scosu [Thu, 13 Jun 2019 11:59:10 +0000 (13:59 +0200)]
fuse_lowlevel: Add max_pages support (#384)
Starting with kernel version 4.20 fuse supports a new property
'max_pages' which is the maximum number of pages that can be used per
request. This can be set via an argument during initialization.
This new property allows writes to be larger than 128k.
This patch sets the property if the matching capability is set
(FUSE_MAX_PAGES). It will also set max_write to 1MiB. Filesystems have
the possibility to decrease this size by setting max_write to a smaller
size. The max_pages and bufsize fields are adjusted accordingly.
Cc: Constantine Shulyupin <const@MakeLinux.com> Signed-off-by: Markus Pargmann <scosu@quobyte.com>
Alan Somers [Fri, 24 May 2019 07:54:42 +0000 (01:54 -0600)]
Remove incorrect comment about fuse_entry_param.generation (#420)
A comment said that fuse_entry_param.generation must be non-zero.
However, I can't find anything in the kernel that requires that, and
real-world file systems don't seem to follow that advice, either.
Alan Somers [Wed, 15 May 2019 20:35:57 +0000 (14:35 -0600)]
passthrough: fix unix-domain sockets on FreeBSD (#413)
FreeBSD doesn't allow creating sockets using mknod(2). Instead, one has to use socket(2)
and bind(2). Add appropriate logic to the examples and add a test case.
This constant is not defined in the kernel, so it will be lost when
fuse_kernel.h is not synchronized. Instead, the kernel just passes a
flag value of "1", so for now we also use a literal in userspace.
Defined the (*ioctl)() commands as unsigned int (#381)
Instead of the Posix ioctl(2) command, Linux uses its own variant of ioctl()
in which the commands are requested as "unsigned long" and truncated to
32 bits by the fuse kernel module. Transmitting the commands to user space
file systems as "unsigned int" is a workaround for processing ioctl()
commands which do not fit into a signed int.
Tomohiro Kusumi [Sat, 9 Mar 2019 10:39:02 +0000 (19:39 +0900)]
Work around -Wformat-truncation=/-Wformat-overflow= warnings (#356)
sprintf(3)/snprintf(3) destination buffers need to be large enough
so that gcc doesn't warn -Wformat-truncation= or -Wformat-overflow=
when source buffer size is 1024 bytes.
--
../test/test_syscalls.c:1445:47: warning: '%s' directive output may be truncated writing 1 byte into a region of size between 0 and 1023 [-Wformat-truncation=]
#define PATH(p) (snprintf(path, sizeof path, "%s/%s", testdir, p), path)
^~~~~~~
../test/test_syscalls.c:1458:19:
res = mkdir(PATH("a"), 0755);
~~~
Sam Huffman [Fri, 8 Mar 2019 21:26:31 +0000 (13:26 -0800)]
fusermount: drop privileges for chdir()
cd to mountpoint's parent directory using unprivileged rather than
privileged access. This is to ensure that unmount works on mountpoints
where root may not have privileged access.
Forty-Bot [Mon, 25 Feb 2019 21:06:42 +0000 (16:06 -0500)]
hello_ll: Fix null pointer dereference (#363)
If hello_ll is invoked without a mountpoint, it will try to call
fuse_session_mount anyway with the NULL mountpoint (which then causes a
segfault). Print out a short help message instead (taken from
passthrough_ll.c).
Miklos Szeredi [Tue, 22 Jan 2019 20:03:00 +0000 (21:03 +0100)]
passthrough_ll: lo_create() should honor CACHE_NEVER (#345)
lo_create() did not honour CACHE_NEVER in lo_create(), which has an effect
on how I/O is performed after the open.
The value of CACHE_ALWAYS, which results in setting fi->keep_cache, only
has an effect for the state of the cache at open, and since the file was
just created the cache is always empty. Hence setting this doesn't have an
effect on lo_create(), but keep it for symmetry with lo_open().
Nikolaus Rath [Tue, 27 Nov 2018 20:58:36 +0000 (20:58 +0000)]
Fix fd/inode leak
If do_readdir() calls do_lookup(), but the latter fails, we still have
to return any entries that we already stored in the readdir buffer to
avoid leaking inodes.
do_lookup() may fail if e.g. we reach the file descriptor limit.
Niels de Vos [Mon, 18 Jun 2018 17:31:43 +0000 (19:31 +0200)]
libfuse: add copy_file_range() support
Add support for the relatively new copy_file_range() syscall. Backend
filesystems can now implement an efficient way of cloning/duplicating
data ranges within files. See 'man 2 copy_file_range' for more details.
* Update meson.build to add mount_util.c to libfuse_sources
unconditionally, it's non Linux-only
* FreeBSD, like NetBSD, doesn't have mntent.h, so don't include
that and define IGNORE_MTAB for both
* FreeBSD, like NetBSD, has no umount2() sysctl, so similarly define
it to unmount()
Kevin Vigor [Tue, 16 Oct 2018 23:23:07 +0000 (17:23 -0600)]
Avoid double unmount on normal unmount in auto_unmount mode.
If a fuse filesystem was mounted in auto_unmount mode on top of an
already mounted filesystem, we would end up doing a double-unmount
when the fuse filesystem was unmounted properly.
