Commit da315f6e authored by Linus Torvalds's avatar Linus Torvalds

Merge tag 'fuse-update-4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse

Pull fuse updates from Miklos Szeredi:
 "The most interesting part of this update is user namespace support,
  mostly done by Eric Biederman. This enables safe unprivileged fuse
  mounts within a user namespace.

  There are also a couple of fixes for bugs found by syzbot and
  miscellaneous fixes and cleanups"

* tag 'fuse-update-4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse:
  fuse: don't keep dead fuse_conn at fuse_fill_super().
  fuse: fix control dir setup and teardown
  fuse: fix congested state leak on aborted connections
  fuse: Allow fully unprivileged mounts
  fuse: Ensure posix acls are translated outside of init_user_ns
  fuse: add writeback documentation
  fuse: honor AT_STATX_FORCE_SYNC
  fuse: honor AT_STATX_DONT_SYNC
  fuse: Restrict allow_other to the superblock's namespace or a descendant
  fuse: Support fuse filesystems outside of init_user_ns
  fuse: Fail all requests with invalid uids or gids
  fuse: Remove the buggy retranslation of pids in fuse_dev_do_read
  fuse: return -ECONNABORTED on /dev/fuse read after abort
  fuse: atomic_o_trunc should truncate pagecache
parents 1c8c5a9d 543b8f86
Fuse supports the following I/O modes:
- direct-io
- cached
+ write-through
+ writeback-cache
The direct-io mode can be selected with the FOPEN_DIRECT_IO flag in the
FUSE_OPEN reply.
In direct-io mode the page cache is completely bypassed for reads and writes.
No read-ahead takes place. Shared mmap is disabled.
In cached mode reads may be satisfied from the page cache, and data may be
read-ahead by the kernel to fill the cache. The cache is always kept consistent
after any writes to the file. All mmap modes are supported.
The cached mode has two sub modes controlling how writes are handled. The
write-through mode is the default and is supported on all kernels. The
writeback-cache mode may be selected by the FUSE_WRITEBACK_CACHE flag in the
FUSE_INIT reply.
In write-through mode each write is immediately sent to userspace as one or more
WRITE requests, as well as updating any cached pages (and caching previously
uncached, but fully written pages). No READ requests are ever sent for writes,
so when an uncached page is partially written, the page is discarded.
In writeback-cache mode (enabled by the FUSE_WRITEBACK_CACHE flag) writes go to
the cache only, which means that the write(2) syscall can often complete very
fast. Dirty pages are written back implicitly (background writeback or page
reclaim on memory pressure) or explicitly (invoked by close(2), fsync(2) and
when the last ref to the file is being released on munmap(2)). This mode
assumes that all changes to the filesystem go through the FUSE kernel module
(size and atime/ctime/mtime attributes are kept up-to-date by the kernel), so
it's generally not suitable for network filesystems. If a partial page is
written, then the page needs to be first read from userspace. This means, that
even for files opened for O_WRONLY it is possible that READ requests will be
generated by the kernel.
...@@ -34,7 +34,7 @@ struct posix_acl *fuse_get_acl(struct inode *inode, int type) ...@@ -34,7 +34,7 @@ struct posix_acl *fuse_get_acl(struct inode *inode, int type)
return ERR_PTR(-ENOMEM); return ERR_PTR(-ENOMEM);
size = fuse_getxattr(inode, name, value, PAGE_SIZE); size = fuse_getxattr(inode, name, value, PAGE_SIZE);
if (size > 0) if (size > 0)
acl = posix_acl_from_xattr(&init_user_ns, value, size); acl = posix_acl_from_xattr(fc->user_ns, value, size);
else if ((size == 0) || (size == -ENODATA) || else if ((size == 0) || (size == -ENODATA) ||
(size == -EOPNOTSUPP && fc->no_getxattr)) (size == -EOPNOTSUPP && fc->no_getxattr))
acl = NULL; acl = NULL;
...@@ -81,7 +81,7 @@ int fuse_set_acl(struct inode *inode, struct posix_acl *acl, int type) ...@@ -81,7 +81,7 @@ int fuse_set_acl(struct inode *inode, struct posix_acl *acl, int type)
if (!value) if (!value)
return -ENOMEM; return -ENOMEM;
ret = posix_acl_to_xattr(&init_user_ns, acl, value, size); ret = posix_acl_to_xattr(fc->user_ns, acl, value, size);
if (ret < 0) { if (ret < 0) {
kfree(value); kfree(value);
return ret; return ret;
......
