aboutsummaryrefslogtreecommitdiffstats
path: root/util
AgeCommit message (Collapse)AuthorLines
2018-07-23fusermount: Fix memory leaksRostislav Skudnov-0/+2
2018-07-18fusermount: whitelist known-good filesystems for mountpointsJann Horn-1/+49
Before: $ _FUSE_COMMFD=1 priv_strace -s8000 -e trace=mount util/fusermount3 /proc/self/fd mount("/dev/fuse", ".", "fuse", MS_NOSUID|MS_NODEV, "fd=3,rootmode=40000,user_id=379777,group_id=5001") = 0 sending file descriptor: Socket operation on non-socket +++ exited with 1 +++ After: $ _FUSE_COMMFD=1 priv_strace -s8000 -e trace=mount util/fusermount3 /proc/self/fd util/fusermount3: mounting over filesystem type 0x009fa0 is forbidden +++ exited with 1 +++ This patch could potentially have security impact on some systems that are configured with allow_other; see https://launchpad.net/bugs/1530566 for an example of how a similar issue in the ecryptfs mount helper was exploitable. However, the FUSE mount helper performs slightly different security checks, so that exact attack doesn't work with fusermount; I don't know of any specific attack you could perform using this, apart from faking the SELinux context of your process when someone's looking at a process listing. Potential targets for overwrite are (looking on a system with a 4.9 kernel): writable only for the current process: /proc/self/{fd,map_files} (Yes, "ls -l" claims that you don't have write access, but that's not true; "find -writable" will show you what access you really have.) writable also for other owned processes: /proc/$pid/{sched,autogroup,comm,mem,clear_refs,attr/*,oom_adj, oom_score_adj,loginuid,coredump_filter,uid_map,gid_map,projid_map, setgroups,timerslack_ns}
2018-07-18fusermount: refuse unknown optionsJann Horn-1/+7
Blacklists are notoriously fragile; especially if the kernel wishes to add some security-critical mount option at a later date, all existing systems with older versions of fusermount installed will suddenly have a security problem. Additionally, if the kernel's option parsing became a tiny bit laxer, the blacklist could probably be bypassed. Whitelist known-harmless flags instead, even if it's slightly more inconvenient.
2018-07-18fusermount: bail out on transient config read failureJann Horn-0/+9
If an attacker wishes to use the default configuration instead of the system's actual configuration, they can attempt to trigger a failure in read_conf(). This only permits increasing mount_max if it is lower than the default, so it's not particularly interesting. Still, this should probably be prevented robustly; bail out if funny stuff happens when we're trying to read the config. Note that the classic attack trick of opening so many files that the system-wide limit is reached won't work here - because fusermount only drops the fsuid, not the euid, the process is running with euid=0 and CAP_SYS_ADMIN, so it bypasses the number-of-globally-open-files check in get_empty_filp() (unless you're inside a user namespace).
2018-07-18fusermount: don't feed "escaped commas" into mount optionsJann Horn-1/+4
The old code permits the following behavior: $ _FUSE_COMMFD=10000 priv_strace -etrace=mount -s200 fusermount -o 'foobar=\,allow_other' mount mount("/dev/fuse", ".", "fuse", MS_NOSUID|MS_NODEV, "foobar=\\,allow_other,fd=3,rootmode=40000,user_id=1000,group_id=1000") = -1 EINVAL (Invalid argument) However, backslashes do not have any special meaning for the kernel here. As it happens, you can't abuse this because there is no FUSE mount option that takes a string value that can contain backslashes; but this is very brittle. Don't interpret "escape characters" in places where they don't work.
2018-07-18fusermount: prevent silent truncation of mount optionsJann Horn-3/+20
Currently, in the kernel, copy_mount_options() copies in one page of userspace memory (or less if some of that memory area is not mapped). do_mount() then writes a null byte to the last byte of the copied page. This means that mount option strings longer than PAGE_SIZE-1 bytes get truncated silently. Therefore, this can happen: user@d9-ut:~$ _FUSE_COMMFD=10000 fusermount -o "$(perl -e 'print ","x4000')" mount sending file descriptor: Bad file descriptor user@d9-ut:~$ grep /mount /proc/mounts /dev/fuse /home/user/mount fuse rw,nosuid,nodev,relatime,user_id=1000,group_id=1000 0 0 user@d9-ut:~$ fusermount -u mount user@d9-ut:~$ _FUSE_COMMFD=10000 fusermount -o "$(perl -e 'print ","x4050')" mount sending file descriptor: Bad file descriptor user@d9-ut:~$ grep /mount /proc/mounts /dev/fuse /home/user/mount fuse rw,nosuid,nodev,relatime,user_id=1000,group_id=100 0 0 user@d9-ut:~$ fusermount -u mount user@d9-ut:~$ _FUSE_COMMFD=10000 fusermount -o "$(perl -e 'print ","x4051')" mount sending file descriptor: Bad file descriptor user@d9-ut:~$ grep /mount /proc/mounts /dev/fuse /home/user/mount fuse rw,nosuid,nodev,relatime,user_id=1000,group_id=10 0 0 user@d9-ut:~$ fusermount -u mount user@d9-ut:~$ _FUSE_COMMFD=10000 fusermount -o "$(perl -e 'print ","x4052')" mount sending file descriptor: Bad file descriptor user@d9-ut:~$ grep /mount /proc/mounts /dev/fuse /home/user/mount fuse rw,nosuid,nodev,relatime,user_id=1000,group_id=1 0 0 user@d9-ut:~$ fusermount -u mount I'm not aware of any context in which this is actually exploitable - you'd still need the UIDs to fit, and you can't do it if the three GIDs of the process don't match (in the case of a typical setgid binary), but it does look like something that should be fixed. I also plan to try to get this fixed on the kernel side.
