1 /*
2 * Copyright (c) 2007-2009 Google Inc. and Amit Singh
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions are
7 * met:
8 *
9 * * Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * * Redistributions in binary form must reproduce the above
12 * copyright notice, this list of conditions and the following disclaimer
13 * in the documentation and/or other materials provided with the
14 * distribution.
15 * * Neither the name of Google Inc. nor the names of its
16 * contributors may be used to endorse or promote products derived from
17 * this software without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
22 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
23 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
24 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
25 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
26 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
27 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
29 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30 *
31 * Copyright (C) 2005 Csaba Henk.
32 * All rights reserved.
33 *
34 * Redistribution and use in source and binary forms, with or without
35 * modification, are permitted provided that the following conditions
36 * are met:
37 * 1. Redistributions of source code must retain the above copyright
38 * notice, this list of conditions and the following disclaimer.
39 * 2. Redistributions in binary form must reproduce the above copyright
40 * notice, this list of conditions and the following disclaimer in the
41 * documentation and/or other materials provided with the distribution.
42 *
43 * THIS SOFTWARE IS PROVIDED BY AUTHOR AND CONTRIBUTORS ``AS IS'' AND
44 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
45 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
46 * ARE DISCLAIMED. IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE
47 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
48 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
49 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
50 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
51 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
52 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
53 * SUCH DAMAGE.
54 */
55
56 #include <sys/cdefs.h>
57 __FBSDID("$FreeBSD: releng/10.4/sys/fs/fuse/fuse_vfsops.c 282270 2015-04-30 12:39:24Z rmacklem $");
58
59 #include <sys/types.h>
60 #include <sys/module.h>
61 #include <sys/systm.h>
62 #include <sys/errno.h>
63 #include <sys/param.h>
64 #include <sys/kernel.h>
65 #include <sys/capsicum.h>
66 #include <sys/conf.h>
67 #include <sys/filedesc.h>
68 #include <sys/uio.h>
69 #include <sys/malloc.h>
70 #include <sys/queue.h>
71 #include <sys/lock.h>
72 #include <sys/sx.h>
73 #include <sys/mutex.h>
74 #include <sys/proc.h>
75 #include <sys/vnode.h>
76 #include <sys/namei.h>
77 #include <sys/mount.h>
78 #include <sys/sysctl.h>
79 #include <sys/fcntl.h>
80
81 #include "fuse.h"
82 #include "fuse_param.h"
83 #include "fuse_node.h"
84 #include "fuse_ipc.h"
85 #include "fuse_internal.h"
86
87 #include <sys/priv.h>
88 #include <security/mac/mac_framework.h>
89
90 #define FUSE_DEBUG_MODULE VFSOPS
91 #include "fuse_debug.h"
92
93 /* This will do for privilege types for now */
94 #ifndef PRIV_VFS_FUSE_ALLOWOTHER
95 #define PRIV_VFS_FUSE_ALLOWOTHER PRIV_VFS_MOUNT_NONUSER
96 #endif
97 #ifndef PRIV_VFS_FUSE_MOUNT_NONUSER
98 #define PRIV_VFS_FUSE_MOUNT_NONUSER PRIV_VFS_MOUNT_NONUSER
99 #endif
100 #ifndef PRIV_VFS_FUSE_SYNC_UNMOUNT
101 #define PRIV_VFS_FUSE_SYNC_UNMOUNT PRIV_VFS_MOUNT_NONUSER
102 #endif
103
104 static vfs_mount_t fuse_vfsop_mount;
105 static vfs_unmount_t fuse_vfsop_unmount;
106 static vfs_root_t fuse_vfsop_root;
107 static vfs_statfs_t fuse_vfsop_statfs;
108
109 struct vfsops fuse_vfsops = {
110 .vfs_mount = fuse_vfsop_mount,
111 .vfs_unmount = fuse_vfsop_unmount,
112 .vfs_root = fuse_vfsop_root,
113 .vfs_statfs = fuse_vfsop_statfs,
114 };
115
116 SYSCTL_INT(_vfs_fuse, OID_AUTO, init_backgrounded, CTLFLAG_RD,
117 SYSCTL_NULL_INT_PTR, 1, "indicate async handshake");
118 static int fuse_enforce_dev_perms = 0;
119
120 SYSCTL_INT(_vfs_fuse, OID_AUTO, enforce_dev_perms, CTLFLAG_RW,
121 &fuse_enforce_dev_perms, 0,
122 "enforce fuse device permissions for secondary mounts");
123 static unsigned sync_unmount = 1;
124
125 SYSCTL_UINT(_vfs_fuse, OID_AUTO, sync_unmount, CTLFLAG_RW,
126 &sync_unmount, 0, "specify when to use synchronous unmount");
127
128 MALLOC_DEFINE(M_FUSEVFS, "fuse_filesystem", "buffer for fuse vfs layer");
129
130 static int
131 fuse_getdevice(const char *fspec, struct thread *td, struct cdev **fdevp)
132 {
133 struct nameidata nd, *ndp = &nd;
134 struct vnode *devvp;
135 struct cdev *fdev;
136 int err;
137
138 /*
139 * Not an update, or updating the name: look up the name
140 * and verify that it refers to a sensible disk device.
