842 if (!inode) {
1843 fuse_reply_err(req, EBADF);
1844 return;
1845 }
1846
1847 /* An fd is going away. Cleanup associated posix locks */
1848 pthread_mutex_lock(&inode->plock_mutex);
1849 g_hash_table_remove(inode->posix_locks, GUINT_TO_POINTER(fi->lock_owner));
1850 pthread_mutex_unlock(&inode->plock_mutex);
1851
1852 res = close(dup(lo_fi_fd(req, fi)));
1853 lo_inode_put(lo_data(req), &inode);
1854 fuse_reply_err(req, res == -1 ? errno : 0);
1855 }
1856
1857 static void lo_fsync(fuse_req_t req, fuse_ino_t ino, int datasync,
1858 struct fuse_file_info *fi)
1859 {
1860 int res;
1861 int fd;
1862 char *buf;
1863
1864 fuse_log(FUSE_LOG_DEBUG, "lo_fsync(ino=%" PRIu64 ", fi=0x%p)\n", ino,
1865 (void *)fi);
1866
1867 if (!fi) {
1868 struct lo_data *lo = lo_data(req);
1869
1870 res = asprintf(&buf, "%i", lo_fd(req, ino));
1871 if (res == -1) {
1872 return (void)fuse_reply_err(req, errno);
1873 }
1874
1875 fd = openat(lo->proc_self_fd, buf, O_RDWR);
1876 free(buf);
1877 if (fd == -1) {
1878 return (void)fuse_reply_err(req, errno);
1879 }
1880 } else {
1881 fd = lo_fi_fd(req, fi);
1882 }
1883
1884 if (datasync) {
1885 res = fdatasync(fd);
1886 } else {
1887 res = fsync(fd);
1888 }
1889 if (!fi) {
1890 close(fd);
1891 }
1892 fuse_reply_err(req, res == -1 ? errno : 0);
1893 }
1894
1895 static void lo_read(fuse_req_t req, fuse_ino_t ino, size_t size, off_t offset,
1896 struct fuse_file_info *fi)
1897 {
1898 struct fuse_bufvec buf = FUSE_BUFVEC_INIT(size);
1899
1900 fuse_log(FUSE_LOG_DEBUG,
1901 "lo_read(ino=%" PRIu64 ", size=%zd, "
1902 "off=%lu)\n",
1903 ino, size, (unsigned long)offset);
1904
1905 buf.buf[0].flags = FUSE_BUF_IS_FD | FUSE_BUF_FD_SEEK;
1906 buf.buf[0].fd = lo_fi_fd(req, fi);
1907 buf.buf[0].pos = offset;
1908
1909 fuse_reply_data(req, &buf);
1910 }
1911
1912 static void lo_write_buf(fuse_req_t req, fuse_ino_t ino,
1913 struct fuse_bufvec *in_buf, off_t off,
1914 struct fuse_file_info *fi)
1915 {
1916 (void)ino;
1917 ssize_t res;
1918 struct fuse_bufvec out_buf = FUSE_BUFVEC_INIT(fuse_buf_size(in_buf));
1919 bool cap_fsetid_dropped = false;
1920
1921 out_buf.buf[0].flags = FUSE_BUF_IS_FD | FUSE_BUF_FD_SEEK;
1922 out_buf.buf[0].fd = lo_fi_fd(req, fi);
1923 out_buf.buf[0].pos = off;
1924
1925 fuse_log(FUSE_LOG_DEBUG,
1926 "lo_write_buf(ino=%" PRIu64 ", size=%zd, off=%lu)\n", ino,
1927 out_buf.buf[0].size, (unsigned long)off);
1928
1929 /*
1930 * If kill_priv is set, drop CAP_FSETID which should lead to kernel
1931 * clearing setuid/setgid on file.
