aboutsummaryrefslogtreecommitdiffstats
path: root/util/fusermount.c
AgeCommit message (Collapse)AuthorLines
2020-12-27util/fusermount.c: Assume the kernel supports UMOUNT_NOFOLLOW (#574)Sargun Dhillon-23/+1
UMOUNT_NOFOLLOW was added in Kernel 2.6.34. It's been 10 years since it's been added Kernel 5.9, and 5.10 break this check mechanism[1]. Let's deprecate it. [1]: https://lore.kernel.org/linux-fsdevel/20201223102604.2078-1-sargun@sargun.me/ Signed-off-by: Sargun Dhillon <sargun@sargun.me>
2020-12-19Add exfat to whitelist (#573)Kangjing "Chaser" Huang-0/+1
2020-03-13Align help options (#500)Andrew Gaul-1/+1
2020-03-13State GPL version in comment (#485)Dr. David Alan Gilbert-1/+1
IN a bunch of comments we say 'under the terms of the GNU GPL', make it clear this is GPLv2 (as LICENSE says). Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2019-09-15Whitelist UFSD (#451)tenzap-0/+1
2019-06-15Fix build with IGNORE_MTAB (#425)Michael Forney-0/+2
chdir_to_parent and check_is_mount are used by should_auto_mount, added in fuse-3.3.0, regardless of whether IGNORE_MTAB is defined.
2019-04-03Whitelist smb2 (#392)Peter Lemenkov-4/+5
See also https://bugzilla.redhat.com/1694552#c7 Signed-off-by: Peter Lemenkov <lemenkov@gmail.com>
2019-03-09Add HFS+ to filesystem whitelist (#347)1c7718e7-0/+1
2019-03-09Correctly include config.h ("" vs <>)Nikolaus Rath-2/+2
This isn't a system header. Fixes: #349
2019-03-08fusermount: drop privileges for chdir()Sam Huffman-0/+2
cd to mountpoint's parent directory using unprivileged rather than privileged access. This is to ensure that unmount works on mountpoints where root may not have privileged access. Fixes: #376
2019-01-04Added OpenAFS to type whitelistNikolaus Rath-0/+1
Fixes: #336.
2018-11-06Avoid double unmount on normal unmount in auto_unmount mode.Kevin Vigor-11/+63
If a fuse filesystem was mounted in auto_unmount mode on top of an already mounted filesystem, we would end up doing a double-unmount when the fuse filesystem was unmounted properly. Make the auto_unmount code less eager: unmount only if the mounted filesystem has proper type and is returning 'Transport endpoint not connected'.
2018-10-19Add SpectrumScale/GPFS and Lustre to FS whitelistValentin Plugaru-0/+2
Fixes: #304 Signed-off-by: Valentin Plugaru <valentin.plugaru@uni.lu>
2018-08-31Do not hardcode /etc/fuse.conf path.Nikolaus Rath-1/+0
2018-08-09Add bcachefs to mountpoint file system whitelistDaniel Fullmer-0/+1
2018-08-05Add FAT to mountpoint file system whitelistBenjamin Barenblat-0/+1
2018-08-05Realphabetize and re-document mountpoint file system whitelistBenjamin Barenblat-4/+6
2018-07-31Add autofs to mountpoint file system whitelistRobo Shimmer-0/+1
2018-07-23fusermount: Fix memory leaksRostislav Skudnov-0/+2
2018-07-18fusermount: whitelist known-good filesystems for mountpointsJann Horn-1/+49
Before: $ _FUSE_COMMFD=1 priv_strace -s8000 -e trace=mount util/fusermount3 /proc/self/fd mount("/dev/fuse", ".", "fuse", MS_NOSUID|MS_NODEV, "fd=3,rootmode=40000,user_id=379777,group_id=5001") = 0 sending file descriptor: Socket operation on non-socket +++ exited with 1 +++ After: $ _FUSE_COMMFD=1 priv_strace -s8000 -e trace=mount util/fusermount3 /proc/self/fd util/fusermount3: mounting over filesystem type 0x009fa0 is forbidden +++ exited with 1 +++ This patch could potentially have security impact on some systems that are configured with allow_other; see https://launchpad.net/bugs/1530566 for an example of how a similar issue in the ecryptfs mount helper was exploitable. However, the FUSE mount helper performs slightly different security checks, so that exact attack doesn't work with fusermount; I don't know of any specific attack you could perform using this, apart from faking the SELinux context of your process when someone's looking at a process listing. Potential targets for overwrite are (looking on a system with a 4.9 kernel): writable only for the current process: /proc/self/{fd,map_files} (Yes, "ls -l" claims that you don't have write access, but that's not true; "find -writable" will show you what access you really have.) writable also for other owned processes: /proc/$pid/{sched,autogroup,comm,mem,clear_refs,attr/*,oom_adj, oom_score_adj,loginuid,coredump_filter,uid_map,gid_map,projid_map, setgroups,timerslack_ns}
2018-07-18fusermount: refuse unknown optionsJann Horn-1/+7
Blacklists are notoriously fragile; especially if the kernel wishes to add some security-critical mount option at a later date, all existing systems with older versions of fusermount installed will suddenly have a security problem. Additionally, if the kernel's option parsing became a tiny bit laxer, the blacklist could probably be bypassed. Whitelist known-harmless flags instead, even if it's slightly more inconvenient.