...@@ -35,7 +35,7 @@ static ssize_t fuse_conn_abort_write(struct file *file, const char __user *buf, ...@@ -35,7 +35,7 @@ static ssize_t fuse_conn_abort_write(struct file *file, const char __user *buf,
{ {
struct fuse_conn *fc = fuse_ctl_file_conn_get(file); struct fuse_conn *fc = fuse_ctl_file_conn_get(file);
if (fc) { if (fc) {
fuse_abort_conn(fc); fuse_abort_conn(fc, true);
fuse_conn_put(fc); fuse_conn_put(fc);
} }
return count; return count;
...@@ -211,10 +211,11 @@ static struct dentry *fuse_ctl_add_dentry(struct dentry *parent, ...@@ -211,10 +211,11 @@ static struct dentry *fuse_ctl_add_dentry(struct dentry *parent,
if (!dentry) if (!dentry)
return NULL; return NULL;
fc->ctl_dentry[fc->ctl_ndents++] = dentry;
inode = new_inode(fuse_control_sb); inode = new_inode(fuse_control_sb);
if (!inode) if (!inode) {
dput(dentry);
return NULL; return NULL;
}
inode->i_ino = get_next_ino(); inode->i_ino = get_next_ino();
inode->i_mode = mode; inode->i_mode = mode;
...@@ -228,6 +229,9 @@ static struct dentry *fuse_ctl_add_dentry(struct dentry *parent, ...@@ -228,6 +229,9 @@ static struct dentry *fuse_ctl_add_dentry(struct dentry *parent,
set_nlink(inode, nlink); set_nlink(inode, nlink);
inode->i_private = fc; inode->i_private = fc;
d_add(dentry, inode); d_add(dentry, inode);
fc->ctl_dentry[fc->ctl_ndents++] = dentry;
return dentry; return dentry;
} }
...@@ -284,7 +288,10 @@ void fuse_ctl_remove_conn(struct fuse_conn *fc) ...@@ -284,7 +288,10 @@ void fuse_ctl_remove_conn(struct fuse_conn *fc)
for (i = fc->ctl_ndents - 1; i >= 0; i--) { for (i = fc->ctl_ndents - 1; i >= 0; i--) {
struct dentry *dentry = fc->ctl_dentry[i]; struct dentry *dentry = fc->ctl_dentry[i];
d_inode(dentry)->i_private = NULL; d_inode(dentry)->i_private = NULL;
d_drop(dentry); if (!i) {
/* Get rid of submounts: */
d_invalidate(dentry);
}
dput(dentry); dput(dentry);
} }
drop_nlink(d_inode(fuse_control_sb->s_root)); drop_nlink(d_inode(fuse_control_sb->s_root));
......
...@@ -48,6 +48,7 @@ ...@@ -48,6 +48,7 @@
#include <linux/stat.h> #include <linux/stat.h>
#include <linux/module.h> #include <linux/module.h>
#include <linux/uio.h> #include <linux/uio.h>
#include <linux/user_namespace.h>
#include "fuse_i.h" #include "fuse_i.h"
...@@ -406,7 +407,7 @@ static void cuse_process_init_reply(struct fuse_conn *fc, struct fuse_req *req) ...@@ -406,7 +407,7 @@ static void cuse_process_init_reply(struct fuse_conn *fc, struct fuse_req *req)
err_region: err_region:
unregister_chrdev_region(devt, 1); unregister_chrdev_region(devt, 1);
err: err:
fuse_abort_conn(fc); fuse_abort_conn(fc, false);
goto out; goto out;
} }
...@@ -498,7 +499,11 @@ static int cuse_channel_open(struct inode *inode, struct file *file) ...@@ -498,7 +499,11 @@ static int cuse_channel_open(struct inode *inode, struct file *file)
if (!cc) if (!cc)
return -ENOMEM; return -ENOMEM;
fuse_conn_init(&cc->fc); /*
* Limit the cuse channel to requests that can
* be represented in file->f_cred->user_ns.
*/
fuse_conn_init(&cc->fc, file->f_cred->user_ns);
fud = fuse_dev_alloc(&cc->fc); fud = fuse_dev_alloc(&cc->fc);
if (!fud) { if (!fud) {
...@@ -581,7 +586,7 @@ static ssize_t cuse_class_abort_store(struct device *dev, ...@@ -581,7 +586,7 @@ static ssize_t cuse_class_abort_store(struct device *dev,
{ {
struct cuse_conn *cc = dev_get_drvdata(dev); struct cuse_conn *cc = dev_get_drvdata(dev);
fuse_abort_conn(&cc->fc); fuse_abort_conn(&cc->fc, false);
return count; return count;
} }
static DEVICE_ATTR(abort, 0200, NULL, cuse_class_abort_store); static DEVICE_ATTR(abort, 0200, NULL, cuse_class_abort_store);
......
...@@ -112,13 +112,6 @@ static void __fuse_put_request(struct fuse_req *req) ...@@ -112,13 +112,6 @@ static void __fuse_put_request(struct fuse_req *req)
refcount_dec(&req->count); refcount_dec(&req->count);
} }
static void fuse_req_init_context(struct fuse_conn *fc, struct fuse_req *req)
{
req->in.h.uid = from_kuid_munged(&init_user_ns, current_fsuid());
req->in.h.gid = from_kgid_munged(&init_user_ns, current_fsgid());
req->in.h.pid = pid_nr_ns(task_pid(current), fc->pid_ns);
}
void fuse_set_initialized(struct fuse_conn *fc) void fuse_set_initialized(struct fuse_conn *fc)
{ {
/* Make sure stores before this are seen on another CPU */ /* Make sure stores before this are seen on another CPU */
...@@ -163,11 +156,19 @@ static struct fuse_req *__fuse_get_req(struct fuse_conn *fc, unsigned npages, ...@@ -163,11 +156,19 @@ static struct fuse_req *__fuse_get_req(struct fuse_conn *fc, unsigned npages,
goto out; goto out;
} }
fuse_req_init_context(fc, req); req->in.h.uid = from_kuid(fc->user_ns, current_fsuid());
req->in.h.gid = from_kgid(fc->user_ns, current_fsgid());
req->in.h.pid = pid_nr_ns(task_pid(current), fc->pid_ns);
__set_bit(FR_WAITING, &req->flags); __set_bit(FR_WAITING, &req->flags);
if (for_background) if (for_background)