1932 */
1933 if (fi->kill_priv) {
1934 res = drop_effective_cap("FSETID", &cap_fsetid_dropped);
1935 if (res != 0) {
1936 fuse_reply_err(req, res);
1937 return;
1938 }
1939 }
1940
1941 res = fuse_buf_copy(&out_buf, in_buf);
1942 if (res < 0) {
1943 fuse_reply_err(req, -res);
1944 } else {
1945 fuse_reply_write(req, (size_t)res);
1946 }
1947
1948 if (cap_fsetid_dropped) {
1949 res = gain_effective_cap("FSETID");
1950 if (res) {
1951 fuse_log(FUSE_LOG_ERR, "Failed to gain CAP_FSETID\n");
1952 }
1953 }
1954 }
1955
1956 static void lo_statfs(fuse_req_t req, fuse_ino_t ino)
1957 {
1958 int res;
1959 struct statvfs stbuf;
1960
1961 res = fstatvfs(lo_fd(req, ino), &stbuf);
1962 if (res == -1) {
1963 fuse_reply_err(req, errno);
1964 } else {
1965 fuse_reply_statfs(req, &stbuf);
1966 }
1967 }
1968
1969 static void lo_fallocate(fuse_req_t req, fuse_ino_t ino, int mode, off_t offset,
1970 off_t length, struct fuse_file_info *fi)
1971 {
1972 int err = EOPNOTSUPP;
1973 (void)ino;
1974
1975 #ifdef CONFIG_FALLOCATE
1976 err = fallocate(lo_fi_fd(req, fi), mode, offset, length);
1977 if (err < 0) {
1978 err = errno;
1979 }
1980
1981 #elif defined(CONFIG_POSIX_FALLOCATE)
1982 if (mode) {
1983 fuse_reply_err(req, EOPNOTSUPP);
1984 return;
1985 }
1986
1987 err = posix_fallocate(lo_fi_fd(req, fi), offset, length);
1988 #endif
1989
1990 fuse_reply_err(req, err);
1991 }
1992
1993 static void lo_flock(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi,
1994 int op)
1995 {
1996 int res;
1997 (void)ino;
1998
1999 res = flock(lo_fi_fd(req, fi), op);
2000
2001 fuse_reply_err(req, res == -1 ? errno : 0);
2002 }
2003
2004 static void lo_getxattr(fuse_req_t req, fuse_ino_t ino, const char *name,
2005 size_t size)
2006 {
2007 struct lo_data *lo = lo_data(req);
2008 char *value = NULL;
2009 char procname[64];
2010 struct lo_inode *inode;
2011 ssize_t ret;
2012 int saverr;
2013 int fd = -1;
2014
2015 inode = lo_inode(req, ino);
2016 if (!inode) {
2017 fuse_reply_err(req, EBADF);
2018 return;
2019 }
2020
2021 saverr = ENOSYS;
2022 if (!lo_data(req)->xattr) {
2023 goto out;
2024 }
2025
2026 fuse_log(FUSE_LOG_DEBUG, "lo_getxattr(ino=%" PRIu64 ", name=%s size=%zd)\n",
2027 ino, name, size);
2028
2029 if (size) {
2030 value = malloc(size);
2031 if (!value) {
2032 goto out_err;
2033 }
2034 }
2035
2036 sprintf(procname, "%i", inode->fd);
2037 /*
2038 * It is not safe to open() non-regular/non-dir files in file server
2039 * unless O_PATH is used, so use that method for regular files/dir
2040 * only (as it seems giving less performance overhead).
2041 * Otherwise, call fchdir() to avoid open().
2042 */
2043 if (S_ISREG(inode->filetype) || S_ISDIR(inode->filetype)) {
2044 fd = openat(lo->proc_self_fd, procname, O_RDONLY);
2045 if (fd < 0) {
2046 goto out_err;
2047 }
2048 ret = fgetxattr(fd, name, value, size);
2049 } else {
2050 /* fchdir should not fail here */
2051 assert(fchdir(lo->proc_self_fd) == 0);
2052 ret = getxattr(procname, name, value, size);
2053 assert(fchdir(lo->root.fd) == 0);
2054 }
2055
2056 if (ret == -1) {
2057 goto out_err;
2058 }
2059 if (size) {
2060 saverr = 0;
2061 if (ret == 0) {
2062 goto out;
2063 }
2064 fuse_reply_buf(req, value, ret);
2065 } else {
2066 fuse_reply_xattr(req, ret);
2067 }
2068 out_free:
2069 free(value);
2070
2071 if (fd >= 0) {
2072 close(fd);
2073 }
2074
2075 lo_inode_put(lo, &inode);
2076 return;
2077
2078 out_err:
2079 saverr = errno;
2080 out:
2081 fuse_reply_err(req, saverr);
2082 goto out_free;
2083 }
2084
2085 static void lo_listxattr(fuse_req_t req, fuse_ino_t ino, size_t size)
2086 {
2087 struct lo_data *lo = lo_data(req);
2088 char *value = NULL;