141 */
142
143 NDINIT(ndp, LOOKUP, FOLLOW, UIO_SYSSPACE, fspec, td);
144 if ((err = namei(ndp)) != 0)
145 return err;
146 NDFREE(ndp, NDF_ONLY_PNBUF);
147 devvp = ndp->ni_vp;
148
149 if (devvp->v_type != VCHR) {
150 vrele(devvp);
151 return ENXIO;
152 }
153 fdev = devvp->v_rdev;
154 dev_ref(fdev);
155
156 if (fuse_enforce_dev_perms) {
157 /*
158 * Check if mounter can open the fuse device.
159 *
160 * This has significance only if we are doing a secondary mount
161 * which doesn't involve actually opening fuse devices, but we
162 * still want to enforce the permissions of the device (in
163 * order to keep control over the circle of fuse users).
164 *
165 * (In case of primary mounts, we are either the superuser so
166 * we can do anything anyway, or we can mount only if the
167 * device is already opened by us, ie. we are permitted to open
168 * the device.)
169 */
170 #if 0
171 #ifdef MAC
172 err = mac_check_vnode_open(td->td_ucred, devvp, VREAD | VWRITE);
173 if (!err)
174 #endif
175 #endif /* 0 */
176 err = VOP_ACCESS(devvp, VREAD | VWRITE, td->td_ucred, td);
177 if (err) {
178 vrele(devvp);
179 dev_rel(fdev);
180 return err;
181 }
182 }
183 /*
184 * according to coda code, no extra lock is needed --
185 * although in sys/vnode.h this field is marked "v"
186 */
187 vrele(devvp);
188
189 if (!fdev->si_devsw ||
190 strcmp("fuse", fdev->si_devsw->d_name)) {
191 dev_rel(fdev);
192 return ENXIO;
193 }
194 *fdevp = fdev;
195
196 return 0;
197 }
198
199 #define FUSE_FLAGOPT(fnam, fval) do { \
200 vfs_flagopt(opts, #fnam, &mntopts, fval); \
201 vfs_flagopt(opts, "__" #fnam, &__mntopts, fval); \
202 } while (0)
203
204 static int
205 fuse_vfsop_mount(struct mount *mp)
206 {
207 int err;
208
209 uint64_t mntopts, __mntopts;
210 int max_read_set;
211 uint32_t max_read;
212 int daemon_timeout;
213 int fd;
214
215 size_t len;
216
217 struct cdev *fdev;
218 struct fuse_data *data;
219 struct thread *td;
220 struct file *fp, *fptmp;
221 char *fspec, *subtype;
222 struct vfsoptlist *opts;
223 cap_rights_t rights;
224
225 subtype = NULL;
226 max_read_set = 0;
227 max_read = ~0;
228 err = 0;
229 mntopts = 0;
230 __mntopts = 0;
231 td = curthread;
232
233 fuse_trace_printf_vfsop();
234
235 if (mp->mnt_flag & MNT_UPDATE)
236 return EOPNOTSUPP;
237
238 MNT_ILOCK(mp);
239 mp->mnt_flag |= MNT_SYNCHRONOUS;
240 mp->mnt_data = NULL;
241 MNT_IUNLOCK(mp);
242 /* Get the new options passed to mount */
243 opts = mp->mnt_optnew;
244
245 if (!opts)
246 return EINVAL;
247
248 /* `fspath' contains the mount point (eg. /mnt/fuse/sshfs); REQUIRED */
249 if (!vfs_getopts(opts, "fspath", &err))
