fuse_set_conn_flag() collects the libfuse-side connection hints that are
not negotiated with the kernel. no_interrupt was the one such hint still
set only by direct field assignment.
Define FUSE_CONN_FLAG_NO_INTERRUPT alongside FUSE_CONN_FLAG_SINGLE_ISSUER
and map it onto conn->no_interrupt in the same switch, and convert the
example init() handlers to set it through the setter.
Signed-off-by: Bernd Schubert <bernd@bsbernd.com>
Part 1 dropped cqe_processing and made the serving loop wait-only, so
the default path now issues one io_uring_submit() per inline reply
instead of coalescing a cqe batch into a single submit.
Restore the batching: the loop splits submit_and_wait so the flush
stays under ring_lock (part 1's race fix), and cqe_processing - now an
_Atomic bool set lock-free around handle_cqes() - again gates the
per-reply submit. The SQ stays serialised, so a batched reply is always
flushed before the next wait, never stranded.
Add a conn flag, io_uring_single_issuer, for a filesystem that replies
only from the per-queue uring thread: it skips ring_lock entirely and
runs the combined io_uring_submit_and_wait() loop, sound because only
that thread touches the ring. The flag reuses a reserved padding bit
(ABI unchanged; flag 0 keeps the multi-issuer path) and is mirrored
into the ring pool after op.init(), before serving starts.
A filesystem enables it with fuse_set_conn_flag(conn,
FUSE_CONN_FLAG_SINGLE_ISSUER), a new exported setter modelled on
fuse_set_feature_flag(); the io_uring_single_issuer bitfield is the
internal storage.
Signed-off-by: Bernd Schubert <bernd@bsbernd.com>
Mirror the fuse-side change commit abdd45f83c
("Make ioctl prototype conditional on FUSE_USE_VERSION. (#482)")'
for cuse too.
Crank versions to 3.19 as this is an ABI change.
Also increase the default FUSE_USE_VERSION to 30 in
include/cuse_lowlevel.h, 29 was below the libfuse3
min version.
Closes: https://github.com/libfuse/libfuse/issues/1406
Signed-off-by: Sam James <sam@gentoo.org>
Signed-off-by: Bernd Schubert <bernd@bsbernd.com>
cuse_prep_data() copied sizeof(struct cuse_lowlevel_ops) bytes from the
caller's clop using the library's struct size, so any field appended to
cuse_lowlevel_ops would make the library read past an older application's
struct. The libfuse version recorded in the session was also the
library's, not the application's, defeating the runtime ABI-fixup hook.
Add size/version-aware entry points cuse_lowlevel_{new,setup,main}_319
that thread the caller's sizeof(struct cuse_lowlevel_ops) and
libfuse_version into a clamped memcpy and fuse_session_new_versioned().
Header macros inject both at the call site, exactly as fuse_session_new()
does, so application source is unchanged. The bare FUSE_3.0 symbols
remain as compat forwarders passing the frozen 3.0 struct size and an
unknown version. No symbol versioning (FUSE_SYMVER) is required.
Signed-off-by: Bernd Schubert <bernd@bsbernd.com>
Bernd received a complaint via github that the "unmount" command in the
new fuse service API is prone to malicious symlink creation races
because the umount2 call doesn't use UMOUNT_NOFOLLOW. Therefore, if you
can trick a fuse service into asking the mount service helper to undo
the mount just after you've replaced the mount with a symlink to a
sensitive mount (e.g. /sys) then you whack a system hard.
I don't know why this unmounting functionality exists in libfuse, and
apparently Bernd doesn't like it. Since the fuse service API has not
yet been released, let's just rip out the command and pretend it never
existed.
Fixes: 5d8b9a39a1 ("mount_service: add systemd socket service mounting helper")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Amazingly, permission for the use of the "blkdev" mount option (aka
mounting with fuseblk.SUBTYPE instead of fuse.SUBTYPE) rests solely on a
getuid()==0 check in userspace. That /might/ be an indication that the
kernel also won't allow this, but as that's the criteria, let's
advertise fuseblk explicitly so that a fuse server can discover the
capability before calling fuse_service_session_mount().