2089 char procname[64];
2090 struct lo_inode *inode;
2091 ssize_t ret;
2092 int saverr;
2093 int fd = -1;
2094
2095 inode = lo_inode(req, ino);
2096 if (!inode) {
2097 fuse_reply_err(req, EBADF);
2098 return;
2099 }
2100
2101 saverr = ENOSYS;
2102 if (!lo_data(req)->xattr) {
2103 goto out;
2104 }
2105
2106 fuse_log(FUSE_LOG_DEBUG, "lo_listxattr(ino=%" PRIu64 ", size=%zd)\n", ino,
2107 size);
2108
2109 if (size) {
2110 value = malloc(size);
2111 if (!value) {
2112 goto out_err;
2113 }
2114 }
2115
2116 sprintf(procname, "%i", inode->fd);
2117 if (S_ISREG(inode->filetype) || S_ISDIR(inode->filetype)) {
2118 fd = openat(lo->proc_self_fd, procname, O_RDONLY);
2119 if (fd < 0) {
2120 goto out_err;
2121 }
2122 ret = flistxattr(fd, value, size);
2123 } else {
2124 /* fchdir should not fail here */
2125 assert(fchdir(lo->proc_self_fd) == 0);
2126 ret = listxattr(procname, value, size);
2127 assert(fchdir(lo->root.fd) == 0);
2128 }
2129
2130 if (ret == -1) {
2131 goto out_err;
2132 }
2133 if (size) {
2134 saverr = 0;
2135 if (ret == 0) {
2136 goto out;
2137 }
2138 fuse_reply_buf(req, value, ret);
2139 } else {
2140 fuse_reply_xattr(req, ret);
2141 }
2142 out_free:
2143 free(value);
2144
2145 if (fd >= 0) {
2146 close(fd);
2147 }
2148
2149 lo_inode_put(lo, &inode);
2150 return;
2151
2152 out_err:
2153 saverr = errno;
2154 out:
2155 fuse_reply_err(req, saverr);
2156 goto out_free;
2157 }
2158
2159 static void lo_setxattr(fuse_req_t req, fuse_ino_t ino, const char *name,
2160 const char *value, size_t size, int flags)
2161 {
2162 char procname[64];
2163 struct lo_data *lo = lo_data(req);
2164 struct lo_inode *inode;
2165 ssize_t ret;
2166 int saverr;
2167 int fd = -1;
2168
2169 inode = lo_inode(req, ino);
2170 if (!inode) {
2171 fuse_reply_err(req, EBADF);
2172 return;
2173 }
2174
2175 saverr = ENOSYS;
2176 if (!lo_data(req)->xattr) {
2177 goto out;
2178 }
2179
2180 fuse_log(FUSE_LOG_DEBUG, "lo_setxattr(ino=%" PRIu64
2181 ", name=%s value=%s size=%zd)\n", ino, name, value, size);
2182
2183 sprintf(procname, "%i", inode->fd);
2184 if (S_ISREG(inode->filetype) || S_ISDIR(inode->filetype)) {
2185 fd = openat(lo->proc_self_fd, procname, O_RDONLY);
2186 if (fd < 0) {
2187 saverr = errno;
2188 goto out;
2189 }
2190 ret = fsetxattr(fd, name, value, size, flags);
2191 } else {
2192 /* fchdir should not fail here */
2193 assert(fchdir(lo->proc_self_fd) == 0);
2194 ret = setxattr(procname, name, value, size, flags);
2195 assert(fchdir(lo->root.fd) == 0);
2196 }
2197
2198 saverr = ret == -1 ? errno : 0;
2199
2200 out:
2201 if (fd >= 0) {
2202 close(fd);
2203 }
2204
2205 lo_inode_put(lo, &inode);
2206 fuse_reply_err(req, saverr);
2207 }
2208
2209 static void lo_removexattr(fuse_req_t req, fuse_ino_t ino, const char *name)
2210 {
2211 char procname[64];
2212 struct lo_data *lo = lo_data(req);
2213 struct lo_inode *inode;
2214 ssize_t ret;
2215 int saverr;
2216 int fd = -1;
2217
2218 inode = lo_inode(req, ino);
2219 if (!inode) {
2220 fuse_reply_err(req, EBADF);
2221 return;
2222 }
2223
2224 saverr = ENOSYS;
2225 if (!lo_data(req)->xattr) {
2226 goto out;
2227 }
2228
2229 fuse_log(FUSE_LOG_DEBUG, "lo_removexattr(ino=%" PRIu64 ", name=%s)\n", ino,
2230 name);
2231
2232 sprintf(procname, "%i", inode->fd);
2233 if (S_ISREG(inode->filetype) || S_ISDIR(inode->filetype)) {
2234 fd = openat(lo->proc_self_fd, procname, O_RDONLY);
2235 if (fd < 0) {
2236 saverr = errno;
2237 goto out;
2238 }
2239 ret = fremovexattr(fd, name);
2240 } else {
2241 /* fchdir should not fail here */
2242 assert(fchdir(lo->proc_self_fd) == 0);
2243 ret = removexattr(procname, name);
2244 assert(fchdir(lo->root.fd) == 0);