250 return err;
251
252 /* `from' contains the device name (eg. /dev/fuse0); REQUIRED */
253 fspec = vfs_getopts(opts, "from", &err);
254 if (!fspec)
255 return err;
256
257 /* `fd' contains the filedescriptor for this session; REQUIRED */
258 if (vfs_scanopt(opts, "fd", "%d", &fd) != 1)
259 return EINVAL;
260
261 err = fuse_getdevice(fspec, td, &fdev);
262 if (err != 0)
263 return err;
264
265 /*
266 * With the help of underscored options the mount program
267 * can inform us from the flags it sets by default
268 */
269 FUSE_FLAGOPT(allow_other, FSESS_DAEMON_CAN_SPY);
270 FUSE_FLAGOPT(push_symlinks_in, FSESS_PUSH_SYMLINKS_IN);
271 FUSE_FLAGOPT(default_permissions, FSESS_DEFAULT_PERMISSIONS);
272 FUSE_FLAGOPT(no_attrcache, FSESS_NO_ATTRCACHE);
273 FUSE_FLAGOPT(no_readahed, FSESS_NO_READAHEAD);
274 FUSE_FLAGOPT(no_datacache, FSESS_NO_DATACACHE);
275 FUSE_FLAGOPT(no_namecache, FSESS_NO_NAMECACHE);
276 FUSE_FLAGOPT(no_mmap, FSESS_NO_MMAP);
277 FUSE_FLAGOPT(brokenio, FSESS_BROKENIO);
278
279 if (vfs_scanopt(opts, "max_read=", "%u", &max_read) == 1)
280 max_read_set = 1;
281 if (vfs_scanopt(opts, "timeout=", "%u", &daemon_timeout) == 1) {
282 if (daemon_timeout < FUSE_MIN_DAEMON_TIMEOUT)
283 daemon_timeout = FUSE_MIN_DAEMON_TIMEOUT;
284 else if (daemon_timeout > FUSE_MAX_DAEMON_TIMEOUT)
285 daemon_timeout = FUSE_MAX_DAEMON_TIMEOUT;
286 } else {
287 daemon_timeout = FUSE_DEFAULT_DAEMON_TIMEOUT;
288 }
289 subtype = vfs_getopts(opts, "subtype=", &err);
290
291 FS_DEBUG2G("mntopts 0x%jx\n", (uintmax_t)mntopts);
292
293 err = fget(td, fd, cap_rights_init(&rights, CAP_READ), &fp);
294 if (err != 0) {
295 FS_DEBUG("invalid or not opened device: data=%p\n", data);
296 goto out;
297 }
298 fptmp = td->td_fpop;
299 td->td_fpop = fp;
300 err = devfs_get_cdevpriv((void **)&data);
301 td->td_fpop = fptmp;
302 fdrop(fp, td);
303 FUSE_LOCK();
304 if (err != 0 || data == NULL || data->mp != NULL) {
305 FS_DEBUG("invalid or not opened device: data=%p data.mp=%p\n",
306 data, data != NULL ? data->mp : NULL);
307 err = ENXIO;
308 FUSE_UNLOCK();
309 goto out;
310 }
311 if (fdata_get_dead(data)) {
312 FS_DEBUG("device is dead during mount: data=%p\n", data);
313 err = ENOTCONN;
314 FUSE_UNLOCK();
315 goto out;
316 }
317 /* Sanity + permission checks */
318 if (!data->daemoncred)
319 panic("fuse daemon found, but identity unknown");
320 if (mntopts & FSESS_DAEMON_CAN_SPY)
321 err = priv_check(td, PRIV_VFS_FUSE_ALLOWOTHER);
322 if (err == 0 && td->td_ucred->cr_uid != data->daemoncred->cr_uid)
323 /* are we allowed to do the first mount? */
324 err = priv_check(td, PRIV_VFS_FUSE_MOUNT_NONUSER);
