aboutsummaryrefslogtreecommitdiffstats
path: root/lib/fuse_lowlevel.c
AgeCommit message (Collapse)AuthorLines
2019-03-08Document fuse_fsync_in.fsync_flags and remove magic numbers (#375)Alan Somers-6/+8
2018-11-19libfuse: add copy_file_range() supportNiels de Vos-0/+22
Add support for the relatively new copy_file_range() syscall. Backend filesystems can now implement an efficient way of cloning/duplicating data ranges within files. See 'man 2 copy_file_range' for more details.
2018-10-09Allow passing `/dev/fuse` file descriptor from parent processMattias Nissler-3/+24
This adds support for a mode of operation in which a privileged parent process opens `/dev/fuse` and takes care of mounting. The FUSE file system daemon can then run as an unprivileged child that merely processes requests on the FUSE file descriptor, which get passed using the special `/dev/fd/%u` syntax for the mountpoint parameter. The main benefit is that no privileged operations need to be performed by the FUSE file system daemon itself directly or indirectly, so the FUSE process can run with fully unprivileged and mechanisms like securebits and no_new_privs can be used to prevent subprocesses from re-acquiring privilege via setuid, fscaps, etc. This reduces risk in case the FUSE file system gets exploited by malicious file system data. Below is an example that illustrates this. Note that I'm using shell for presentation purposes, the expectation is that the parent process will implement the equivalent of the `mount -i` and `capsh` commands. ``` \# example/hello can mount successfully with privilege $ sudo sh -c "LD_LIBRARY_PATH=build/lib ./example/hello /mnt/tmp" $ sudo cat /mnt/tmp/hello Hello World! $ sudo umount /mnt/tmp \# example/hello fails to mount without privilege $ sudo capsh --drop=all --secbits=0x2f -- -c 'LD_LIBRARY_PATH=build/lib ./example/hello -f /mnt/tmp' fusermount3: mount failed: Operation not permitted \# Passing FUSE file descriptor via /dev/fd/%u allows example/hello to work without privilege $ sudo sh -c ' exec 17<>/dev/fuse mount -i -o nodev,nosuid,noexec,fd=17,rootmode=40000,user_id=0,group_id=0 -t fuse hello /mnt/tmp capsh --drop=all --secbits=0x2f -- -c "LD_LIBRARY_PATH=build/lib example/hello /dev/fd/17" ' $ sudo cat /mnt/tmp/hello Hello World! $ sudo umount /mnt/tmp ```
2018-09-20Don't enable adaptive readdirplus unless fs has readdir() handler.Nikolaus Rath-1/+2
2017-11-27Spelling (#223)Josh Soref-1/+1
Fix spelling errors
2017-08-25do_init(): print missing capabilities if there are any.Nikolaus Rath-1/+2
2017-08-22Document and unify error codes of fuse_lowlevel_notify_*Nikolaus Rath-3/+9
2017-08-11Fix unused variable warnings under FreeBSD.Nikolaus Rath-0/+1
2017-08-07Fix support for FUSE_POSIX_ACLMarcin Sulikowski-0/+2
The kernel may set the FUSE_POSIX_ACL flag in the FUSE_INIT request to notify the userspace daemon that the OS does support POSIX ACLs for FUSE file systems. If the filesystem implementation wants to enable POSIX ACLs, it has to reply with the FUSE_POSIX_ACL flag set. However, the reply to the kernel never includes this flag, even if the implementation expresses the need by setting the FUSE_CAP_POSIX_ACL flag in the fuse_conn_info::want variable passed to its init callback. We modify the library to handle requests for FUSE_CAP_POSIX_ACL correctly, i.e., set the FUSE_POSIX_ACL flag in the FUSE_INIT reply to the kernel. Signed-off-by: Marcin Sulikowski <marcin.sulikowski@editshare.com>
2017-07-08Fixed description of struct fuse_conn_info->time_granNikolaus Rath-1/+2
At least on Linux kernel 4.9, a value of zero gives more than 1-sec accuracy.
2017-06-05getgroups(): clarify codeNikolaus Rath-1/+1
read() return value should always be positive or -1. However, since we cast to unsigned a little later, it's clearer to check for non-negativity.