2245 }
2246
2247 saverr = ret == -1 ? errno : 0;
2248
2249 out:
2250 if (fd >= 0) {
2251 close(fd);
2252 }
2253
2254 lo_inode_put(lo, &inode);
2255 fuse_reply_err(req, saverr);
2256 }
2257
2258 #ifdef HAVE_COPY_FILE_RANGE
2259 static void lo_copy_file_range(fuse_req_t req, fuse_ino_t ino_in, off_t off_in,
2260 struct fuse_file_info *fi_in, fuse_ino_t ino_out,
2261 off_t off_out, struct fuse_file_info *fi_out,
2262 size_t len, int flags)
2263 {
2264 int in_fd, out_fd;
2265 ssize_t res;
2266
2267 in_fd = lo_fi_fd(req, fi_in);
2268 out_fd = lo_fi_fd(req, fi_out);
2269
2270 fuse_log(FUSE_LOG_DEBUG,
2271 "lo_copy_file_range(ino=%" PRIu64 "/fd=%d, "
2272 "off=%lu, ino=%" PRIu64 "/fd=%d, "
2273 "off=%lu, size=%zd, flags=0x%x)\n",
2274 ino_in, in_fd, off_in, ino_out, out_fd, off_out, len, flags);
2275
2276 res = copy_file_range(in_fd, &off_in, out_fd, &off_out, len, flags);
2277 if (res < 0) {
2278 fuse_reply_err(req, errno);
2279 } else {
2280 fuse_reply_write(req, res);
2281 }
2282 }
2283 #endif
2284
2285 static void lo_lseek(fuse_req_t req, fuse_ino_t ino, off_t off, int whence,
2286 struct fuse_file_info *fi)
2287 {
2288 off_t res;
2289
2290 (void)ino;
2291 res = lseek(lo_fi_fd(req, fi), off, whence);
2292 if (res != -1) {
2293 fuse_reply_lseek(req, res);
2294 } else {
2295 fuse_reply_err(req, errno);
2296 }
2297 }
2298
2299 static void lo_destroy(void *userdata)
2300 {
2301 struct lo_data *lo = (struct lo_data *)userdata;
2302
2303 pthread_mutex_lock(&lo->mutex);
2304 while (true) {
2305 GHashTableIter iter;
2306 gpointer key, value;
2307
2308 g_hash_table_iter_init(&iter, lo->inodes);
2309 if (!g_hash_table_iter_next(&iter, &key, &value)) {
2310 break;
2311 }
2312
2313 struct lo_inode *inode = value;
2314 unref_inode(lo, inode, inode->nlookup);
2315 }
2316 pthread_mutex_unlock(&lo->mutex);
2317 }
2318
2319 static struct fuse_lowlevel_ops lo_oper = {
2320 .init = lo_init,
2321 .lookup = lo_lookup,
2322 .mkdir = lo_mkdir,
2323 .mknod = lo_mknod,
2324 .symlink = lo_symlink,
2325 .link = lo_link,
2326 .unlink = lo_unlink,
2327 .rmdir = lo_rmdir,
2328 .rename = lo_rename,
2329 .forget = lo_forget,
2330 .forget_multi = lo_forget_multi,
2331 .getattr = lo_getattr,
2332 .setattr = lo_setattr,
2333 .readlink = lo_readlink,
2334 .opendir = lo_opendir,
2335 .readdir = lo_readdir,
2336 .readdirplus = lo_readdirplus,
2337 .releasedir = lo_releasedir,
2338 .fsyncdir = lo_fsyncdir,
2339 .create = lo_create,
2340 .getlk = lo_getlk,
2341 .setlk = lo_setlk,
2342 .open = lo_open,
2343 .release = lo_release,
2344 .flush = lo_flush,
2345 .fsync = lo_fsync,
2346 .read = lo_read,
2347 .write_buf = lo_write_buf,
2348 .statfs = lo_statfs,
2349 .fallocate = lo_fallocate,
2350 .flock = lo_flock,
2351 .getxattr = lo_getxattr,
2352 .listxattr = lo_listxattr,
2353 .setxattr = lo_setxattr,
2354 .removexattr = lo_removexattr,
2355 #ifdef HAVE_COPY_FILE_RANGE
2356 .copy_file_range = lo_copy_file_range,
2357 #endif
2358 .lseek = lo_lseek,
2359 .destroy = lo_destroy,
2360 };
2361
2362 /* Print vhost-user.json backend program capabilities */
2363 static void print_capabilities(void)
2364 {
2365 printf("{\n");
2366 printf(" \"type\": \"fs\"\n");
2367 printf("}\n");
2368 }
2369
2370 /*
2371 * Drop all Linux capabilities because the wait parent process only needs to
2372 * sit in waitpid(2) and terminate.
2373 */
2374 static void setup_wait_parent_capabilities(void)
2375 {
2376 capng_setpid(syscall(SYS_gettid));
2377 capng_clear(CAPNG_SELECT_BOTH);
2378 capng_apply(CAPNG_SELECT_BOTH);
2379 }
2380
2381 /*
2382 * Move to a new mount, net, and pid namespaces to isolate this process.