325 if (err) {
326 FUSE_UNLOCK();
327 goto out;
328 }
329 data->ref++;
330 data->mp = mp;
331 data->dataflags |= mntopts;
332 data->max_read = max_read;
333 data->daemon_timeout = daemon_timeout;
334 FUSE_UNLOCK();
335
336 vfs_getnewfsid(mp);
337 MNT_ILOCK(mp);
338 mp->mnt_data = data;
339 mp->mnt_flag |= MNT_LOCAL;
340 mp->mnt_kern_flag |= MNTK_USES_BCACHE;
341 MNT_IUNLOCK(mp);
342 /* We need this here as this slot is used by getnewvnode() */
343 mp->mnt_stat.f_iosize = PAGE_SIZE;
344 if (subtype) {
345 strlcat(mp->mnt_stat.f_fstypename, ".", MFSNAMELEN);
346 strlcat(mp->mnt_stat.f_fstypename, subtype, MFSNAMELEN);
347 }
348 copystr(fspec, mp->mnt_stat.f_mntfromname, MNAMELEN - 1, &len);
349 bzero(mp->mnt_stat.f_mntfromname + len, MNAMELEN - len);
350 FS_DEBUG2G("mp %p: %s\n", mp, mp->mnt_stat.f_mntfromname);
351
352 /* Now handshaking with daemon */
353 fuse_internal_send_init(data, td);
354
355 out:
356 if (err) {
357 FUSE_LOCK();
358 if (data->mp == mp) {
359 /*
360 * Destroy device only if we acquired reference to
361 * it
362 */
363 FS_DEBUG("mount failed, destroy device: data=%p mp=%p"
364 " err=%d\n",
365 data, mp, err);
366 data->mp = NULL;
367 fdata_trydestroy(data);
368 }
369 FUSE_UNLOCK();
370 dev_rel(fdev);
371 }
372 return err;
373 }
374
375 static int
376 fuse_vfsop_unmount(struct mount *mp, int mntflags)
377 {
378 int err = 0;
379 int flags = 0;
380
381 struct cdev *fdev;
382 struct fuse_data *data;
383 struct fuse_dispatcher fdi;
384 struct thread *td = curthread;
385
386 fuse_trace_printf_vfsop();
387
388 if (mntflags & MNT_FORCE) {
389 flags |= FORCECLOSE;
390 }
391 data = fuse_get_mpdata(mp);
392 if (!data) {
393 panic("no private data for mount point?");
394 }
395 /* There is 1 extra root vnode reference (mp->mnt_data). */
396 FUSE_LOCK();
397 if (data->vroot != NULL) {
398 struct vnode *vroot = data->vroot;
399
400 data->vroot = NULL;
401 FUSE_UNLOCK();
402 vrele(vroot);
403 } else
404 FUSE_UNLOCK();
405 err = vflush(mp, 0, flags, td);
406 if (err) {
407 debug_printf("vflush failed");
408 return err;
409 }
410 if (fdata_get_dead(data)) {
411 goto alreadydead;
412 }
413 fdisp_init(&fdi, 0);
414 fdisp_make(&fdi, FUSE_DESTROY, mp, 0, td, NULL);
415
416 err = fdisp_wait_answ(&fdi);
417 fdisp_destroy(&fdi);
418
419 fdata_set_dead(data);
420
421 alreadydead:
422 FUSE_LOCK();
423 data->mp = NULL;
424 fdev = data->fdev;
425 fdata_trydestroy(data);
426 FUSE_UNLOCK();
427
428 MNT_ILOCK(mp);
429 mp->mnt_data = NULL;
430 mp->mnt_flag &= ~MNT_LOCAL;
431 MNT_IUNLOCK(mp);
432
433 dev_rel(fdev);
434
435 return 0;
436 }
437
438 static int