2017-06-05Fix comparison of integers of different signsAngelo G. Del Regno-3/+3
Some variables of different size and sign were getting compared without any safe casting. The build system also throws warnings at this and, being this library used for filesystems, it's really important to ensure stability.
2017-04-20make buffer size match kernel max transfer sizeCarlos Maiolino-3/+5
Currently libfuse has a hardcoded buffer limit to 128kib, while fuse kernel module has a limit up to 32 pages. This patch changes buffer limit to match the current page size, instead of assuming 4096 bytes pages, enabling architectures with bigger pages to use larger buffers, improving performance. Also, add a new macro (HEADER_SIZE) to specify the space needed to accommodate the header, making it easier to understand why those extra 4096 bytes are needed Signed-off-by: Carlos Maiolino <cmaiolino-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2016-11-29Improve documentation of fuse_session_unmountNikolaus Rath-0/+4
2016-11-22Make handling of -oallow_root easier to understandNikolaus Rath-6/+17
-oallow_root is handled in userspace, and requires passing -oallow_other to the kernel. This patch should make the code easier to understand and avoid the confusion that gave rise to issue #86.
2016-11-22Add support for FUSE_HANDLE_KILLPRIVNikolaus Rath-0/+3
Fixes #116.
2016-11-22Add support for FUSE_POSIX_ACLNikolaus Rath-0/+2
Fixes #117.
2016-11-22Added support for FUSE_PARALLEL_DIROPSNikolaus Rath-0/+3
Enabled by default since we haven't released libfuse 3.0 yet :-). Fixes #112.
2016-11-16Enable more capabilities by default, and document defaults.Nikolaus Rath-1/+11
Fixes #112.
2016-11-16Abort if fs requests capabilities not supported by kernel.Nikolaus Rath-0/+9
See also issue #114.
2016-11-16Fail more nicely on max_read mismatchNikolaus Rath-1/+4
Instead of abort()ing, close the session properly and return an error code.
2016-11-16Add support for more detailed error codes from main loopNikolaus Rath-0/+1
2016-10-27Add max_read to fuse_conn_infoNikolaus Rath-0/+8
Eventually, this setting should be negotiated in the filesystem's init() handler (like e.g. max_write). However, this requires corresponding changes in the FUSE kernel module. In preparation for this (and to allow a transition period) we already allow (and require) filesystems to set the value in the init() handler in addition to the mount option. The end-goal is tracked in issue #91.
2016-10-25Use "se" instead of "f" for struct fuse_sessionNikolaus Rath-90/+90
The fuse_session pointer is sometimes called f and at other times se. The former is an artifact from the time when there still was a separate struct fuse_ll object. For consistency and to easy maintenance, this patch changes the name of the fuse_session pointer to "se" wherever possible. This patch was generated by the following Coccinelle script: @@ symbol f, se; @@ struct fuse_session * -f +se ; <... -f +se ...> @@ expression expr; @@ struct fuse_session * -f +se = expr; <... -f +se ...> @@ identifier fn; @@ fn(...,struct fuse_session * -f +se ,...) { <... -f +se ...> } Due to its complexity, the do_init() function had to be commented out and then patched manually.
2016-10-24fuse_session_new(): don't accept empty argv, check argv[0]Nikolaus Rath-1/+11
This should help avoid people to accidentally put options into argv[0]. Fixes #100.
2016-10-20Do not close stdout on fuse_session_destroy()Consus-1/+3
If fuse_session_mount() fails (or was never called in the first place) we end up with the default fd value which happens to be 0. It hurts long-running processes, which lifetime extends beyond session's lifetime.
2016-10-17fuse_session_new(): accept --debugNikolaus Rath-1/+1
Fixes commit 3e022acf4076. Thanks to Github user mtheall for the review!
2016-10-16Inlined fuse_mount_help() into fuse_lowlevel_help().Nikolaus Rath-1/+6
Both the BSD and Linux implementation actually accept mostly the same FUSE-specific mount options. Up to now, the BSD help function appended the output of ``mount_fusefs --help``, but looking at http://www.unix.com/man-page/freebsd/8/mount_fusefs/ this is likely more confusing than helpful (since the user is not actually invoking mount_fusefs directly, most of the options don't make sense).