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Add support for parsing FUSE_SECCTX extensions sent by the kernel
during file creation operations. This allows userspace filesystems
to receive and persist SELinux/AppArmor security labels on newly
created files.
Add example in passthrough_hp: When creating a file, iterates the fuse
req extension security contexts to find the SELinux security label and
apply it.
Signed-off-by: Kevin Chen <kchen@ddn.com>
* master:
Change use_subtype_prefix type to bool in fuse_mnt_build_source()
lib mount: fix fsfd leakage on error
lib mount: include linux/mount.h in mount_i_linux.h
lib mount: no need to fsconfig mtab options
Fix ENODEV fallback logic for block devices with fsname
Update the condition when to use synchronous init
fuse_daemonize_early: Rename is_active to is_used, add new is_active
Add a missing NULL check for x_mtab_opts in mount_fuse()
fusermount: Fix heap buffer overflow in perform_mount()
lib/mount.c: Restore "subtype#fsname" format for legacy kernel fallback
fuse: No need to call strlen
The previous condition in session_start_sync_init() if to
use synchronous init was not right yet - we actually want
sync-init by default when fuse_daemonize_earl_start is
used. But users also need to able to override (at least
we need to be able to override for our own tests).
So add an enum with the values of auto (default),
enabled and disabled.
Noticed due to a PR from Jingbo Xu <jefflexu@linux.alibaba.com>
that added the workaround to enable, which not supposed to be
needed. The logic should work on its own when fuse_daemonize_early_start
is used.
This also exports fuse_session_set_sync_init (and renames it from
fuse_session_want_sync_init()).
Signed-off-by: Bernd Schubert <bernd@bsbernd.com>
Fix various cppcheck complaints about pointers that could be const
pointers instead.
I am not sure you ought to take this patch, because this affects the
client program ABI by limiting what the library can do in the future
with the passed in struct fuse_service object.
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Update "mtab" so that non-kernel mount options (e.g. "x-fubar=XXX") are
recorded somewhere so that userspace utilities can pick that up. Note
that this likely is not the venerable /etc/mtab, which has been a
symlink to procfs for years. On a modern system, these non-kernel
options end up /run/mount/utab.
But that's not a detail that libfuse has to worry about directly; it's
really just calling mount -f(ake) to make the changes it wants. Old
hats may remember the use of mount -f to update /etc/mtab after mounting
the root filesystem.
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Signed-off-by: Bernd Schubert <bernd@bsbernd.com>
Create a mount helper program that can start a fuse server that runs as
a socket-based systemd service, and a new libfuse module to wrap all the
details of communicating between the mount helper and the containerized
fuse server.
This enables untrusted ext4 mounts via systemd service containers, which
avoids the problem of malicious filesystems compromising the integrity
of the running kernel through memory corruption.
In theory this could also be supported via inetd and clones, though the
author hasn't found one that supports AF_UNIX sockets.
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Signed-off-by: Bernd Schubert <bernd@bsbernd.com>
This makes use of the bidirectional fusermount. Added is
doc/README.mount, which explains the new bidirectional
communication with fusermount.
Signed-off-by: Bernd Schubert <bschubert@ddn.com>
One might want to print debug out in background mode, which the command
line parameter does not easily allow. Or one might want to enable and
disable at run time.
Signed-off-by: Bernd Schubert <bschubert@ddn.com>
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Add synchronous FUSE_INIT processing during mount() to
enable early daemonization with proper error reporting
to the parent process.
A new mount thread is needed that handles FUSE_INIT and
possible other requests at mount time (like getxattr for selinux).
The kernel sends FUSE_INIT during the mount() syscall. Without a thread
to process it, mount() blocks forever.