2018-07-18fusermount: bail out on transient config read failureJann Horn-0/+9
If an attacker wishes to use the default configuration instead of the system's actual configuration, they can attempt to trigger a failure in read_conf(). This only permits increasing mount_max if it is lower than the default, so it's not particularly interesting. Still, this should probably be prevented robustly; bail out if funny stuff happens when we're trying to read the config. Note that the classic attack trick of opening so many files that the system-wide limit is reached won't work here - because fusermount only drops the fsuid, not the euid, the process is running with euid=0 and CAP_SYS_ADMIN, so it bypasses the number-of-globally-open-files check in get_empty_filp() (unless you're inside a user namespace).
2018-07-18fusermount: don't feed "escaped commas" into mount optionsJann Horn-1/+4
The old code permits the following behavior: $ _FUSE_COMMFD=10000 priv_strace -etrace=mount -s200 fusermount -o 'foobar=\,allow_other' mount mount("/dev/fuse", ".", "fuse", MS_NOSUID|MS_NODEV, "foobar=\\,allow_other,fd=3,rootmode=40000,user_id=1000,group_id=1000") = -1 EINVAL (Invalid argument) However, backslashes do not have any special meaning for the kernel here. As it happens, you can't abuse this because there is no FUSE mount option that takes a string value that can contain backslashes; but this is very brittle. Don't interpret "escape characters" in places where they don't work.
2018-07-18fusermount: prevent silent truncation of mount optionsJann Horn-3/+20
Currently, in the kernel, copy_mount_options() copies in one page of userspace memory (or less if some of that memory area is not mapped). do_mount() then writes a null byte to the last byte of the copied page. This means that mount option strings longer than PAGE_SIZE-1 bytes get truncated silently. Therefore, this can happen: user@d9-ut:~$ _FUSE_COMMFD=10000 fusermount -o "$(perl -e 'print ","x4000')" mount sending file descriptor: Bad file descriptor user@d9-ut:~$ grep /mount /proc/mounts /dev/fuse /home/user/mount fuse rw,nosuid,nodev,relatime,user_id=1000,group_id=1000 0 0 user@d9-ut:~$ fusermount -u mount user@d9-ut:~$ _FUSE_COMMFD=10000 fusermount -o "$(perl -e 'print ","x4050')" mount sending file descriptor: Bad file descriptor user@d9-ut:~$ grep /mount /proc/mounts /dev/fuse /home/user/mount fuse rw,nosuid,nodev,relatime,user_id=1000,group_id=100 0 0 user@d9-ut:~$ fusermount -u mount user@d9-ut:~$ _FUSE_COMMFD=10000 fusermount -o "$(perl -e 'print ","x4051')" mount sending file descriptor: Bad file descriptor user@d9-ut:~$ grep /mount /proc/mounts /dev/fuse /home/user/mount fuse rw,nosuid,nodev,relatime,user_id=1000,group_id=10 0 0 user@d9-ut:~$ fusermount -u mount user@d9-ut:~$ _FUSE_COMMFD=10000 fusermount -o "$(perl -e 'print ","x4052')" mount sending file descriptor: Bad file descriptor user@d9-ut:~$ grep /mount /proc/mounts /dev/fuse /home/user/mount fuse rw,nosuid,nodev,relatime,user_id=1000,group_id=1 0 0 user@d9-ut:~$ fusermount -u mount I'm not aware of any context in which this is actually exploitable - you'd still need the UIDs to fit, and you can't do it if the three GIDs of the process don't match (in the case of a typical setgid binary), but it does look like something that should be fixed. I also plan to try to get this fixed on the kernel side.
2018-05-08Fix compile-time warnings on IGNORE_MTABTomohiro Kusumi-1/+2
Silence below warnings which appear if IGNORE_MTAB is defined. [59/64] Compiling C object 'util/fusermount3@exe/fusermount.c.o'. ../util/fusermount.c:493:12: warning: function declaration isn't a prototype [-Wstrict-prototypes] static int count_fuse_fs() ^~~~~~~~~~~~~ ../util/fusermount.c: In function 'unmount_fuse': ../util/fusermount.c:508:46: warning: unused parameter 'quiet' [-Wunused-parameter] static int unmount_fuse(const char *mnt, int quiet, int lazy) ^~~~~
2016-11-28Rename more things from fuse to fuse3Przemysław Pawełczyk-5/+5
2016-10-28Fix memory leak in fusermount.Nikolaus Rath-7/+13
2016-10-27Removed obsolete FUSE_DEV_OLDNikolaus Rath-54/+8
2016-10-15Removed -o nonempty optionNikolaus Rath-11/+3
This brings the default behavior in-line with that of the regular `mount` command.