2018-07-04Source LSB init functionsLaszlo Boszormenyi (GCS)-0/+3
2018-05-11add_arg(): check for overflowNikolaus Rath-0/+5
Fixes: #222.
2018-05-08Fix compile-time warnings on IGNORE_MTABTomohiro Kusumi-1/+2
Silence below warnings which appear if IGNORE_MTAB is defined. [59/64] Compiling C object 'util/fusermount3@exe/fusermount.c.o'. ../util/fusermount.c:493:12: warning: function declaration isn't a prototype [-Wstrict-prototypes] static int count_fuse_fs() ^~~~~~~~~~~~~ ../util/fusermount.c: In function 'unmount_fuse': ../util/fusermount.c:508:46: warning: unused parameter 'quiet' [-Wunused-parameter] static int unmount_fuse(const char *mnt, int quiet, int lazy) ^~~~~
2018-03-28Add example configuration file (#216)admorgan-0/+20
Add a configuration file with all options disabled that includes all valid options and their description.
2017-12-01Handle mount ... -o nofail (#221)Josh Soref-0/+1
Accept (and ignore) nofail mount option
2017-10-20make udevrulesdir configurableJoerg Thalheim-2/+6
on nixos we install fuse in its own hierarchy independent from systemd.
2017-08-24Dropped support for building with autotoolsNikolaus Rath-53/+0
It's just too much pain to keep it working.
2017-08-14Fixed udev rules directory.Nikolaus Rath-1/+1
2017-08-02Ask pkgconfig where we should install udev rulesHeiko Becker-2/+6
2017-07-07Don't use emacs' python-mode for meson filesNikolaus Rath-3/+0
There is a proper meson-mode now.
2017-06-21Install init script in $DESTDIR/etc, not $prefix/$sysconfdirNikolaus Rath-3/+5
Fixes: #178.
2017-01-12Added experimental support for building with Meson+NinjaNikolaus Rath-1/+60
2016-11-28Rename more things from fuse to fuse3Przemysław Pawełczyk-8/+8
2016-10-28Fix memory leak in fusermount.Nikolaus Rath-7/+13
2016-10-28Renamed fusermount / mount.fuse to fusermount3 / mount.fuse3Nikolaus Rath-12/+11
2016-10-27Removed obsolete FUSE_DEV_OLDNikolaus Rath-54/+8
2016-10-15Removed -o nonempty optionNikolaus Rath-11/+3
This brings the default behavior in-line with that of the regular `mount` command.
2014-07-15fusermount, libfuse: send value as unsigned in "user_id=" and "group_id="Miklos Szeredi-2/+2
...options. Uids/gids larger than 2147483647 would result in EINVAL when mounting the filesystem. This also needs a fix in the kernel.
2013-08-26Merge remote-tracking branch 'origin/fuse_2_9_bugfix'Miklos Szeredi-0/+1
2013-08-26Add missing includesDaniel Thau-0/+1
This allows compiling fuse with musl.
2013-07-26Print help on stdout instead of stderrMiklos Szeredi-10/+9
2013-07-25ulockmgr: strip ulockmgr support from this source packageMiklos Szeredi-432/+1
Distribute ulockmgr separately. It is not needed for the building of libfuse, only fusexmp_fh. Check ulockmgr library in ./configure and if not disable remote-lock suport in fusexmp_fh.
2013-07-24libfuse: remove "-D_FILE_OFFSET_BITS=64" from fuse.pcMiklos Szeredi-2/+4
add AC_SYS_LARGEFILE to your configure.ac instead.