Mount thread lifetime:
Created before mount() syscall in fuse_start_sync_init_worker()
Processes requests until se->mount_finished is set (after mount() returns)
Joined after successful mount in fuse_wait_sync_init_completion()
Cancelled if mount fails (direct → fusermount3 fallback)
Key changes:
Add init_thread, init_error, mount_finished to struct fuse_session
Use FUSE_DEV_IOC_SYNC_INIT ioctl for kernel support
Fall back to async FUSE_INIT if unsupported
Auto-enabled when fuse_daemonize_active() or via
fuse_session_want_sync_init()
Allows parent to report mount/init failures instead of
exiting immediately after fork.
Note: For now synchronous FUSE_INIT is only supported for privileged
mounts.
Signed-off-by: Bernd Schubert <bschubert@ddn.com>
We actually need these in fusermount.c and for the
new mount API, which goes into its own file.
Also extend the struct with the extra safe field
used by fusermount.c
Signed-off-by: Bernd Schubert <bernd@bsbernd.com>
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Existing example/ file systems do the fuse_daemonize() after
fuse_session_mount() - i.e. after the mount point is already
established. Though, these example/ daemons do not start
extra threads and do not need network initialization either.
fuse_daemonize() also does not allow to return notification
from the forked child to the parent.
Complex fuse file system daemons often want the order of
1) fork - parent watches, child does the work
Child:
2) start extra threads and system initialization (like network
connection and RDMA memory registration) from the fork child.
3) Start the fuse session after everything else succeeded
Parent:
Report child initialization success or failure
A new API is introduced to overcome the limitations of
fuse_daemonize()
fuse_daemonize_start() - fork, but foreground process does not
terminate yet and watches the background.
fuse_daemonize_success() / fuse_daemonize_fail() - background
daemon signals to the foreground process success or failure.
fuse_daemonize_active() - helper function for the high level
interface, which needs to handle both APIs. fuse_daemonize()
is called within fuse_main(), which now needs to know if the caller
actually already used the new API itself.
The object 'struct fuse_daemonize *' is allocated dynamically
and stored a global variable in fuse_daemonize.c, because
- high level fuse_main_real_versioned() needs to know
if already daemonized
- high level daemons do not have access to struct fuse_session
- FUSE_SYNC_INIT in later commits can only be done if the new
API (or a file system internal) daemonization is used.
Signed-off-by: Bernd Schubert <bernd@bsbernd.com>
The fuse_get_feature_flag() function only reads from the conn parameter
and does not modify it. Add const qualifier for API consistency and to
allow callers to pass const pointers.
This is a public API function added in version 3.17.3. Adding const is
ABI-compatible as it only affects source-level type checking.
Fixes cppcheck warning:
- cppcheck-constParameterPointer in fuse_lowlevel.c:2670
Signed-off-by: Bernd Schubert <bernd@bsbernd.com>
Add const qualifiers to various function parameters and local variables:
- Add const to opts parameter in fuse_apply_conn_info_opts (helper.c)
- Add const to config parameter in fuse_loop_cfg_verify (fuse_loop_mt.c)
- Add const to v1_conf parameter in fuse_loop_cfg_convert (fuse_loop_mt.c)
- Add const to f parameter in fuse_mount and fuse_unmount (fuse.c)
- Add const to conflict variable in fuse_lib_getlk (fuse.c)
- Add const to payload, arg, in_buf variables in fuse_lowlevel.c
- Add const to req parameter in find_interrupted (fuse_lowlevel.c)
- Add const to in parameter in fuse_session_in2req (fuse_lowlevel.c)
- Add const to se parameter in fuse_req_check_allow_root (fuse_lowlevel.c)
- Add const to version parameter in fuse_session_new_versioned
(fuse_lowlevel.c)
- Add const to se parameter in fuse_session_fd (fuse_lowlevel.c)
Fixes cppcheck warnings:
- cppcheck-constParameterPointer (12 instances)
- cppcheck-constVariablePointer (5 instances)
Signed-off-by: Bernd Schubert <bernd@bsbernd.com>
Add const to various function parameters and local variables:
- Add const to path_element and node in fuse_reverse_inodepath
- Add const to end parameter in unlock_path
- Add const to f parameter in fuse_prepare_interrupt
- Add const to fi parameter in file_info_string
- Rename local buf to fi_str to avoid shadowing outer argument
- Add const to node in is_open
- Reduce scope and add const to node/newnode in hidden_name
- Reduce scope of err in fuse_create_context_key
- Remove redundant err=0 and !err check in fuse_lib_setattr
- Add const to st parameter in fuse_add_direntry_to_dh
- Add const to node in lookup_nodeid
- Reduce scope of res in fuse_lib_fill_dir_plus
- Add const to llfi parameter in fuse_readdir_common
- Add const to lock parameter in lock_to_flock
- Reduce scope of node in fuse_clean_cache
- Add const to f parameter in fuse_get_session
- Reduce scope of sleep_time in fuse_prune_nodes
Note: Skipped callback const warnings that would require function
pointer casts.