__set_bit(FR_BACKGROUND, &req->flags); __set_bit(FR_BACKGROUND, &req->flags);
if (unlikely(req->in.h.uid == ((uid_t)-1) ||
req->in.h.gid == ((gid_t)-1))) {
fuse_put_request(fc, req);
return ERR_PTR(-EOVERFLOW);
}
return req; return req;
out: out:
...@@ -256,7 +257,10 @@ struct fuse_req *fuse_get_req_nofail_nopages(struct fuse_conn *fc, ...@@ -256,7 +257,10 @@ struct fuse_req *fuse_get_req_nofail_nopages(struct fuse_conn *fc,
if (!req) if (!req)
req = get_reserved_req(fc, file); req = get_reserved_req(fc, file);
fuse_req_init_context(fc, req); req->in.h.uid = from_kuid_munged(fc->user_ns, current_fsuid());
req->in.h.gid = from_kgid_munged(fc->user_ns, current_fsgid());
req->in.h.pid = pid_nr_ns(task_pid(current), fc->pid_ns);
__set_bit(FR_WAITING, &req->flags); __set_bit(FR_WAITING, &req->flags);
__clear_bit(FR_BACKGROUND, &req->flags); __clear_bit(FR_BACKGROUND, &req->flags);
return req; return req;
...@@ -381,8 +385,7 @@ static void request_end(struct fuse_conn *fc, struct fuse_req *req) ...@@ -381,8 +385,7 @@ static void request_end(struct fuse_conn *fc, struct fuse_req *req)
if (!fc->blocked && waitqueue_active(&fc->blocked_waitq)) if (!fc->blocked && waitqueue_active(&fc->blocked_waitq))
wake_up(&fc->blocked_waitq); wake_up(&fc->blocked_waitq);
if (fc->num_background == fc->congestion_threshold && if (fc->num_background == fc->congestion_threshold && fc->sb) {
fc->connected && fc->sb) {
clear_bdi_congested(fc->sb->s_bdi, BLK_RW_SYNC); clear_bdi_congested(fc->sb->s_bdi, BLK_RW_SYNC);
clear_bdi_congested(fc->sb->s_bdi, BLK_RW_ASYNC); clear_bdi_congested(fc->sb->s_bdi, BLK_RW_ASYNC);
} }
...@@ -1234,9 +1237,10 @@ static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file, ...@@ -1234,9 +1237,10 @@ static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file,
if (err) if (err)
goto err_unlock; goto err_unlock;
err = -ENODEV; if (!fiq->connected) {
if (!fiq->connected) err = (fc->aborted && fc->abort_err) ? -ECONNABORTED : -ENODEV;
goto err_unlock; goto err_unlock;
}
if (!list_empty(&fiq->interrupts)) { if (!list_empty(&fiq->interrupts)) {
req = list_entry(fiq->interrupts.next, struct fuse_req, req = list_entry(fiq->interrupts.next, struct fuse_req,
...@@ -1260,12 +1264,6 @@ static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file, ...@@ -1260,12 +1264,6 @@ static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file,
in = &req->in; in = &req->in;
reqsize = in->h.len; reqsize = in->h.len;
if (task_active_pid_ns(current) != fc->pid_ns) {
rcu_read_lock();
in->h.pid = pid_vnr(find_pid_ns(in->h.pid, fc->pid_ns));
rcu_read_unlock();
}
/* If request is too large, reply with an error and restart the read */ /* If request is too large, reply with an error and restart the read */
if (nbytes < reqsize) { if (nbytes < reqsize) {
req->out.h.error = -EIO; req->out.h.error = -EIO;
...@@ -1287,7 +1285,7 @@ static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file, ...@@ -1287,7 +1285,7 @@ static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file,
spin_lock(&fpq->lock); spin_lock(&fpq->lock);
clear_bit(FR_LOCKED, &req->flags); clear_bit(FR_LOCKED, &req->flags);
if (!fpq->connected) { if (!fpq->connected) {
err = -ENODEV; err = (fc->aborted && fc->abort_err) ? -ECONNABORTED : -ENODEV;
goto out_end; goto out_end;
} }
if (err) { if (err) {
...@@ -2076,7 +2074,7 @@ static void end_polls(struct fuse_conn *fc) ...@@ -2076,7 +2074,7 @@ static void end_polls(struct fuse_conn *fc)
* is OK, the request will in that case be removed from the list before we touch * is OK, the request will in that case be removed from the list before we touch
* it. * it.
*/ */
void fuse_abort_conn(struct fuse_conn *fc) void fuse_abort_conn(struct fuse_conn *fc, bool is_abort)
{ {
struct fuse_iqueue *fiq = &fc->iq; struct fuse_iqueue *fiq = &fc->iq;
...@@ -2089,6 +2087,7 @@ void fuse_abort_conn(struct fuse_conn *fc) ...@@ -2089,6 +2087,7 @@ void fuse_abort_conn(struct fuse_conn *fc)
fc->connected = 0; fc->connected = 0;
fc->blocked = 0; fc->blocked = 0;
fc->aborted = is_abort;
fuse_set_initialized(fc); fuse_set_initialized(fc);
list_for_each_entry(fud, &fc->devices, entry) { list_for_each_entry(fud, &fc->devices, entry) {
struct fuse_pqueue *fpq = &fud->pq; struct fuse_pqueue *fpq = &fud->pq;
...@@ -2151,7 +2150,7 @@ int fuse_dev_release(struct inode *inode, struct file *file) ...@@ -2151,7 +2150,7 @@ int fuse_dev_release(struct inode *inode, struct file *file)
/* Are we the last open device? */ /* Are we the last open device? */
if (atomic_dec_and_test(&fc->dev_count)) { if (atomic_dec_and_test(&fc->dev_count)) {
WARN_ON(fc->iq.fasync != NULL); WARN_ON(fc->iq.fasync != NULL);
fuse_abort_conn(fc); fuse_abort_conn(fc, false);
} }
fuse_dev_free(fud); fuse_dev_free(fud);
} }
......