2383 */
2384 static void setup_namespaces(struct lo_data *lo, struct fuse_session *se)
2385 {
2386 pid_t child;
2387 char template[] = "virtiofsd-XXXXXX";
2388 char *tmpdir;
2389
2390 /*
2391 * Create a new pid namespace for *child* processes. We'll have to
2392 * fork in order to enter the new pid namespace. A new mount namespace
2393 * is also needed so that we can remount /proc for the new pid
2394 * namespace.
2395 *
2396 * Our UNIX domain sockets have been created. Now we can move to
2397 * an empty network namespace to prevent TCP/IP and other network
2398 * activity in case this process is compromised.
2399 */
2400 if (unshare(CLONE_NEWPID | CLONE_NEWNS | CLONE_NEWNET) != 0) {
2401 fuse_log(FUSE_LOG_ERR, "unshare(CLONE_NEWPID | CLONE_NEWNS): %m\n");
2402 exit(1);
2403 }
2404
2405 child = fork();
2406 if (child < 0) {
2407 fuse_log(FUSE_LOG_ERR, "fork() failed: %m\n");
2408 exit(1);
2409 }
2410 if (child > 0) {
2411 pid_t waited;
2412 int wstatus;
2413
2414 setup_wait_parent_capabilities();
2415
2416 /* The parent waits for the child */
2417 do {
2418 waited = waitpid(child, &wstatus, 0);
2419 } while (waited < 0 && errno == EINTR && !se->exited);
2420
2421 /* We were terminated by a signal, see fuse_signals.c */
2422 if (se->exited) {
2423 exit(0);
2424 }
2425
2426 if (WIFEXITED(wstatus)) {
2427 exit(WEXITSTATUS(wstatus));
2428 }
2429
2430 exit(1);
2431 }
2432
2433 /* Send us SIGTERM when the parent thread terminates, see prctl(2) */
2434 prctl(PR_SET_PDEATHSIG, SIGTERM);
2435
2436 /*
2437 * If the mounts have shared propagation then we want to opt out so our
2438 * mount changes don't affect the parent mount namespace.
2439 */
2440 if (mount(NULL, "/", NULL, MS_REC | MS_SLAVE, NULL) < 0) {
2441 fuse_log(FUSE_LOG_ERR, "mount(/, MS_REC|MS_SLAVE): %m\n");
2442 exit(1);
2443 }
2444
2445 /* The child must remount /proc to use the new pid namespace */
2446 if (mount("proc", "/proc", "proc",
2447 MS_NODEV | MS_NOEXEC | MS_NOSUID | MS_RELATIME, NULL) < 0) {
2448 fuse_log(FUSE_LOG_ERR, "mount(/proc): %m\n");
2449 exit(1);
2450 }
2451
2452 tmpdir = mkdtemp(template);
2453 if (!tmpdir) {
2454 fuse_log(FUSE_LOG_ERR, "tmpdir(%s): %m\n", template);
2455 exit(1);
2456 }
2457
2458 if (mount("/proc/self/fd", tmpdir, NULL, MS_BIND, NULL) < 0) {
2459 fuse_log(FUSE_LOG_ERR, "mount(/proc/self/fd, %s, MS_BIND): %m\n",
2460 tmpdir);
2461 exit(1);
2462 }
2463
2464 /* Now we can get our /proc/self/fd directory file descriptor */
2465 lo->proc_self_fd = open(tmpdir, O_PATH);
2466 if (lo->proc_self_fd == -1) {
2467 fuse_log(FUSE_LOG_ERR, "open(%s, O_PATH): %m\n", tmpdir);
2468 exit(1);
2469 }
2470
2471 if (umount2(tmpdir, MNT_DETACH) < 0) {
2472 fuse_log(FUSE_LOG_ERR, "umount2(%s, MNT_DETACH): %m\n", tmpdir);
2473 exit(1);
2474 }
2475
2476 if (rmdir(tmpdir) < 0) {
2477 fuse_log(FUSE_LOG_ERR, "rmdir(%s): %m\n", tmpdir);
2478 }
2479 }
2480
2481 /*
2482 * Capture the capability state, we'll need to restore this for individual
2483 * threads later; see load_capng.
2484 */
2485 static void setup_capng(void)
2486 {
2487 /* Note this accesses /proc so has to happen before the sandbox */
2488 if (capng_get_caps_process()) {
2489 fuse_log(FUSE_LOG_ERR, "capng_get_caps_process\n");
2490 exit(1);
2491 }
2492 pthread_mutex_init(&cap.mutex, NULL);
2493 pthread_mutex_lock(&cap.mutex);
2494 cap.saved = capng_save_state();
2495 if (!cap.saved) {
2496 fuse_log(FUSE_LOG_ERR, "capng_save_state\n");
2497 exit(1);
2498 }
2499 pthread_mutex_unlock(&cap.mutex);
2500 }
2501
2502 static void cleanup_capng(void)
2503 {
2504 free(cap.saved);
2505 cap.saved = NULL;
2506 pthread_mutex_destroy(&cap.mutex);
2507 }
2508
2509
2510 /*
2511 * Make the source directory our root so symlinks cannot escape and no other
2512 * files are accessible. Assumes unshare(CLONE_NEWNS) was already called.