Note: Skipped unusedStructMember (used in FUSE_NODE_SLAB build).
Note: Skipped knownConditionTrueFalse (correct threading code).
Note: Skipped uninitStructMember (false positive).
Fixes cppcheck warnings:
- cppcheck-constParameterPointer (7 instances)
- cppcheck-constVariablePointer (5 instances)
- cppcheck-knownConditionTrueFalse
- cppcheck-shadowArgument
- cppcheck-variableScope (4 instances)
- cppcheck-unreadVariable
Signed-off-by: Bernd Schubert <bernd@bsbernd.com>
Add const to various function parameters and local variables:
- Reduce scope of err variable in fuse_write_msg_dev
- Add const to statx parameter in fuse_reply_statx
- Add const to arg and param in do_batch_forget
- Add const to arg in _do_getattr, do_tmpfile, _do_link, _do_open
- Add const to name in do_mknod
- Add const to arg in _do_flush, _do_readdir, _do_readdirplus
- Add const to arg in _do_releasedir, _do_poll
- Reduce scope of mountpoint in _do_destroy
- Add parentheses to clarify precedence in fuse_get_feature_flag
Fixes cppcheck warnings:
- cppcheck-constVariablePointer (2 instances)
- cppcheck-constParameterPointer (11 instances)
- cppcheck-variableScope (2 instances)
- cppcheck-clarifyCalculation
Signed-off-by: Bernd Schubert <bernd@bsbernd.com>
- Remove redundant assignment after abort() (unreachable code)
- Remove unreachable assignment of fuse_instance->error after abort()
- Mark signals parameters as const in internal functions
- Mark se parameter as const in fuse_remove_signal_handlers
Fixes cppcheck warnings:
- cppcheck-redundantAssignment
- cppcheck-unreachableCode
- cppcheck-constParameter
- cppcheck-constParameterPointer
Signed-off-by: Bernd Schubert <bernd@bsbernd.com>
* fuse: add FUSE_CAP_ALLOW_IDMAP support
Add FUSE_CAP_ALLOW_IDMAP capability flag to indicate that creation of
idmapped mounts is allowed. This maps to the kernel's FUSE_ALLOW_IDMAP
flag.
- Define FUSE_CAP_ALLOW_IDMAP in fuse_common.h using (1ULL << 32) to
ensure correct behavior on both 32-bit and 64-bit platforms.
- Set the capability in capable_ext when kernel reports FUSE_ALLOW_IDMAP.
- Send FUSE_ALLOW_IDMAP to kernel when userspace sets it in want_ext.
- Add the new FUSE_CAP_ALLOW_IDMAP capability to the printcap example
so it is printed when supported by the kernel.
Signed-off-by: Renzheng Wang <wangrzneu@gmail.com>
Add fuse_lowlevel_notify_prune() helper, which sends FUSE_NOTIFY_PRUNE
notification to kernel indicating that the server side's inode caches
with resources e.g. file handle could be cleaned up if the corresponding
dentry/inode caches (with dangling references) at the kernel side could
be pruned out.
This is a best-effort operation as inodes with active references are
skipped.
Signed-off-by: Jingbo Xu <jefflexu@linux.alibaba.com>
Add support for handling the FUSE_SYNCFS operation in the high-level
library.