439 fuse_vfsop_root(struct mount *mp, int lkflags, struct vnode **vpp)
440 {
441 struct fuse_data *data = fuse_get_mpdata(mp);
442 int err = 0;
443
444 if (data->vroot != NULL) {
445 err = vget(data->vroot, lkflags, curthread);
446 if (err == 0)
447 *vpp = data->vroot;
448 } else {
449 err = fuse_vnode_get(mp, FUSE_ROOT_ID, NULL, vpp, NULL, VDIR);
450 if (err == 0) {
451 FUSE_LOCK();
452 MPASS(data->vroot == NULL || data->vroot == *vpp);
453 if (data->vroot == NULL) {
454 FS_DEBUG("new root vnode\n");
455 data->vroot = *vpp;
456 FUSE_UNLOCK();
457 vref(*vpp);
458 } else if (data->vroot != *vpp) {
459 FS_DEBUG("root vnode race\n");
460 FUSE_UNLOCK();
461 VOP_UNLOCK(*vpp, 0);
462 vrele(*vpp);
463 vrecycle(*vpp);
464 *vpp = data->vroot;
465 } else
466 FUSE_UNLOCK();
467 }
468 }
469 return err;
470 }
471
472 static int
473 fuse_vfsop_statfs(struct mount *mp, struct statfs *sbp)
474 {
475 struct fuse_dispatcher fdi;
476 int err = 0;
477
478 struct fuse_statfs_out *fsfo;
479 struct fuse_data *data;
480
481 FS_DEBUG2G("mp %p: %s\n", mp, mp->mnt_stat.f_mntfromname);
482 data = fuse_get_mpdata(mp);
483
484 if (!(data->dataflags & FSESS_INITED))
485 goto fake;
486
487 fdisp_init(&fdi, 0);
488 fdisp_make(&fdi, FUSE_STATFS, mp, FUSE_ROOT_ID, NULL, NULL);
489 err = fdisp_wait_answ(&fdi);
490 if (err) {
491 fdisp_destroy(&fdi);
492 if (err == ENOTCONN) {
493 /*
494 * We want to seem a legitimate fs even if the daemon
495 * is stiff dead... (so that, eg., we can still do path
496 * based unmounting after the daemon dies).
497 */
498 goto fake;
499 }
500 return err;
501 }
502 fsfo = fdi.answ;
503
504 sbp->f_blocks = fsfo->st.blocks;
505 sbp->f_bfree = fsfo->st.bfree;
506 sbp->f_bavail = fsfo->st.bavail;
507 sbp->f_files = fsfo->st.files;
508 sbp->f_ffree = fsfo->st.ffree; /* cast from uint64_t to int64_t */
509 sbp->f_namemax = fsfo->st.namelen;
510 sbp->f_bsize = fsfo->st.frsize; /* cast from uint32_t to uint64_t */
511
512 FS_DEBUG("fuse_statfs_out -- blocks: %llu, bfree: %llu, bavail: %llu, "
513 "fil es: %llu, ffree: %llu, bsize: %i, namelen: %i\n",
514 (unsigned long long)fsfo->st.blocks,
515 (unsigned long long)fsfo->st.bfree,
516 (unsigned long long)fsfo->st.bavail,
517 (unsigned long long)fsfo->st.files,
518 (unsigned long long)fsfo->st.ffree, fsfo->st.bsize,
519 fsfo->st.namelen);
520
521 fdisp_destroy(&fdi);
522 return 0;
523
524 fake:
525 sbp->f_blocks = 0;
526 sbp->f_bfree = 0;
527 sbp->f_bavail = 0;
528 sbp->f_files = 0;
529 sbp->f_ffree = 0;
530 sbp->f_namemax = 0;
531 sbp->f_bsize = FUSE_DEFAULT_BLOCKSIZE;
532
533 return 0;
534 }
Cache object: 99add67e40d1a02e5f77b6a2403900b1
|