2513 */
2514 static void setup_mounts(const char *source)
2515 {
2516 int oldroot;
2517 int newroot;
2518
2519 if (mount(source, source, NULL, MS_BIND | MS_REC, NULL) < 0) {
2520 fuse_log(FUSE_LOG_ERR, "mount(%s, %s, MS_BIND): %m\n", source, source);
2521 exit(1);
2522 }
2523
2524 /* This magic is based on lxc's lxc_pivot_root() */
2525 oldroot = open("/", O_DIRECTORY | O_RDONLY | O_CLOEXEC);
2526 if (oldroot < 0) {
2527 fuse_log(FUSE_LOG_ERR, "open(/): %m\n");
2528 exit(1);
2529 }
2530
2531 newroot = open(source, O_DIRECTORY | O_RDONLY | O_CLOEXEC);
2532 if (newroot < 0) {
2533 fuse_log(FUSE_LOG_ERR, "open(%s): %m\n", source);
2534 exit(1);
2535 }
2536
2537 if (fchdir(newroot) < 0) {
2538 fuse_log(FUSE_LOG_ERR, "fchdir(newroot): %m\n");
2539 exit(1);
2540 }
2541
2542 if (syscall(__NR_pivot_root, ".", ".") < 0) {
2543 fuse_log(FUSE_LOG_ERR, "pivot_root(., .): %m\n");
2544 exit(1);
2545 }
2546
2547 if (fchdir(oldroot) < 0) {
2548 fuse_log(FUSE_LOG_ERR, "fchdir(oldroot): %m\n");
2549 exit(1);
2550 }
2551
2552 if (mount("", ".", "", MS_SLAVE | MS_REC, NULL) < 0) {
2553 fuse_log(FUSE_LOG_ERR, "mount(., MS_SLAVE | MS_REC): %m\n");
2554 exit(1);
2555 }
2556
2557 if (umount2(".", MNT_DETACH) < 0) {
2558 fuse_log(FUSE_LOG_ERR, "umount2(., MNT_DETACH): %m\n");
2559 exit(1);
2560 }
2561
2562 if (fchdir(newroot) < 0) {
2563 fuse_log(FUSE_LOG_ERR, "fchdir(newroot): %m\n");
2564 exit(1);
2565 }
2566
2567 close(newroot);
2568 close(oldroot);
2569 }
2570
2571 /*
2572 * Only keep whitelisted capabilities that are needed for file system operation
2573 */
2574 static void setup_capabilities(void)
2575 {
2576 pthread_mutex_lock(&cap.mutex);
2577 capng_restore_state(&cap.saved);
2578
2579 /*
2580 * Whitelist file system-related capabilities that are needed for a file
2581 * server to act like root. Drop everything else like networking and
2582 * sysadmin capabilities.
2583 *
2584 * Exclusions:
2585 * 1. CAP_LINUX_IMMUTABLE is not included because it's only used via ioctl
2586 * and we don't support that.
2587 * 2. CAP_MAC_OVERRIDE is not included because it only seems to be
2588 * used by the Smack LSM. Omit it until there is demand for it.
2589 */
2590 capng_setpid(syscall(SYS_gettid));
2591 capng_clear(CAPNG_SELECT_BOTH);
2592 capng_updatev(CAPNG_ADD, CAPNG_PERMITTED | CAPNG_EFFECTIVE,
2593 CAP_CHOWN,
2594 CAP_DAC_OVERRIDE,
2595 CAP_DAC_READ_SEARCH,
2596 CAP_FOWNER,
2597 CAP_FSETID,
2598 CAP_SETGID,
2599 CAP_SETUID,
2600 CAP_MKNOD,
2601 CAP_SETFCAP,
2602 -1);
2603
2604 capng_apply(CAPNG_SELECT_BOTH);
2605
2606 cap.saved = capng_save_state();
2607 pthread_mutex_unlock(&cap.mutex);
2608 }
2609
2610 /*
2611 * Lock down this process to prevent access to other processes or files outside
2612 * source directory. This reduces the impact of arbitrary code execution bugs.