This allows filesystems using the high-level FUSE API to implement
syncfs(2) handling.
Signed-off-by: Ari Sundholm <ari@tuxera.com>
Add support for handling the FUSE_SYNCFS operation in the low-level
library.
The FUSE_SYNCFS operation was not previously supported for FUSE
filesystems, which prevented syncfs(2) from providing its intended
integrity guarantees. This also affected sync(2), which internally
calls syncfs(2) on all active superblocks.
Historically, the kernel did not forward FUSE_SYNCFS requests to FUSE
file servers, with virtiofs being the sole exception. The operation was
enabled in the virtiofs kernel module and could not be used by other
FUSE filesystems from userspace. This restriction existed because a
userspace FUSE_SYNCFS handler could block indefinitely, causing
sync(2) to stall system-wide.
Later, the kernel gained request timeout handling for FUSE operations,
which largely eliminated this risk. However, the operation remained
limited to virtiofs.
Starting with the Linux 6.18 kernel series, the kernel forwards
FUSE_SYNCFS requests to all fuseblk file servers, lifting this
restriction.
To use this feature, the following prerequisites have to be met:
1. A Linux kernel 6.18 or newer.
2. The filesystem must run as fuseblk (i.e. be backed by a block
device).
3. A syncfs handler must be provided in the filesystem's
fuse_operations or fuse_lowlevel_ops structure.
This commit adds support for FUSE_SYNCFS in the low-level library.
Support for the high-level API is added in a subsequent commit.
Signed-off-by: Ari Sundholm <ari@tuxera.com>
With 'umount -f' or
'echo 1 > /sys/fs/fuse/connections/NNN/abort'
libfuse might not receive FUSE_DESTROY and the
daemon might not know that it needs to exit.
Example: passthrough_hp might be blocked on the underlying file system
because that has some issues. The mount point would get stuck and
the user might call "umount -f" on the fuse mount point. Kernel
would then abort the connection, but libfuse/fuse-server would
still not exit and not even know that kernel had aborted the connection,
because FUSE_DESTROY might not arrive on kernel connection abort
anymore.
The new optional teardown watchdog polls on the fuse_session fd
(/dev/fuse) and starts a timer when the connection aborted.
When the timeout expires the watchdog thread exits, which will
terminate the entire program.
Signed-off-by: Bernd Schubert <bernd@bsbernd.com>
The docs previously said that FUSE_FILL_DIR_PLUS makes "all file
attributes" valid, but also that use_ino controls whether the
st_ino field is honored. These docs conflict!
Since it doesn't make sense for getattr() and readdir() to have
different behavior for st_ino, it's best to decide that use_ino
will always take priority. This should not break any filesystems,
as use of non-zero st_ino with use_ino false already had weird
and broken behavior before this PR.
Signed-off-by: Dave Vasilevsky <dave@vasilevsky.ca>
It seems fuse_reply_open() cannot actually return -ENOENT under
recoverable conditions, so remove the corresponding paragraph
claiming otherwise.
For a discussion on this see
https://github.com/libfuse/libfuse/discussions/1262
Also add an additional note file, which explains fuse_reply errors
Signed-off-by: Zeno Endemann <zeno.endemann@mailbox.org>
fuse_log() did not have that attribute and so compilers
didn't give warnings for plain printf().
Add the attribute and fix related warnings.
Signed-off-by: Bernd Schubert <bernd@bsbernd.com>
During testing of LACT using various sanitizers issue with libfuse.so
leaking memory and reading uninitialized memory was uncovered. While
this was due to ABI misusage on the side of fuser (Rust wrapper for
libfuse.so), we now allow creating a no-op session by passing ops as
NULL.
fuser and other libfuse users is using fuse_session_new() with
NULL struct fuse_lowlevel_ops *op and op_size=0. This resulted
in a warning, but otherwise succeeded. The resulting fuse_session
is just passed to fuse_session_mount() so that libfuse could
do the actual mount. Fuse kernel request handling is not done
through libfuse but their own layer.