...@@ -858,8 +858,8 @@ static void fuse_fillattr(struct inode *inode, struct fuse_attr *attr, ...@@ -858,8 +858,8 @@ static void fuse_fillattr(struct inode *inode, struct fuse_attr *attr,
stat->ino = attr->ino; stat->ino = attr->ino;
stat->mode = (inode->i_mode & S_IFMT) | (attr->mode & 07777); stat->mode = (inode->i_mode & S_IFMT) | (attr->mode & 07777);
stat->nlink = attr->nlink; stat->nlink = attr->nlink;
stat->uid = make_kuid(&init_user_ns, attr->uid); stat->uid = make_kuid(fc->user_ns, attr->uid);
stat->gid = make_kgid(&init_user_ns, attr->gid); stat->gid = make_kgid(fc->user_ns, attr->gid);
stat->rdev = inode->i_rdev; stat->rdev = inode->i_rdev;
stat->atime.tv_sec = attr->atime; stat->atime.tv_sec = attr->atime;
stat->atime.tv_nsec = attr->atimensec; stat->atime.tv_nsec = attr->atimensec;
...@@ -924,12 +924,20 @@ static int fuse_do_getattr(struct inode *inode, struct kstat *stat, ...@@ -924,12 +924,20 @@ static int fuse_do_getattr(struct inode *inode, struct kstat *stat,
} }
static int fuse_update_get_attr(struct inode *inode, struct file *file, static int fuse_update_get_attr(struct inode *inode, struct file *file,
struct kstat *stat) struct kstat *stat, unsigned int flags)
{ {
struct fuse_inode *fi = get_fuse_inode(inode); struct fuse_inode *fi = get_fuse_inode(inode);
int err = 0; int err = 0;
bool sync;
if (time_before64(fi->i_time, get_jiffies_64())) { if (flags & AT_STATX_FORCE_SYNC)
sync = true;
else if (flags & AT_STATX_DONT_SYNC)
sync = false;
else
sync = time_before64(fi->i_time, get_jiffies_64());
if (sync) {
forget_all_cached_acls(inode); forget_all_cached_acls(inode);
err = fuse_do_getattr(inode, stat, file); err = fuse_do_getattr(inode, stat, file);
} else if (stat) { } else if (stat) {
...@@ -943,7 +951,7 @@ static int fuse_update_get_attr(struct inode *inode, struct file *file, ...@@ -943,7 +951,7 @@ static int fuse_update_get_attr(struct inode *inode, struct file *file,
int fuse_update_attributes(struct inode *inode, struct file *file) int fuse_update_attributes(struct inode *inode, struct file *file)
{ {
return fuse_update_get_attr(inode, file, NULL); return fuse_update_get_attr(inode, file, NULL, 0);
} }
int fuse_reverse_inval_entry(struct super_block *sb, u64 parent_nodeid, int fuse_reverse_inval_entry(struct super_block *sb, u64 parent_nodeid,
...@@ -1030,7 +1038,7 @@ int fuse_allow_current_process(struct fuse_conn *fc) ...@@ -1030,7 +1038,7 @@ int fuse_allow_current_process(struct fuse_conn *fc)
const struct cred *cred; const struct cred *cred;
if (fc->allow_other) if (fc->allow_other)
return 1; return current_in_userns(fc->user_ns);
cred = current_cred(); cred = current_cred();
if (uid_eq(cred->euid, fc->user_id) && if (uid_eq(cred->euid, fc->user_id) &&
...@@ -1475,17 +1483,17 @@ static bool update_mtime(unsigned ivalid, bool trust_local_mtime) ...@@ -1475,17 +1483,17 @@ static bool update_mtime(unsigned ivalid, bool trust_local_mtime)
return true; return true;
} }
static void iattr_to_fattr(struct iattr *iattr, struct fuse_setattr_in *arg, static void iattr_to_fattr(struct fuse_conn *fc, struct iattr *iattr,
bool trust_local_cmtime) struct fuse_setattr_in *arg, bool trust_local_cmtime)
{ {
unsigned ivalid = iattr->ia_valid; unsigned ivalid = iattr->ia_valid;
if (ivalid & ATTR_MODE) if (ivalid & ATTR_MODE)
arg->valid |= FATTR_MODE, arg->mode = iattr->ia_mode; arg->valid |= FATTR_MODE, arg->mode = iattr->ia_mode;
if (ivalid & ATTR_UID) if (ivalid & ATTR_UID)
arg->valid |= FATTR_UID, arg->uid = from_kuid(&init_user_ns, iattr->ia_uid); arg->valid |= FATTR_UID, arg->uid = from_kuid(fc->user_ns, iattr->ia_uid);
if (ivalid & ATTR_GID) if (ivalid & ATTR_GID)
arg->valid |= FATTR_GID, arg->gid = from_kgid(&init_user_ns, iattr->ia_gid); arg->valid |= FATTR_GID, arg->gid = from_kgid(fc->user_ns, iattr->ia_gid);
if (ivalid & ATTR_SIZE) if (ivalid & ATTR_SIZE)
arg->valid |= FATTR_SIZE, arg->size = iattr->ia_size; arg->valid |= FATTR_SIZE, arg->size = iattr->ia_size;
if (ivalid & ATTR_ATIME) { if (ivalid & ATTR_ATIME) {
...@@ -1629,8 +1637,19 @@ int fuse_do_setattr(struct dentry *dentry, struct iattr *attr, ...@@ -1629,8 +1637,19 @@ int fuse_do_setattr(struct dentry *dentry, struct iattr *attr,
return err; return err;
if (attr->ia_valid & ATTR_OPEN) { if (attr->ia_valid & ATTR_OPEN) {
if (fc->atomic_o_trunc) /* This is coming from open(..., ... | O_TRUNC); */
WARN_ON(!(attr->ia_valid & ATTR_SIZE));
WARN_ON(attr->ia_size != 0);
if (fc->atomic_o_trunc) {
/*
* No need to send request to userspace, since actual
* truncation has already been done by OPEN. But still
* need to truncate page cache.