2613 */
2614 static void setup_sandbox(struct lo_data *lo, struct fuse_session *se,
2615 bool enable_syslog)
2616 {
2617 setup_namespaces(lo, se);
2618 setup_mounts(lo->source);
2619 setup_seccomp(enable_syslog);
2620 setup_capabilities();
2621 }
2622
2623 /* Set the maximum number of open file descriptors */
2624 static void setup_nofile_rlimit(unsigned long rlimit_nofile)
2625 {
2626 struct rlimit rlim = {
2627 .rlim_cur = rlimit_nofile,
2628 .rlim_max = rlimit_nofile,
2629 };
2630
2631 if (rlimit_nofile == 0) {
2632 return; /* nothing to do */
2633 }
2634
2635 if (setrlimit(RLIMIT_NOFILE, &rlim) < 0) {
2636 /* Ignore SELinux denials */
2637 if (errno == EPERM) {
2638 return;
2639 }
2640
2641 fuse_log(FUSE_LOG_ERR, "setrlimit(RLIMIT_NOFILE): %m\n");
2642 exit(1);
2643 }
2644 }
2645
2646 static void log_func(enum fuse_log_level level, const char *fmt, va_list ap)
2647 {
2648 g_autofree char *localfmt = NULL;
2649
2650 if (current_log_level < level) {
2651 return;
2652 }
2653
2654 if (current_log_level == FUSE_LOG_DEBUG) {
2655 if (!use_syslog) {
2656 localfmt = g_strdup_printf("[%" PRId64 "] [ID: %08ld] %s",
2657 get_clock(), syscall(__NR_gettid), fmt);
2658 } else {
2659 localfmt = g_strdup_printf("[ID: %08ld] %s", syscall(__NR_gettid),
2660 fmt);
2661 }
2662 fmt = localfmt;
2663 }
2664
2665 if (use_syslog) {
2666 int priority = LOG_ERR;
2667 switch (level) {
2668 case FUSE_LOG_EMERG:
2669 priority = LOG_EMERG;
2670 break;
2671 case FUSE_LOG_ALERT:
2672 priority = LOG_ALERT;
2673 break;
2674 case FUSE_LOG_CRIT:
2675 priority = LOG_CRIT;
2676 break;
2677 case FUSE_LOG_ERR:
2678 priority = LOG_ERR;
2679 break;
2680 case FUSE_LOG_WARNING:
2681 priority = LOG_WARNING;
2682 break;
2683 case FUSE_LOG_NOTICE:
2684 priority = LOG_NOTICE;
2685 break;
2686 case FUSE_LOG_INFO:
2687 priority = LOG_INFO;
2688 break;
2689 case FUSE_LOG_DEBUG:
2690 priority = LOG_DEBUG;
2691 break;
2692 }
2693 vsyslog(priority, fmt, ap);
2694 } else {
2695 vfprintf(stderr, fmt, ap);
2696 }
2697 }
2698
2699 static void setup_root(struct lo_data *lo, struct lo_inode *root)
2700 {
2701 int fd, res;
2702 struct stat stat;
2703
2704 fd = open("/", O_PATH);
2705 if (fd == -1) {
2706 fuse_log(FUSE_LOG_ERR, "open(%s, O_PATH): %m\n", lo->source);
2707 exit(1);
2708 }
2709
2710 res = fstatat(fd, "", &stat, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
2711 if (res == -1) {
2712 fuse_log(FUSE_LOG_ERR, "fstatat(%s): %m\n", lo->source);
2713 exit(1);
2714 }
2715
2716 root->filetype = S_IFDIR;
2717 root->fd = fd;
2718 root->key.ino = stat.st_ino;
2719 root->key.dev = stat.st_dev;
2720 root->nlookup = 2;
2721 g_atomic_int_set(&root->refcount, 2);
2722 }
2723
2724 static guint lo_key_hash(gconstpointer key)
2725 {
2726 const struct lo_key *lkey = key;
2727
2728 return (guint)lkey->ino + (guint)lkey->dev;
2729 }
2730
2731 static gboolean lo_key_equal(gconstpointer a, gconstpointer b)
2732 {
2733 const struct lo_key *la = a;
2734 const struct lo_key *lb = b;
2735
2736 return la->ino == lb->ino && la->dev == lb->dev;
2737 }
2738
2739 static void fuse_lo_data_cleanup(struct lo_data *lo)
2740 {
2741 if (lo->inodes) {
2742 g_hash_table_destroy(lo->inodes);
2743 }
2744 lo_map_destroy(&lo->fd_map);
2745 lo_map_destroy(&lo->dirp_map);
2746 lo_map_destroy(&lo->ino_map);
2747
2748 if (lo->proc_self_fd >= 0) {
2749 close(lo->proc_self_fd);
2750 }
2751
2752 if (lo->root.fd >= 0) {
2753 close(lo->root.fd);
2754 }
2755
2756 free(lo->source);
2757 }
2758
2759 int main(int argc, char *argv[])
2760 {
2761 struct fuse_args args = FUSE_ARGS_INIT(argc, argv);
2762 struct fuse_session *se;