Edit by Bernd:
- Update the commit message
- moved using null_ops to fuse_session_new_30() as that is
actually called by the external fuse_session_new().
- forbidding NULL struct fuse_lowlevel_ops *op and 0 op_size
in fuse_session_new_versioned()
- various other NULL ptr checks in fuse_session_new() that
now result in failure.
Signed-off-by: Alik Aslanyan <inline0@pm.me>
Signed-off-by: Bernd Schubert <bernd@bsbernd.com>
fuse.h and fuse_lowlevel.h are already forward declaring struct statx,
there is no need for HAVE_STATX anymore. HAVE_STATX also bears the
risk to conflict with an application define. Alternatively it would
have been possible to change to HAVE_FUSE_STATX.
Get rid of the conditionals in the public header files and
also remove HAVE_STATX definition from the public
libfuse_config.h.
Edit by Bernd: Commit message and removal of HAVE_STATX from
public libfuse_config.h.
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Bernd Schubert <bernd@bsbernd.com>
The FUSE protocol uses struct fuse_write_out to convey the return value of
copy_file_range, which is restricted to uint32_t. But the COPY_FILE_RANGE
interface supports a 64-bit size copies.
Currently the number of bytes copied is silently truncated to 32-bit, which
is unfortunate at best.
Implement the COPY_FILE_RANGE_64 interface which is identical to the old
one, except the number of bytes copied is returned in a 64-bit value.
The library interface remains the same.
If the kernel does not support the new interface or the server is running
as a 32-bit process, limit the copy size to size to UINT_MAX - 4096.
Edit by Bernd:
Keep ioctl_64bit and add use new bit is_copy_file_range_64 to keep
flags separated from each other - easier code readability IMO.
Reported-by: Florian Weimer <fweimer@redhat.com>
Closes: https://lore.kernel.org/all/lhuh5ynl8z5.fsf@oldenburg.str.redhat.com/
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Bernd Schubert <bschubert@ddn.com>
With io-uring the req owns the payload buffer, the application
can directly access it and copy data into it.
fuse_buf_copy_one() already has a check for dstmem == srcmem
and skips data copies.
fuse_reply_data
fuse_reply_data_uring
fuse_buf_copy
fuse_buf_copy_one
Signed-off-by: Bernd Schubert <bschubert@ddn.com>
This commit adds libfuse support for FUSE_STATX requests on
linux distributions.
Currently, statx is only supported on linux. To make the interface a
ergonomic as possible (eg using native 'struct statx' vs 'struct
fuse_statx'), this implementation gates the 'struct statx' changes
by #ifdef linux.
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
This patch adds support for the FUSE INC_EPOCH notify. This new operation
simply increments the FUSE connection epoch value, allowing to invalidate
all the dentries next time they are revalidated.
Signed-off-by: Luis Henriques <luis@igalia.com>
fuse_apply_conn_info_opts() was applying to 'want_ext',
which would cause conflicts with 'want' if the application
applied its own flags to 'conn->want'.
Solution is:
- to move fuse_{set,unset,get}_feature_flag and
convert_to_conn_want_ext() to fuse_lowlevel.c and
to define them as part of the public API, although
convert_to_conn_want_ext() should not be used - it is
currently needed to be a public function due as it needs
to be defined for the tests.
Related to https://github.com/libfuse/libfuse/issues/1171 and
https://github.com/libfuse/libfuse/pull/1172.
Closes: https://github.com/libfuse/libfuse/issues/1171
Signed-off-by: Bernd Schubert <bschubert@ddn.com>
This adds the libfuse changes needed to support request timeouts.
A timeout may be set by the server in its init call. If a request is not
completed by the timeout, the connection will be aborted by the kernel.
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
This might be useful to optimize code paths. For example, with
io-uring the request buffer is valid until the request is replied
to, while without io-uring the request buffer is only valid
in current thread context.
Signed-off-by: Bernd Schubert <bschubert@ddn.com>
Bernd Schubert