*/
i_size_write(inode, 0);
truncate_pagecache(inode, 0);
return 0; return 0;
}
file = NULL; file = NULL;
} }
...@@ -1646,7 +1665,7 @@ int fuse_do_setattr(struct dentry *dentry, struct iattr *attr, ...@@ -1646,7 +1665,7 @@ int fuse_do_setattr(struct dentry *dentry, struct iattr *attr,
memset(&inarg, 0, sizeof(inarg)); memset(&inarg, 0, sizeof(inarg));
memset(&outarg, 0, sizeof(outarg)); memset(&outarg, 0, sizeof(outarg));
iattr_to_fattr(attr, &inarg, trust_local_cmtime); iattr_to_fattr(fc, attr, &inarg, trust_local_cmtime);
if (file) { if (file) {
struct fuse_file *ff = file->private_data; struct fuse_file *ff = file->private_data;
inarg.valid |= FATTR_FH; inarg.valid |= FATTR_FH;
...@@ -1783,7 +1802,7 @@ static int fuse_getattr(const struct path *path, struct kstat *stat, ...@@ -1783,7 +1802,7 @@ static int fuse_getattr(const struct path *path, struct kstat *stat,
if (!fuse_allow_current_process(fc)) if (!fuse_allow_current_process(fc))
return -EACCES; return -EACCES;
return fuse_update_get_attr(inode, NULL, stat); return fuse_update_get_attr(inode, NULL, stat, flags);
} }
static const struct inode_operations fuse_dir_inode_operations = { static const struct inode_operations fuse_dir_inode_operations = {
......
...@@ -26,6 +26,7 @@ ...@@ -26,6 +26,7 @@
#include <linux/xattr.h> #include <linux/xattr.h>
#include <linux/pid_namespace.h> #include <linux/pid_namespace.h>
#include <linux/refcount.h> #include <linux/refcount.h>
#include <linux/user_namespace.h>
/** Max number of pages that can be used in a single read request */ /** Max number of pages that can be used in a single read request */
#define FUSE_MAX_PAGES_PER_REQ 32 #define FUSE_MAX_PAGES_PER_REQ 32
...@@ -466,6 +467,9 @@ struct fuse_conn { ...@@ -466,6 +467,9 @@ struct fuse_conn {
/** The pid namespace for this mount */ /** The pid namespace for this mount */
struct pid_namespace *pid_ns; struct pid_namespace *pid_ns;
/** The user namespace for this mount */
struct user_namespace *user_ns;
/** Maximum read size */ /** Maximum read size */
unsigned max_read; unsigned max_read;
...@@ -515,6 +519,9 @@ struct fuse_conn { ...@@ -515,6 +519,9 @@ struct fuse_conn {
abort and device release */ abort and device release */
unsigned connected; unsigned connected;
/** Connection aborted via sysfs */
bool aborted;
/** Connection failed (version mismatch). Cannot race with /** Connection failed (version mismatch). Cannot race with
setting other bitfields since it is only set once in INIT setting other bitfields since it is only set once in INIT
reply, before any other request, and never cleared */ reply, before any other request, and never cleared */
...@@ -526,6 +533,9 @@ struct fuse_conn { ...@@ -526,6 +533,9 @@ struct fuse_conn {
/** Do readpages asynchronously? Only set in INIT */ /** Do readpages asynchronously? Only set in INIT */
unsigned async_read:1; unsigned async_read:1;
/** Return an unique read error after abort. Only set in INIT */
unsigned abort_err:1;
/** Do not send separate SETATTR request before open(O_TRUNC) */ /** Do not send separate SETATTR request before open(O_TRUNC) */
unsigned atomic_o_trunc:1; unsigned atomic_o_trunc:1;
...@@ -851,7 +861,7 @@ void fuse_request_send_background_locked(struct fuse_conn *fc, ...@@ -851,7 +861,7 @@ void fuse_request_send_background_locked(struct fuse_conn *fc,
struct fuse_req *req); struct fuse_req *req);
/* Abort all requests */ /* Abort all requests */
void fuse_abort_conn(struct fuse_conn *fc); void fuse_abort_conn(struct fuse_conn *fc, bool is_abort);
/** /**
* Invalidate inode attributes * Invalidate inode attributes
...@@ -870,7 +880,7 @@ struct fuse_conn *fuse_conn_get(struct fuse_conn *fc); ...@@ -870,7 +880,7 @@ struct fuse_conn *fuse_conn_get(struct fuse_conn *fc);
/** /**
* Initialize fuse_conn * Initialize fuse_conn
*/ */
void fuse_conn_init(struct fuse_conn *fc); void fuse_conn_init(struct fuse_conn *fc, struct user_namespace *user_ns);
/** /**
* Release reference to fuse_conn * Release reference to fuse_conn
...@@ -975,6 +985,7 @@ ssize_t fuse_listxattr(struct dentry *entry, char *list, size_t size); ...@@ -975,6 +985,7 @@ ssize_t fuse_listxattr(struct dentry *entry, char *list, size_t size);
int fuse_removexattr(struct inode *inode, const char *name); int fuse_removexattr(struct inode *inode, const char *name);
extern const struct xattr_handler *fuse_xattr_handlers[]; extern const struct xattr_handler *fuse_xattr_handlers[];
extern const struct xattr_handler *fuse_acl_xattr_handlers[]; extern const struct xattr_handler *fuse_acl_xattr_handlers[];
extern const struct xattr_handler *fuse_no_acl_xattr_handlers[];
struct posix_acl; struct posix_acl;
struct posix_acl *fuse_get_acl(struct inode *inode, int type); struct posix_acl *fuse_get_acl(struct inode *inode, int type);
......