2012-07-04Fix build with automake >= 1.12.1Olivier Blin-4/+4
mkdir_p is deprecated since automake 1.12.1 (see automake commit 7a1eb9ff9027929687f12905e131f6fda3fa6d0c). MKDIR_P should be used instead of mkdir_p. This is available since autoconf 2.59d (2006-06-05), by calling AC_PROG_MKDIR_P. The mkdir_p workaround was not working anyway for out-of-tree builds, since the ../mkinstalldirs path would be incorrect.
2012-07-04Fix install from out-of-tree buildOlivier Blin-1/+1
When building out-of-tree, install fails since it tries to copy mount.fuse binary from source directory. Patch initially from Damien Thébault (SoftAtHome)
2011-11-17Fix the following compile errorMiklos Szeredi-0/+1
fusermount.c: In function 'clone_newns': fusermount.c:315:2: warning: implicit declaration of function 'clone' [-Wimplicit-function-declaration] fusermount.c:315:44: error: 'CLONE_NEWNS' undeclared (first use in this function) fusermount.c:315:44: note: each undeclared identifier is reported only once for each function it appears in fusermount.c:317:1: warning: control reaches end of non-void function [-Wreturn-type]
2011-09-23Replace daemon() function with fork()Anatol Pomozov-2/+15
daemon() is a BSD-ism. Although it is available on many platforms it is not a standard function. Some platforms (e.g. MacOSX) deprecated it. It is safer just to use fork() function that is a part of POSIX.
2011-05-25Spell checking comments, etc...Reuben Hawkins-1/+1
...with the help of vim :set spell modified: FAQ modified: include/fuse.h modified: include/fuse_common.h modified: include/fuse_opt.h modified: lib/fuse_kern_chan.c modified: util/fusermount.c
2011-05-23cleaning up warningsReuben Hawkins-4/+24
fprintf(stderr, whatever); -> fprintf(stderr, "%s", whatever); checking return values on chdir and lockf where we weren't already modified: example/cusexmp.c modified: example/fioclient.c modified: util/fusermount.c
2011-04-15fusermount: Added support for auto_unmount optionMax Krasnyansky-14/+49
When this option is specified fusermount will become a daemon and wait for the parent to exit or die, which causes control fd to get closed. It will then try to unmount the original mountpoint.
2011-03-30Check the 'mtablock' for negative valueLaszlo Papp-2/+4
2011-03-30fusermount: clean up do_mount() functionMiklos Szeredi-5/+4
2011-03-30Eliminate the unused valueLaszlo Papp-1/+1
2011-03-30Fix resource leaks in fusermountLaszlo Papp-8/+10
2011-03-30Do not pass NULL to xstrdupLaszlo Papp-8/+12
2011-03-30Check the return value properly before passing it to any functionLaszlo Papp-2/+4
2011-03-11In case of failure to add to /etc/mtab don't umount.Miklos Szeredi-1/+1
Reported by Marc Deslauriers
2011-03-11Revert "Fix cleanup in case of failed mount"Miklos Szeredi-30/+6
This reverts commit bf5ffb5fd8558bd799791834def431c0cee5a11f. Cleanup of mount doesn't work the way it was envisioned, because the kernel doesn't follow mounts on the umount() call, hence it will find a non-mounted directory.
2011-01-31fusermount: only allow mount and umount if util-linux suppports ↵Miklos Szeredi-135/+32
--no-canonicalize Remove "legacy" util-linux support as missing --no-canonicalize cannot be worked around in fuse.
2011-01-31fusermount: chdir to / before performing mount/umountMiklos Szeredi-15/+10
2011-01-31Fix cleanup in case of failed mountMiklos Szeredi-6/+29
In case of failure to add to /etc/mtab use same mountpoint for cleanup as for mounting. Reported by Marc Deslauriers
2010-11-08fusermount: don't save/restore cwdMiklos Szeredi-15/+2
Remove unnecessary restoring of current working directory in "fusermount -u"
2010-11-08update umount procedureMiklos Szeredi-9/+147
If umount(8) supports --fake and --no-canonicalize (util-linux-ng version 2.18 or later), and umount(2) supports the UMOUNT_NOFOLLOW flag (linux kernel version 2.6.35 or later) then, "fusermount -u" will call the umount(2) system call and use "umount --fake ..." to update /etc/mtab Added --disable-legacy-umount option to configure. This disables the runtime checking of umount(8) version. When built with this option then "fusermount -u" will fail if umount(8) doesn't support the --fake and --no-canonicalize options.
2010-09-28Fix option escaping for fusermount.Miklos Szeredi-3/+17
If the "fsname=" option contained a comma then the option parser in fusermount was confused (Novell bugzilla #641480). Fix by escaping commas when passing them over to fusermount. Reported by Jan Engelhardt
generated by cgit v1.2.3 (git 2.39.1) at 2025-10-17 00:30:18 +0000