2014-07-15fusermount, libfuse: send value as unsigned in "user_id=" and "group_id="Miklos Szeredi-2/+2
...options. Uids/gids larger than 2147483647 would result in EINVAL when mounting the filesystem. This also needs a fix in the kernel.
2013-08-26Merge remote-tracking branch 'origin/fuse_2_9_bugfix'Miklos Szeredi-0/+1
2013-08-26Add missing includesDaniel Thau-0/+1
This allows compiling fuse with musl.
2013-07-26Print help on stdout instead of stderrMiklos Szeredi-10/+9
2011-11-17Fix the following compile errorMiklos Szeredi-0/+1
fusermount.c: In function 'clone_newns': fusermount.c:315:2: warning: implicit declaration of function 'clone' [-Wimplicit-function-declaration] fusermount.c:315:44: error: 'CLONE_NEWNS' undeclared (first use in this function) fusermount.c:315:44: note: each undeclared identifier is reported only once for each function it appears in fusermount.c:317:1: warning: control reaches end of non-void function [-Wreturn-type]
2011-05-25Spell checking comments, etc...Reuben Hawkins-1/+1
...with the help of vim :set spell modified: FAQ modified: include/fuse.h modified: include/fuse_common.h modified: include/fuse_opt.h modified: lib/fuse_kern_chan.c modified: util/fusermount.c
2011-05-23cleaning up warningsReuben Hawkins-4/+24
fprintf(stderr, whatever); -> fprintf(stderr, "%s", whatever); checking return values on chdir and lockf where we weren't already modified: example/cusexmp.c modified: example/fioclient.c modified: util/fusermount.c
2011-04-15fusermount: Added support for auto_unmount optionMax Krasnyansky-14/+49
When this option is specified fusermount will become a daemon and wait for the parent to exit or die, which causes control fd to get closed. It will then try to unmount the original mountpoint.
2011-03-30Check the 'mtablock' for negative valueLaszlo Papp-2/+4
2011-03-30fusermount: clean up do_mount() functionMiklos Szeredi-5/+4
2011-03-30Eliminate the unused valueLaszlo Papp-1/+1
2011-03-30Fix resource leaks in fusermountLaszlo Papp-8/+10
2011-03-11In case of failure to add to /etc/mtab don't umount.Miklos Szeredi-1/+1
Reported by Marc Deslauriers
2011-03-11Revert "Fix cleanup in case of failed mount"Miklos Szeredi-30/+6
This reverts commit bf5ffb5fd8558bd799791834def431c0cee5a11f. Cleanup of mount doesn't work the way it was envisioned, because the kernel doesn't follow mounts on the umount() call, hence it will find a non-mounted directory.
2011-01-31fusermount: only allow mount and umount if util-linux suppports ↵Miklos Szeredi-135/+32
--no-canonicalize Remove "legacy" util-linux support as missing --no-canonicalize cannot be worked around in fuse.
2011-01-31fusermount: chdir to / before performing mount/umountMiklos Szeredi-15/+10
2011-01-31Fix cleanup in case of failed mountMiklos Szeredi-6/+29
In case of failure to add to /etc/mtab use same mountpoint for cleanup as for mounting. Reported by Marc Deslauriers
2010-11-08fusermount: don't save/restore cwdMiklos Szeredi-15/+2
Remove unnecessary restoring of current working directory in "fusermount -u"
2010-11-08update umount procedureMiklos Szeredi-9/+147
If umount(8) supports --fake and --no-canonicalize (util-linux-ng version 2.18 or later), and umount(2) supports the UMOUNT_NOFOLLOW flag (linux kernel version 2.6.35 or later) then, "fusermount -u" will call the umount(2) system call and use "umount --fake ..." to update /etc/mtab Added --disable-legacy-umount option to configure. This disables the runtime checking of umount(8) version. When built with this option then "fusermount -u" will fail if umount(8) doesn't support the --fake and --no-canonicalize options.
2010-09-28Fix option escaping for fusermount.Miklos Szeredi-3/+17
If the "fsname=" option contained a comma then the option parser in fusermount was confused (Novell bugzilla #641480). Fix by escaping commas when passing them over to fusermount. Reported by Jan Engelhardt
2010-04-26* Fix checking for symlinks in umount from /tmp. Reported by AlMiklos Szeredi-14/+32
Viro * Fix umounting if /tmp is a symlink. Reported by Franco Broi
generated by cgit v1.2.3 (git 2.39.1) at 2025-10-07 18:38:54 +0000