...@@ -171,8 +171,8 @@ void fuse_change_attributes_common(struct inode *inode, struct fuse_attr *attr, ...@@ -171,8 +171,8 @@ void fuse_change_attributes_common(struct inode *inode, struct fuse_attr *attr,
inode->i_ino = fuse_squash_ino(attr->ino); inode->i_ino = fuse_squash_ino(attr->ino);
inode->i_mode = (inode->i_mode & S_IFMT) | (attr->mode & 07777); inode->i_mode = (inode->i_mode & S_IFMT) | (attr->mode & 07777);
set_nlink(inode, attr->nlink); set_nlink(inode, attr->nlink);
inode->i_uid = make_kuid(&init_user_ns, attr->uid); inode->i_uid = make_kuid(fc->user_ns, attr->uid);
inode->i_gid = make_kgid(&init_user_ns, attr->gid); inode->i_gid = make_kgid(fc->user_ns, attr->gid);
inode->i_blocks = attr->blocks; inode->i_blocks = attr->blocks;
inode->i_atime.tv_sec = attr->atime; inode->i_atime.tv_sec = attr->atime;
inode->i_atime.tv_nsec = attr->atimensec; inode->i_atime.tv_nsec = attr->atimensec;
...@@ -371,7 +371,7 @@ void fuse_unlock_inode(struct inode *inode) ...@@ -371,7 +371,7 @@ void fuse_unlock_inode(struct inode *inode)
static void fuse_umount_begin(struct super_block *sb) static void fuse_umount_begin(struct super_block *sb)
{ {
fuse_abort_conn(get_fuse_conn_super(sb)); fuse_abort_conn(get_fuse_conn_super(sb), false);
} }
static void fuse_send_destroy(struct fuse_conn *fc) static void fuse_send_destroy(struct fuse_conn *fc)
...@@ -393,7 +393,7 @@ static void fuse_put_super(struct super_block *sb) ...@@ -393,7 +393,7 @@ static void fuse_put_super(struct super_block *sb)
fuse_send_destroy(fc); fuse_send_destroy(fc);
fuse_abort_conn(fc); fuse_abort_conn(fc, false);
mutex_lock(&fuse_mutex); mutex_lock(&fuse_mutex);
list_del(&fc->entry); list_del(&fc->entry);
fuse_ctl_remove_conn(fc); fuse_ctl_remove_conn(fc);
...@@ -477,7 +477,8 @@ static int fuse_match_uint(substring_t *s, unsigned int *res) ...@@ -477,7 +477,8 @@ static int fuse_match_uint(substring_t *s, unsigned int *res)
return err; return err;
} }
static int parse_fuse_opt(char *opt, struct fuse_mount_data *d, int is_bdev) static int parse_fuse_opt(char *opt, struct fuse_mount_data *d, int is_bdev,
struct user_namespace *user_ns)
{ {
char *p; char *p;
memset(d, 0, sizeof(struct fuse_mount_data)); memset(d, 0, sizeof(struct fuse_mount_data));
...@@ -513,7 +514,7 @@ static int parse_fuse_opt(char *opt, struct fuse_mount_data *d, int is_bdev) ...@@ -513,7 +514,7 @@ static int parse_fuse_opt(char *opt, struct fuse_mount_data *d, int is_bdev)
case OPT_USER_ID: case OPT_USER_ID:
if (fuse_match_uint(&args[0], &uv)) if (fuse_match_uint(&args[0], &uv))
return 0; return 0;
d->user_id = make_kuid(current_user_ns(), uv); d->user_id = make_kuid(user_ns, uv);
if (!uid_valid(d->user_id)) if (!uid_valid(d->user_id))
return 0; return 0;
d->user_id_present = 1; d->user_id_present = 1;
...@@ -522,7 +523,7 @@ static int parse_fuse_opt(char *opt, struct fuse_mount_data *d, int is_bdev) ...@@ -522,7 +523,7 @@ static int parse_fuse_opt(char *opt, struct fuse_mount_data *d, int is_bdev)
case OPT_GROUP_ID: case OPT_GROUP_ID:
if (fuse_match_uint(&args[0], &uv)) if (fuse_match_uint(&args[0], &uv))
return 0; return 0;
d->group_id = make_kgid(current_user_ns(), uv); d->group_id = make_kgid(user_ns, uv);
if (!gid_valid(d->group_id)) if (!gid_valid(d->group_id))
return 0; return 0;
d->group_id_present = 1; d->group_id_present = 1;
...@@ -565,8 +566,8 @@ static int fuse_show_options(struct seq_file *m, struct dentry *root) ...@@ -565,8 +566,8 @@ static int fuse_show_options(struct seq_file *m, struct dentry *root)
struct super_block *sb = root->d_sb; struct super_block *sb = root->d_sb;
struct fuse_conn *fc = get_fuse_conn_super(sb); struct fuse_conn *fc = get_fuse_conn_super(sb);
seq_printf(m, ",user_id=%u", from_kuid_munged(&init_user_ns, fc->user_id)); seq_printf(m, ",user_id=%u", from_kuid_munged(fc->user_ns, fc->user_id));
seq_printf(m, ",group_id=%u", from_kgid_munged(&init_user_ns, fc->group_id)); seq_printf(m, ",group_id=%u", from_kgid_munged(fc->user_ns, fc->group_id));
if (fc->default_permissions) if (fc->default_permissions)
seq_puts(m, ",default_permissions"); seq_puts(m, ",default_permissions");
if (fc->allow_other) if (fc->allow_other)
...@@ -597,7 +598,7 @@ static void fuse_pqueue_init(struct fuse_pqueue *fpq) ...@@ -597,7 +598,7 @@ static void fuse_pqueue_init(struct fuse_pqueue *fpq)
fpq->connected = 1; fpq->connected = 1;
} }
void fuse_conn_init(struct fuse_conn *fc) void fuse_conn_init(struct fuse_conn *fc, struct user_namespace *user_ns)
{ {
memset(fc, 0, sizeof(*fc)); memset(fc, 0, sizeof(*fc));