2763 struct fuse_cmdline_opts opts;
2764 struct lo_data lo = {
2765 .debug = 0,
2766 .writeback = 0,
2767 .posix_lock = 1,
2768 .proc_self_fd = -1,
2769 };
2770 struct lo_map_elem *root_elem;
2771 int ret = -1;
2772
2773 /* Don't mask creation mode, kernel already did that */
2774 umask(0);
2775
2776 pthread_mutex_init(&lo.mutex, NULL);
2777 lo.inodes = g_hash_table_new(lo_key_hash, lo_key_equal);
2778 lo.root.fd = -1;
2779 lo.root.fuse_ino = FUSE_ROOT_ID;
2780 lo.cache = CACHE_AUTO;
2781
2782 /*
2783 * Set up the ino map like this:
2784 * [0] Reserved (will not be used)
2785 * [1] Root inode
2786 */
2787 lo_map_init(&lo.ino_map);
2788 lo_map_reserve(&lo.ino_map, 0)->in_use = false;
2789 root_elem = lo_map_reserve(&lo.ino_map, lo.root.fuse_ino);
2790 root_elem->inode = &lo.root;
2791
2792 lo_map_init(&lo.dirp_map);
2793 lo_map_init(&lo.fd_map);
2794
2795 if (fuse_parse_cmdline(&args, &opts) != 0) {
2796 goto err_out1;
2797 }
2798 fuse_set_log_func(log_func);
2799 use_syslog = opts.syslog;
2800 if (use_syslog) {
2801 openlog("virtiofsd", LOG_PID, LOG_DAEMON);
2802 }
2803
2804 if (opts.show_help) {
2805 printf("usage: %s [options]\n\n", argv[0]);
2806 fuse_cmdline_help();
2807 printf(" -o source=PATH shared directory tree\n");
2808 fuse_lowlevel_help();
2809 ret = 0;
2810 goto err_out1;
2811 } else if (opts.show_version) {
2812 fuse_lowlevel_version();
2813 ret = 0;
2814 goto err_out1;
2815 } else if (opts.print_capabilities) {
2816 print_capabilities();
2817 ret = 0;
2818 goto err_out1;
2819 }
2820
2821 if (fuse_opt_parse(&args, &lo, lo_opts, NULL) == -1) {
2822 goto err_out1;
2823 }
2824
2825 /*
2826 * log_level is 0 if not configured via cmd options (0 is LOG_EMERG,
2827 * and we don't use this log level).
2828 */
2829 if (opts.log_level != 0) {
2830 current_log_level = opts.log_level;
2831 }
2832 lo.debug = opts.debug;
2833 if (lo.debug) {
2834 current_log_level = FUSE_LOG_DEBUG;
2835 }
2836 if (lo.source) {
2837 struct stat stat;
2838 int res;
2839
2840 res = lstat(lo.source, &stat);
2841 if (res == -1) {
2842 fuse_log(FUSE_LOG_ERR, "failed to stat source (\"%s\"): %m\n",
2843 lo.source);
2844 exit(1);
2845 }
2846 if (!S_ISDIR(stat.st_mode)) {
2847 fuse_log(FUSE_LOG_ERR, "source is not a directory\n");
2848 exit(1);
2849 }
2850 } else {
2851 lo.source = strdup("/");
2852 }
2853 if (!lo.timeout_set) {
2854 switch (lo.cache) {
2855 case CACHE_NONE:
2856 lo.timeout = 0.0;
2857 break;
2858
2859 case CACHE_AUTO:
2860 lo.timeout = 1.0;
2861 break;
2862
2863 case CACHE_ALWAYS:
2864 lo.timeout = 86400.0;
2865 break;
2866 }
2867 } else if (lo.timeout < 0) {
2868 fuse_log(FUSE_LOG_ERR, "timeout is negative (%lf)\n", lo.timeout);
2869 exit(1);
2870 }
2871
2872 se = fuse_session_new(&args, &lo_oper, sizeof(lo_oper), &lo);
2873 if (se == NULL) {
2874 goto err_out1;
2875 }
2876
2877 if (fuse_set_signal_handlers(se) != 0) {
2878 goto err_out2;
2879 }
2880
2881 if (fuse_session_mount(se) != 0) {
2882 goto err_out3;
2883 }
2884
2885 fuse_daemonize(opts.foreground);
2886
2887 setup_nofile_rlimit(opts.rlimit_nofile);
2888
2889 /* Must be before sandbox since it wants /proc */
2890 setup_capng();
2891
2892 setup_sandbox(&lo, se, opts.syslog);
2893
2894 setup_root(&lo, &lo.root);
2895 /* Block until ctrl+c or fusermount -u */
2896 ret = virtio_loop(se);
2897
2898 fuse_session_unmount(se);
2899 cleanup_capng();
2900 err_out3:
2901 fuse_remove_signal_handlers(se);
2902 err_out2:
2903 fuse_session_destroy(se);
2904 err_out1:
2905 fuse_opt_free_args(&args);
2906
2907 fuse_lo_data_cleanup(&lo);
2908
2909 return ret ? 1 : 0;
2910 }