2016-10-16fuse_session_new: accept -o debug as synonym for -dNikolaus Rath-0/+1
2016-10-15Make --help output more suitable for end-userNikolaus Rath-0/+6
We now only list options that are potentially useful for an end-user (and unlikely to accidentally break a file system). The full list of FUSE options has been moved to the documentation of the fuse_new() and fuse_session_new() functions.
2016-10-15Unify handling of fuse_conn_info optionsNikolaus Rath-99/+0
Instead of using command line options to modify struct fuse_conn_info before and after calling the init() handler, we now give the file system explicit control over this.
2016-10-15Merge branch 'fixup-lock-options'Nikolaus Rath-0/+3
2016-10-15Re-activated lost no_remote_*lock options.Nikolaus Rath-0/+3
2016-10-13do_init(): treat command line options consistentlyNikolaus Rath-47/+53
Previously, some command line options would change the FUSE defaults but leave the final value to the file systems `init` handler while others would override any changes made by `init`. Now, command line options do both: they modify the default, *and* take precedence.
2016-10-13Make -o clone_fd into a parameter of session_loop_mt().Nikolaus Rath-3/+1
This option really affects the behavior of the session loop, not the low-level interface. Therefore, it does not belong in the fuse_session object.
2016-10-13Move session options into sub-structNikolaus Rath-29/+28
The session options are used only once to determine the proper conn->want flags. It is nice to have them clearly separated from the other struct fuse_session members that are used throughout the life of the file system.
2016-10-13Use NULL for option processing function where possible.Nikolaus Rath-10/+1
2016-10-13Activate splice_read by default if write_buf is implemented.Nikolaus Rath-0/+1
2016-10-10Factored out LL_OPTIONS macroNikolaus Rath-34/+36
2016-10-10Removed 'async_read' field in fuse_conn_infoNikolaus Rath-8/+11
This is redundant with the capability flags in `wants` and `capable`.
2016-10-10Make several -o NN options work againNikolaus Rath-5/+5
In commit 2ed7af, we accidentally set the default values *after* parsing the command line arguments.
2016-10-10Use "se" instead of "f" for fuse_session pointer where possible.Nikolaus Rath-52/+53
These changes were generated with the following Coccinelle semantic patch: @@ symbol f, se; // avoid unneeded warnings from Coccinelle @@ struct fuse_session * -f +se ; <... -f +se ...> @@ identifier fn; @@ fn(...,struct fuse_session * -f +se ,...) { <... -f +se ...> }
2016-10-09Fix valgrind warningNikolaus Rath-0/+1
If we don't assign a value to padding, we get a warning about reading uninitialized data when sending the iovec to the kernel.
2016-10-08Removed ``-o big_writes`` optionNikolaus Rath-8/+4
This option is obsolete and should always be enabled. File systems that want to limit the size of write requests should use the ``-o max_write=<N>`` option instead.
2016-10-05Remove pointless aliasing of fuse_session *se to *fNikolaus Rath-34/+9
This is an overlooked artifact of the fuse_ll-fuse_session merge.
2016-10-04Merge fuse_ll into fuse_session (part 8)Nikolaus Rath-6/+6
Replaced "req->se" with "f" where the latter is already defined.
2016-10-04Merge fuse_ll into fuse_session (part 7)Nikolaus Rath-34/+30
Remove pointless aliasing of "struct fuse_session *se" to "struct fuse_session *f".
2016-10-04Merge fuse_ll into fuse_session (part 5)Nikolaus Rath-13/+3
Fixup fuse_session_new().
2016-10-04Merge fuse_ll into fuse_session (part 4)Nikolaus Rath-9/+3
Merge fuse_ll_destroy() and fuse_session_destroy().
2016-10-04Merge fuse_ll into fuse_session (part 3)Nikolaus Rath-13/+12
Replace se->f with se.
generated by cgit v1.2.3 (git 2.39.1) at 2025-10-07 22:43:25 +0000