Make the auto_unmount code less eager: unmount only if the mounted
filesystem has proper type and is returning 'Transport endpoint not
connected'.
Miklos Szeredi [Wed, 15 Aug 2018 08:36:31 +0000 (10:36 +0200)]
passthrough_ll: initialize unused memory
For '.' and '..' entries only the file type in e.attr.st_mode and the inode
number in e.attr.st_ino are used. But it's prudent to at least initialize
the other fields of struct fuse_entry_param as well, instead of using
random values from the stack.
Miklos Szeredi [Tue, 14 Aug 2018 19:37:02 +0000 (21:37 +0200)]
passthrough_ll: allow configuring caching
Caching can be controlled with the following options:
"cache=never": disable caching
"cache=normal": enable caching but also refresh after the timeout
"cache=always": never refresh cache
The timeout can be controlled with the "timeout=SEC" option, where SEC is
the number of seconds and can be an arbitrary non-negative floating point
number.
Miklos Szeredi [Tue, 14 Aug 2018 19:37:02 +0000 (21:37 +0200)]
passthrough_ll: add *xattr() operations
The extended attribute functionality is enabled with the "xattr" option
(default) and disabled with the "no_xatt" option.
New operations added:
- getxattr
- listxattr
- setxattr
- removexattr
Caveat: none of these operations will work on a symbolic link, because it's
difficult to implement that without races that can result in incorrect
operation.
Miklos Szeredi [Tue, 14 Aug 2018 19:37:02 +0000 (21:37 +0200)]
passthrough_ll: add flock()
Conditionally enable flock() locking on underlying filesystem, based on the
flock/no_flock options. Default is "no_flock", meaning locking will be
local to the fuse filesystem and won't be propagated to the filesystem
passed through.
Vivek Goyal [Tue, 14 Aug 2018 19:37:02 +0000 (21:37 +0200)]
passthrough_ll: add source option
Right now, passthrough_ll will use "/" as source directory for passthrough.
We need more flexibility where user can specify path of directory to be
passed through. Hence add an option "source=<source-dir>".
Mattias Nissler [Fri, 31 Aug 2018 07:44:04 +0000 (09:44 +0200)]
Add unprivileged option in `mount.fuse3`
The unprivileged option allows to run the FUSE file system process
without privileges by dropping capabilities and preventing them from
being re-acquired via setuid / fscaps etc. To accomplish this,
mount.fuse sets up the `/dev/fuse` file descriptor and mount itself
and passes the file descriptor via the `/dev/fd/%u` mountpoint syntax
to the FUSE file system.
Mattias Nissler [Mon, 27 Aug 2018 13:17:57 +0000 (15:17 +0200)]
Allow passing `/dev/fuse` file descriptor from parent process
This adds support for a mode of operation in which a privileged parent
process opens `/dev/fuse` and takes care of mounting. The FUSE file
system daemon can then run as an unprivileged child that merely
processes requests on the FUSE file descriptor, which get passed using
the special `/dev/fd/%u` syntax for the mountpoint parameter.
The main benefit is that no privileged operations need to be performed
by the FUSE file system daemon itself directly or indirectly, so the
FUSE process can run with fully unprivileged and mechanisms like
securebits and no_new_privs can be used to prevent subprocesses from
re-acquiring privilege via setuid, fscaps, etc. This reduces risk in
case the FUSE file system gets exploited by malicious file system
data.
Below is an example that illustrates this. Note that I'm using shell
for presentation purposes, the expectation is that the parent process
will implement the equivalent of the `mount -i` and `capsh` commands.
```
\# example/hello can mount successfully with privilege
$ sudo sh -c "LD_LIBRARY_PATH=build/lib ./example/hello /mnt/tmp"
$ sudo cat /mnt/tmp/hello
Hello World!
$ sudo umount /mnt/tmp
\# example/hello fails to mount without privilege
$ sudo capsh --drop=all --secbits=0x2f -- -c 'LD_LIBRARY_PATH=build/lib ./example/hello -f /mnt/tmp'
fusermount3: mount failed: Operation not permitted
\# Passing FUSE file descriptor via /dev/fd/%u allows example/hello to work without privilege
$ sudo sh -c '
exec 17<>/dev/fuse
mount -i -o nodev,nosuid,noexec,fd=17,rootmode=40000,user_id=0,group_id=0 -t fuse hello /mnt/tmp
capsh --drop=all --secbits=0x2f -- -c "LD_LIBRARY_PATH=build/lib example/hello /dev/fd/17"
'
$ sudo cat /mnt/tmp/hello
Hello World!
$ sudo umount /mnt/tmp
```
Allow skipping utils build & installation (-Dutils=false) and examples
build (-Dexamples=false). By default behaviour is unchanged (both are
true: utils and examples get build).
Martin Blanchard [Mon, 20 Aug 2018 19:32:10 +0000 (20:32 +0100)]
Make meson build scripts subprojects friendly
Multiple meson build scripts improvements including:
* Bump meson requirement to 0.40.1 (0.40 already required)
* Declare a dependency object for main library
* Stop using add_global_arguments()
* Various minor style fixes
projects / qemu-gpiodev / libfuse.git / log