spin_lock_init(&fc->lock); spin_lock_init(&fc->lock);
...@@ -621,6 +622,7 @@ void fuse_conn_init(struct fuse_conn *fc) ...@@ -621,6 +622,7 @@ void fuse_conn_init(struct fuse_conn *fc)
fc->attr_version = 1; fc->attr_version = 1;
get_random_bytes(&fc->scramble_key, sizeof(fc->scramble_key)); get_random_bytes(&fc->scramble_key, sizeof(fc->scramble_key));
fc->pid_ns = get_pid_ns(task_active_pid_ns(current)); fc->pid_ns = get_pid_ns(task_active_pid_ns(current));
fc->user_ns = get_user_ns(user_ns);
} }
EXPORT_SYMBOL_GPL(fuse_conn_init); EXPORT_SYMBOL_GPL(fuse_conn_init);
...@@ -630,6 +632,7 @@ void fuse_conn_put(struct fuse_conn *fc) ...@@ -630,6 +632,7 @@ void fuse_conn_put(struct fuse_conn *fc)
if (fc->destroy_req) if (fc->destroy_req)
fuse_request_free(fc->destroy_req); fuse_request_free(fc->destroy_req);
put_pid_ns(fc->pid_ns); put_pid_ns(fc->pid_ns);
put_user_ns(fc->user_ns);
fc->release(fc); fc->release(fc);
} }
} }
...@@ -918,6 +921,8 @@ static void process_init_reply(struct fuse_conn *fc, struct fuse_req *req) ...@@ -918,6 +921,8 @@ static void process_init_reply(struct fuse_conn *fc, struct fuse_req *req)
fc->posix_acl = 1; fc->posix_acl = 1;
fc->sb->s_xattr = fuse_acl_xattr_handlers; fc->sb->s_xattr = fuse_acl_xattr_handlers;
} }
if (arg->flags & FUSE_ABORT_ERROR)
fc->abort_err = 1;
} else { } else {
ra_pages = fc->max_read / PAGE_SIZE; ra_pages = fc->max_read / PAGE_SIZE;
fc->no_lock = 1; fc->no_lock = 1;
...@@ -948,7 +953,8 @@ static void fuse_send_init(struct fuse_conn *fc, struct fuse_req *req) ...@@ -948,7 +953,8 @@ static void fuse_send_init(struct fuse_conn *fc, struct fuse_req *req)
FUSE_FLOCK_LOCKS | FUSE_HAS_IOCTL_DIR | FUSE_AUTO_INVAL_DATA | FUSE_FLOCK_LOCKS | FUSE_HAS_IOCTL_DIR | FUSE_AUTO_INVAL_DATA |
FUSE_DO_READDIRPLUS | FUSE_READDIRPLUS_AUTO | FUSE_ASYNC_DIO | FUSE_DO_READDIRPLUS | FUSE_READDIRPLUS_AUTO | FUSE_ASYNC_DIO |
FUSE_WRITEBACK_CACHE | FUSE_NO_OPEN_SUPPORT | FUSE_WRITEBACK_CACHE | FUSE_NO_OPEN_SUPPORT |
FUSE_PARALLEL_DIROPS | FUSE_HANDLE_KILLPRIV | FUSE_POSIX_ACL; FUSE_PARALLEL_DIROPS | FUSE_HANDLE_KILLPRIV | FUSE_POSIX_ACL |
FUSE_ABORT_ERROR;
req->in.h.opcode = FUSE_INIT; req->in.h.opcode = FUSE_INIT;
req->in.numargs = 1; req->in.numargs = 1;
req->in.args[0].size = sizeof(*arg); req->in.args[0].size = sizeof(*arg);
...@@ -1061,7 +1067,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent) ...@@ -1061,7 +1067,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
sb->s_flags &= ~(SB_NOSEC | SB_I_VERSION); sb->s_flags &= ~(SB_NOSEC | SB_I_VERSION);
if (!parse_fuse_opt(data, &d, is_bdev)) if (!parse_fuse_opt(data, &d, is_bdev, sb->s_user_ns))
goto err; goto err;
if (is_bdev) { if (is_bdev) {
...@@ -1089,16 +1095,27 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent) ...@@ -1089,16 +1095,27 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
if (!file) if (!file)
goto err; goto err;
if ((file->f_op != &fuse_dev_operations) || /*
(file->f_cred->user_ns != &init_user_ns)) * Require mount to happen from the same user namespace which
* opened /dev/fuse to prevent potential attacks.
*/
if (file->f_op != &fuse_dev_operations ||
file->f_cred->user_ns != sb->s_user_ns)
goto err_fput; goto err_fput;
/*
* If we are not in the initial user namespace posix
* acls must be translated.
*/
if (sb->s_user_ns != &init_user_ns)
sb->s_xattr = fuse_no_acl_xattr_handlers;
fc = kmalloc(sizeof(*fc), GFP_KERNEL); fc = kmalloc(sizeof(*fc), GFP_KERNEL);
err = -ENOMEM; err = -ENOMEM;
if (!fc) if (!fc)
goto err_fput; goto err_fput;
fuse_conn_init(fc); fuse_conn_init(fc, sb->s_user_ns);
fc->release = fuse_free_conn; fc->release = fuse_free_conn;
fud = fuse_dev_alloc(fc); fud = fuse_dev_alloc(fc);
...@@ -1179,6 +1196,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent) ...@@ -1179,6 +1196,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
fuse_dev_free(fud); fuse_dev_free(fud);
err_put_conn: err_put_conn:
fuse_conn_put(fc); fuse_conn_put(fc);
sb->s_fs_info = NULL;
err_fput: err_fput:
fput(file); fput(file);
err: err:
...@@ -1208,7 +1226,7 @@ static void fuse_kill_sb_anon(struct super_block *sb) ...@@ -1208,7 +1226,7 @@ static void fuse_kill_sb_anon(struct super_block *sb)
static struct file_system_type fuse_fs_type = { static struct file_system_type fuse_fs_type = {
.owner = THIS_MODULE, .owner = THIS_MODULE,
.name = "fuse", .name = "fuse",
.fs_flags = FS_HAS_SUBTYPE, .fs_flags = FS_HAS_SUBTYPE | FS_USERNS_MOUNT,
.mount = fuse_mount, .mount = fuse_mount,
.kill_sb = fuse_kill_sb_anon, .kill_sb = fuse_kill_sb_anon,
}; };
......
...@@ -192,6 +192,26 @@ static int fuse_xattr_set(const struct xattr_handler *handler, ...@@ -192,6 +192,26 @@ static int fuse_xattr_set(const struct xattr_handler *handler,
return fuse_setxattr(inode, name, value, size, flags); return fuse_setxattr(inode, name, value, size, flags);
} }
static bool no_xattr_list(struct dentry *dentry)
{
return false;
}
static int no_xattr_get(const struct xattr_handler *handler,
struct dentry *dentry, struct inode *inode,
const char *name, void *value, size_t size)
{
return -EOPNOTSUPP;
}
static int no_xattr_set(const struct xattr_handler *handler,
struct dentry *dentry, struct inode *nodee,
const char *name, const void *value,
size_t size, int flags)
{
return -EOPNOTSUPP;
}
static const struct xattr_handler fuse_xattr_handler = { static const struct xattr_handler fuse_xattr_handler = {
.prefix = "", .prefix = "",
.get = fuse_xattr_get, .get = fuse_xattr_get,
...@@ -209,3 +229,26 @@ const struct xattr_handler *fuse_acl_xattr_handlers[] = { ...@@ -209,3 +229,26 @@ const struct xattr_handler *fuse_acl_xattr_handlers[] = {
&fuse_xattr_handler, &fuse_xattr_handler,
NULL NULL
}; };
static const struct xattr_handler fuse_no_acl_access_xattr_handler = {
.name = XATTR_NAME_POSIX_ACL_ACCESS,
.flags = ACL_TYPE_ACCESS,
.list = no_xattr_list,
.get = no_xattr_get,
.set = no_xattr_set,
};
static const struct xattr_handler fuse_no_acl_default_xattr_handler = {
.name = XATTR_NAME_POSIX_ACL_DEFAULT,
.flags = ACL_TYPE_ACCESS,
.list = no_xattr_list,
.get = no_xattr_get,
.set = no_xattr_set,
};
const struct xattr_handler *fuse_no_acl_xattr_handlers[] = {
&fuse_no_acl_access_xattr_handler,
&fuse_no_acl_default_xattr_handler,
&fuse_xattr_handler,
NULL
};
...@@ -113,6 +113,9 @@ ...@@ -113,6 +113,9 @@
* 7.26 * 7.26
* - add FUSE_HANDLE_KILLPRIV * - add FUSE_HANDLE_KILLPRIV
* - add FUSE_POSIX_ACL * - add FUSE_POSIX_ACL
*
* 7.27
* - add FUSE_ABORT_ERROR
*/ */
#ifndef _LINUX_FUSE_H #ifndef _LINUX_FUSE_H
...@@ -148,7 +151,7 @@ ...@@ -148,7 +151,7 @@
#define FUSE_KERNEL_VERSION 7 #define FUSE_KERNEL_VERSION 7
/** Minor version number of this interface */ /** Minor version number of this interface */
#define FUSE_KERNEL_MINOR_VERSION 26 #define FUSE_KERNEL_MINOR_VERSION 27
/** The node ID of the root inode */ /** The node ID of the root inode */
#define FUSE_ROOT_ID 1 #define FUSE_ROOT_ID 1
...@@ -245,6 +248,7 @@ struct fuse_file_lock { ...@@ -245,6 +248,7 @@ struct fuse_file_lock {
* FUSE_PARALLEL_DIROPS: allow parallel lookups and readdir * FUSE_PARALLEL_DIROPS: allow parallel lookups and readdir
* FUSE_HANDLE_KILLPRIV: fs handles killing suid/sgid/cap on write/chown/trunc * FUSE_HANDLE_KILLPRIV: fs handles killing suid/sgid/cap on write/chown/trunc
* FUSE_POSIX_ACL: filesystem supports posix acls * FUSE_POSIX_ACL: filesystem supports posix acls
* FUSE_ABORT_ERROR: reading the device after abort returns ECONNABORTED
*/ */
#define FUSE_ASYNC_READ (1 << 0) #define FUSE_ASYNC_READ (1 << 0)
#define FUSE_POSIX_LOCKS (1 << 1) #define FUSE_POSIX_LOCKS (1 << 1)
...@@ -267,6 +271,7 @@ struct fuse_file_lock { ...@@ -267,6 +271,7 @@ struct fuse_file_lock {
#define FUSE_PARALLEL_DIROPS (1 << 18) #define FUSE_PARALLEL_DIROPS (1 << 18)
#define FUSE_HANDLE_KILLPRIV (1 << 19) #define FUSE_HANDLE_KILLPRIV (1 << 19)
#define FUSE_POSIX_ACL (1 << 20) #define FUSE_POSIX_ACL (1 << 20)
#define FUSE_ABORT_ERROR (1 << 21)
/** /**
* CUSE INIT request/reply flags * CUSE INIT request/reply flags
......
...@@ -1235,6 +1235,7 @@ bool current_in_userns(const struct user_namespace *target_ns) ...@@ -1235,6 +1235,7 @@ bool current_in_userns(const struct user_namespace *target_ns)
{ {
return in_userns(target_ns, current_user_ns()); return in_userns(target_ns, current_user_ns());
} }
EXPORT_SYMBOL(current_in_userns);
static inline struct user_namespace *to_user_ns(struct ns_common *ns) static inline struct user_namespace *to_user_ns(struct ns_common *ns)
{ {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment