1/*
2 * Copyright (c) 2007-2009 Google Inc. and Amit Singh
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions are
7 * met:
8 *
9 * * Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * * Redistributions in binary form must reproduce the above
12 * copyright notice, this list of conditions and the following disclaimer
13 * in the documentation and/or other materials provided with the
14 * distribution.
15 * * Neither the name of Google Inc. nor the names of its
16 * contributors may be used to endorse or promote products derived from
17 * this software without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
22 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
23 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
24 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
25 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
26 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
27 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
29 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30 *
31 * Copyright (C) 2005 Csaba Henk.
32 * All rights reserved.
33 *
34 * Redistribution and use in source and binary forms, with or without
35 * modification, are permitted provided that the following conditions
36 * are met:
37 * 1. Redistributions of source code must retain the above copyright
38 * notice, this list of conditions and the following disclaimer.
39 * 2. Redistributions in binary form must reproduce the above copyright
40 * notice, this list of conditions and the following disclaimer in the
41 * documentation and/or other materials provided with the distribution.
42 *
43 * THIS SOFTWARE IS PROVIDED BY AUTHOR AND CONTRIBUTORS ``AS IS'' AND
44 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
45 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
46 * ARE DISCLAIMED. IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE
47 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
48 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
49 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
50 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
51 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
52 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
53 * SUCH DAMAGE.
54 */
55
56#include <sys/cdefs.h>
| 1/*
2 * Copyright (c) 2007-2009 Google Inc. and Amit Singh
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions are
7 * met:
8 *
9 * * Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * * Redistributions in binary form must reproduce the above
12 * copyright notice, this list of conditions and the following disclaimer
13 * in the documentation and/or other materials provided with the
14 * distribution.
15 * * Neither the name of Google Inc. nor the names of its
16 * contributors may be used to endorse or promote products derived from
17 * this software without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
22 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
23 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
24 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
25 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
26 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
27 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
29 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30 *
31 * Copyright (C) 2005 Csaba Henk.
32 * All rights reserved.
33 *
34 * Redistribution and use in source and binary forms, with or without
35 * modification, are permitted provided that the following conditions
36 * are met:
37 * 1. Redistributions of source code must retain the above copyright
38 * notice, this list of conditions and the following disclaimer.
39 * 2. Redistributions in binary form must reproduce the above copyright
40 * notice, this list of conditions and the following disclaimer in the
41 * documentation and/or other materials provided with the distribution.
42 *
43 * THIS SOFTWARE IS PROVIDED BY AUTHOR AND CONTRIBUTORS ``AS IS'' AND
44 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
45 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
46 * ARE DISCLAIMED. IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE
47 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
48 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
49 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
50 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
51 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
52 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
53 * SUCH DAMAGE.
54 */
55
56#include <sys/cdefs.h>
|
66#include <sys/conf.h>
67#include <sys/filedesc.h>
68#include <sys/uio.h>
69#include <sys/malloc.h>
70#include <sys/queue.h>
71#include <sys/lock.h>
72#include <sys/sx.h>
73#include <sys/mutex.h>
74#include <sys/proc.h>
75#include <sys/vnode.h>
76#include <sys/namei.h>
77#include <sys/mount.h>
78#include <sys/sysctl.h>
79#include <sys/fcntl.h>
80
81#include "fuse.h"
82#include "fuse_param.h"
83#include "fuse_node.h"
84#include "fuse_ipc.h"
85#include "fuse_internal.h"
86
87#include <sys/priv.h>
88#include <security/mac/mac_framework.h>
89
90#define FUSE_DEBUG_MODULE VFSOPS
91#include "fuse_debug.h"
92
93/* This will do for privilege types for now */
94#ifndef PRIV_VFS_FUSE_ALLOWOTHER
95#define PRIV_VFS_FUSE_ALLOWOTHER PRIV_VFS_MOUNT_NONUSER
96#endif
97#ifndef PRIV_VFS_FUSE_MOUNT_NONUSER
98#define PRIV_VFS_FUSE_MOUNT_NONUSER PRIV_VFS_MOUNT_NONUSER
99#endif
100#ifndef PRIV_VFS_FUSE_SYNC_UNMOUNT
101#define PRIV_VFS_FUSE_SYNC_UNMOUNT PRIV_VFS_MOUNT_NONUSER
102#endif
103
104static vfs_mount_t fuse_vfsop_mount;
105static vfs_unmount_t fuse_vfsop_unmount;
106static vfs_root_t fuse_vfsop_root;
107static vfs_statfs_t fuse_vfsop_statfs;
108
109struct vfsops fuse_vfsops = {
110 .vfs_mount = fuse_vfsop_mount,
111 .vfs_unmount = fuse_vfsop_unmount,
112 .vfs_root = fuse_vfsop_root,
113 .vfs_statfs = fuse_vfsop_statfs,
114};
115
116SYSCTL_INT(_vfs_fuse, OID_AUTO, init_backgrounded, CTLFLAG_RD,
117 SYSCTL_NULL_INT_PTR, 1, "indicate async handshake");
118static int fuse_enforce_dev_perms = 0;
119
120SYSCTL_INT(_vfs_fuse, OID_AUTO, enforce_dev_perms, CTLFLAG_RW,
121 &fuse_enforce_dev_perms, 0,
122 "enforce fuse device permissions for secondary mounts");
123static unsigned sync_unmount = 1;
124
125SYSCTL_UINT(_vfs_fuse, OID_AUTO, sync_unmount, CTLFLAG_RW,
126 &sync_unmount, 0, "specify when to use synchronous unmount");
127
128MALLOC_DEFINE(M_FUSEVFS, "fuse_filesystem", "buffer for fuse vfs layer");
129
130static int
131fuse_getdevice(const char *fspec, struct thread *td, struct cdev **fdevp)
132{
133 struct nameidata nd, *ndp = &nd;
134 struct vnode *devvp;
135 struct cdev *fdev;
136 int err;
137
138 /*
139 * Not an update, or updating the name: look up the name
140 * and verify that it refers to a sensible disk device.
141 */
142
143 NDINIT(ndp, LOOKUP, FOLLOW, UIO_SYSSPACE, fspec, td);
144 if ((err = namei(ndp)) != 0)
145 return err;
146 NDFREE(ndp, NDF_ONLY_PNBUF);
147 devvp = ndp->ni_vp;
148
149 if (devvp->v_type != VCHR) {
150 vrele(devvp);
151 return ENXIO;
152 }
153 fdev = devvp->v_rdev;
154 dev_ref(fdev);
155
156 if (fuse_enforce_dev_perms) {
157 /*
158 * Check if mounter can open the fuse device.
159 *
160 * This has significance only if we are doing a secondary mount
161 * which doesn't involve actually opening fuse devices, but we
162 * still want to enforce the permissions of the device (in
163 * order to keep control over the circle of fuse users).
164 *
165 * (In case of primary mounts, we are either the superuser so
166 * we can do anything anyway, or we can mount only if the
167 * device is already opened by us, ie. we are permitted to open
168 * the device.)
169 */
170#if 0
171#ifdef MAC
172 err = mac_check_vnode_open(td->td_ucred, devvp, VREAD | VWRITE);
173 if (!err)
174#endif
175#endif /* 0 */
176 err = VOP_ACCESS(devvp, VREAD | VWRITE, td->td_ucred, td);
177 if (err) {
178 vrele(devvp);
179 dev_rel(fdev);
180 return err;
181 }
182 }
183 /*
184 * according to coda code, no extra lock is needed --
185 * although in sys/vnode.h this field is marked "v"
186 */
187 vrele(devvp);
188
189 if (!fdev->si_devsw ||
190 strcmp("fuse", fdev->si_devsw->d_name)) {
191 dev_rel(fdev);
192 return ENXIO;
193 }
194 *fdevp = fdev;
195
196 return 0;
197}
198
199#define FUSE_FLAGOPT(fnam, fval) do { \
200 vfs_flagopt(opts, #fnam, &mntopts, fval); \
201 vfs_flagopt(opts, "__" #fnam, &__mntopts, fval); \
202} while (0)
203
204static int
205fuse_vfsop_mount(struct mount *mp)
206{
207 int err;
208
209 uint64_t mntopts, __mntopts;
210 int max_read_set;
211 uint32_t max_read;
212 int daemon_timeout;
213 int fd;
214
215 size_t len;
216
217 struct cdev *fdev;
218 struct fuse_data *data;
219 struct thread *td;
220 struct file *fp, *fptmp;
221 char *fspec, *subtype;
222 struct vfsoptlist *opts;
223 cap_rights_t rights;
224
225 subtype = NULL;
226 max_read_set = 0;
227 max_read = ~0;
228 err = 0;
229 mntopts = 0;
230 __mntopts = 0;
231 td = curthread;
232
233 fuse_trace_printf_vfsop();
234
235 if (mp->mnt_flag & MNT_UPDATE)
236 return EOPNOTSUPP;
237
238 MNT_ILOCK(mp);
239 mp->mnt_flag |= MNT_SYNCHRONOUS;
240 mp->mnt_data = NULL;
241 MNT_IUNLOCK(mp);
242 /* Get the new options passed to mount */
243 opts = mp->mnt_optnew;
244
245 if (!opts)
246 return EINVAL;
247
248 /* `fspath' contains the mount point (eg. /mnt/fuse/sshfs); REQUIRED */
249 if (!vfs_getopts(opts, "fspath", &err))
250 return err;
251
252 /* `from' contains the device name (eg. /dev/fuse0); REQUIRED */
253 fspec = vfs_getopts(opts, "from", &err);
254 if (!fspec)
255 return err;
256
257 /* `fd' contains the filedescriptor for this session; REQUIRED */
258 if (vfs_scanopt(opts, "fd", "%d", &fd) != 1)
259 return EINVAL;
260
261 err = fuse_getdevice(fspec, td, &fdev);
262 if (err != 0)
263 return err;
264
265 /*
266 * With the help of underscored options the mount program
267 * can inform us from the flags it sets by default
268 */
269 FUSE_FLAGOPT(allow_other, FSESS_DAEMON_CAN_SPY);
270 FUSE_FLAGOPT(push_symlinks_in, FSESS_PUSH_SYMLINKS_IN);
271 FUSE_FLAGOPT(default_permissions, FSESS_DEFAULT_PERMISSIONS);
272 FUSE_FLAGOPT(no_attrcache, FSESS_NO_ATTRCACHE);
273 FUSE_FLAGOPT(no_readahed, FSESS_NO_READAHEAD);
274 FUSE_FLAGOPT(no_datacache, FSESS_NO_DATACACHE);
275 FUSE_FLAGOPT(no_namecache, FSESS_NO_NAMECACHE);
276 FUSE_FLAGOPT(no_mmap, FSESS_NO_MMAP);
277 FUSE_FLAGOPT(brokenio, FSESS_BROKENIO);
278
279 if (vfs_scanopt(opts, "max_read=", "%u", &max_read) == 1)
280 max_read_set = 1;
281 if (vfs_scanopt(opts, "timeout=", "%u", &daemon_timeout) == 1) {
282 if (daemon_timeout < FUSE_MIN_DAEMON_TIMEOUT)
283 daemon_timeout = FUSE_MIN_DAEMON_TIMEOUT;
284 else if (daemon_timeout > FUSE_MAX_DAEMON_TIMEOUT)
285 daemon_timeout = FUSE_MAX_DAEMON_TIMEOUT;
286 } else {
287 daemon_timeout = FUSE_DEFAULT_DAEMON_TIMEOUT;
288 }
289 subtype = vfs_getopts(opts, "subtype=", &err);
290
291 FS_DEBUG2G("mntopts 0x%jx\n", (uintmax_t)mntopts);
292
293 err = fget(td, fd, cap_rights_init(&rights, CAP_READ), &fp);
294 if (err != 0) {
295 FS_DEBUG("invalid or not opened device: data=%p\n", data);
296 goto out;
297 }
298 fptmp = td->td_fpop;
299 td->td_fpop = fp;
300 err = devfs_get_cdevpriv((void **)&data);
301 td->td_fpop = fptmp;
302 fdrop(fp, td);
303 FUSE_LOCK();
304 if (err != 0 || data == NULL || data->mp != NULL) {
305 FS_DEBUG("invalid or not opened device: data=%p data.mp=%p\n",
306 data, data != NULL ? data->mp : NULL);
307 err = ENXIO;
308 FUSE_UNLOCK();
309 goto out;
310 }
311 if (fdata_get_dead(data)) {
312 FS_DEBUG("device is dead during mount: data=%p\n", data);
313 err = ENOTCONN;
314 FUSE_UNLOCK();
315 goto out;
316 }
317 /* Sanity + permission checks */
318 if (!data->daemoncred)
319 panic("fuse daemon found, but identity unknown");
320 if (mntopts & FSESS_DAEMON_CAN_SPY)
321 err = priv_check(td, PRIV_VFS_FUSE_ALLOWOTHER);
322 if (err == 0 && td->td_ucred->cr_uid != data->daemoncred->cr_uid)
323 /* are we allowed to do the first mount? */
324 err = priv_check(td, PRIV_VFS_FUSE_MOUNT_NONUSER);
325 if (err) {
326 FUSE_UNLOCK();
327 goto out;
328 }
329 data->ref++;
330 data->mp = mp;
331 data->dataflags |= mntopts;
332 data->max_read = max_read;
333 data->daemon_timeout = daemon_timeout;
334 FUSE_UNLOCK();
335
336 vfs_getnewfsid(mp);
337 MNT_ILOCK(mp);
338 mp->mnt_data = data;
339 mp->mnt_flag |= MNT_LOCAL;
340 MNT_IUNLOCK(mp);
341 /* We need this here as this slot is used by getnewvnode() */
342 mp->mnt_stat.f_iosize = PAGE_SIZE;
343 if (subtype) {
344 strlcat(mp->mnt_stat.f_fstypename, ".", MFSNAMELEN);
345 strlcat(mp->mnt_stat.f_fstypename, subtype, MFSNAMELEN);
346 }
347 copystr(fspec, mp->mnt_stat.f_mntfromname, MNAMELEN - 1, &len);
348 bzero(mp->mnt_stat.f_mntfromname + len, MNAMELEN - len);
349 FS_DEBUG2G("mp %p: %s\n", mp, mp->mnt_stat.f_mntfromname);
350
351 /* Now handshaking with daemon */
352 fuse_internal_send_init(data, td);
353
354out:
355 if (err) {
356 FUSE_LOCK();
357 if (data->mp == mp) {
358 /*
359 * Destroy device only if we acquired reference to
360 * it
361 */
362 FS_DEBUG("mount failed, destroy device: data=%p mp=%p"
363 " err=%d\n",
364 data, mp, err);
365 data->mp = NULL;
366 fdata_trydestroy(data);
367 }
368 FUSE_UNLOCK();
369 dev_rel(fdev);
370 }
371 return err;
372}
373
374static int
375fuse_vfsop_unmount(struct mount *mp, int mntflags)
376{
377 int err = 0;
378 int flags = 0;
379
380 struct cdev *fdev;
381 struct fuse_data *data;
382 struct fuse_dispatcher fdi;
383 struct thread *td = curthread;
384
385 fuse_trace_printf_vfsop();
386
387 if (mntflags & MNT_FORCE) {
388 flags |= FORCECLOSE;
389 }
390 data = fuse_get_mpdata(mp);
391 if (!data) {
392 panic("no private data for mount point?");
393 }
394 /* There is 1 extra root vnode reference (mp->mnt_data). */
395 FUSE_LOCK();
396 if (data->vroot != NULL) {
397 struct vnode *vroot = data->vroot;
398
399 data->vroot = NULL;
400 FUSE_UNLOCK();
401 vrele(vroot);
402 } else
403 FUSE_UNLOCK();
404 err = vflush(mp, 0, flags, td);
405 if (err) {
406 debug_printf("vflush failed");
407 return err;
408 }
409 if (fdata_get_dead(data)) {
410 goto alreadydead;
411 }
412 fdisp_init(&fdi, 0);
413 fdisp_make(&fdi, FUSE_DESTROY, mp, 0, td, NULL);
414
415 err = fdisp_wait_answ(&fdi);
416 fdisp_destroy(&fdi);
417
418 fdata_set_dead(data);
419
420alreadydead:
421 FUSE_LOCK();
422 data->mp = NULL;
423 fdev = data->fdev;
424 fdata_trydestroy(data);
425 FUSE_UNLOCK();
426
427 MNT_ILOCK(mp);
428 mp->mnt_data = NULL;
429 mp->mnt_flag &= ~MNT_LOCAL;
430 MNT_IUNLOCK(mp);
431
432 dev_rel(fdev);
433
434 return 0;
435}
436
437static int
438fuse_vfsop_root(struct mount *mp, int lkflags, struct vnode **vpp)
439{
440 struct fuse_data *data = fuse_get_mpdata(mp);
441 int err = 0;
442
443 if (data->vroot != NULL) {
444 err = vget(data->vroot, lkflags, curthread);
445 if (err == 0)
446 *vpp = data->vroot;
447 } else {
448 err = fuse_vnode_get(mp, FUSE_ROOT_ID, NULL, vpp, NULL, VDIR);
449 if (err == 0) {
450 FUSE_LOCK();
451 MPASS(data->vroot == NULL || data->vroot == *vpp);
452 if (data->vroot == NULL) {
453 FS_DEBUG("new root vnode\n");
454 data->vroot = *vpp;
455 FUSE_UNLOCK();
456 vref(*vpp);
457 } else if (data->vroot != *vpp) {
458 FS_DEBUG("root vnode race\n");
459 FUSE_UNLOCK();
460 VOP_UNLOCK(*vpp, 0);
461 vrele(*vpp);
462 vrecycle(*vpp);
463 *vpp = data->vroot;
464 } else
465 FUSE_UNLOCK();
466 }
467 }
468 return err;
469}
470
471static int
472fuse_vfsop_statfs(struct mount *mp, struct statfs *sbp)
473{
474 struct fuse_dispatcher fdi;
475 int err = 0;
476
477 struct fuse_statfs_out *fsfo;
478 struct fuse_data *data;
479
480 FS_DEBUG2G("mp %p: %s\n", mp, mp->mnt_stat.f_mntfromname);
481 data = fuse_get_mpdata(mp);
482
483 if (!(data->dataflags & FSESS_INITED))
484 goto fake;
485
486 fdisp_init(&fdi, 0);
487 fdisp_make(&fdi, FUSE_STATFS, mp, FUSE_ROOT_ID, NULL, NULL);
488 err = fdisp_wait_answ(&fdi);
489 if (err) {
490 fdisp_destroy(&fdi);
491 if (err == ENOTCONN) {
492 /*
493 * We want to seem a legitimate fs even if the daemon
494 * is stiff dead... (so that, eg., we can still do path
495 * based unmounting after the daemon dies).
496 */
497 goto fake;
498 }
499 return err;
500 }
501 fsfo = fdi.answ;
502
503 sbp->f_blocks = fsfo->st.blocks;
504 sbp->f_bfree = fsfo->st.bfree;
505 sbp->f_bavail = fsfo->st.bavail;
506 sbp->f_files = fsfo->st.files;
507 sbp->f_ffree = fsfo->st.ffree; /* cast from uint64_t to int64_t */
508 sbp->f_namemax = fsfo->st.namelen;
509 sbp->f_bsize = fsfo->st.frsize; /* cast from uint32_t to uint64_t */
510
511 FS_DEBUG("fuse_statfs_out -- blocks: %llu, bfree: %llu, bavail: %llu, "
512 "fil es: %llu, ffree: %llu, bsize: %i, namelen: %i\n",
513 (unsigned long long)fsfo->st.blocks,
514 (unsigned long long)fsfo->st.bfree,
515 (unsigned long long)fsfo->st.bavail,
516 (unsigned long long)fsfo->st.files,
517 (unsigned long long)fsfo->st.ffree, fsfo->st.bsize,
518 fsfo->st.namelen);
519
520 fdisp_destroy(&fdi);
521 return 0;
522
523fake:
524 sbp->f_blocks = 0;
525 sbp->f_bfree = 0;
526 sbp->f_bavail = 0;
527 sbp->f_files = 0;
528 sbp->f_ffree = 0;
529 sbp->f_namemax = 0;
530 sbp->f_bsize = FUSE_DEFAULT_BLOCKSIZE;
531
532 return 0;
533}
| 66#include <sys/conf.h>
67#include <sys/filedesc.h>
68#include <sys/uio.h>
69#include <sys/malloc.h>
70#include <sys/queue.h>
71#include <sys/lock.h>
72#include <sys/sx.h>
73#include <sys/mutex.h>
74#include <sys/proc.h>
75#include <sys/vnode.h>
76#include <sys/namei.h>
77#include <sys/mount.h>
78#include <sys/sysctl.h>
79#include <sys/fcntl.h>
80
81#include "fuse.h"
82#include "fuse_param.h"
83#include "fuse_node.h"
84#include "fuse_ipc.h"
85#include "fuse_internal.h"
86
87#include <sys/priv.h>
88#include <security/mac/mac_framework.h>
89
90#define FUSE_DEBUG_MODULE VFSOPS
91#include "fuse_debug.h"
92
93/* This will do for privilege types for now */
94#ifndef PRIV_VFS_FUSE_ALLOWOTHER
95#define PRIV_VFS_FUSE_ALLOWOTHER PRIV_VFS_MOUNT_NONUSER
96#endif
97#ifndef PRIV_VFS_FUSE_MOUNT_NONUSER
98#define PRIV_VFS_FUSE_MOUNT_NONUSER PRIV_VFS_MOUNT_NONUSER
99#endif
100#ifndef PRIV_VFS_FUSE_SYNC_UNMOUNT
101#define PRIV_VFS_FUSE_SYNC_UNMOUNT PRIV_VFS_MOUNT_NONUSER
102#endif
103
104static vfs_mount_t fuse_vfsop_mount;
105static vfs_unmount_t fuse_vfsop_unmount;
106static vfs_root_t fuse_vfsop_root;
107static vfs_statfs_t fuse_vfsop_statfs;
108
109struct vfsops fuse_vfsops = {
110 .vfs_mount = fuse_vfsop_mount,
111 .vfs_unmount = fuse_vfsop_unmount,
112 .vfs_root = fuse_vfsop_root,
113 .vfs_statfs = fuse_vfsop_statfs,
114};
115
116SYSCTL_INT(_vfs_fuse, OID_AUTO, init_backgrounded, CTLFLAG_RD,
117 SYSCTL_NULL_INT_PTR, 1, "indicate async handshake");
118static int fuse_enforce_dev_perms = 0;
119
120SYSCTL_INT(_vfs_fuse, OID_AUTO, enforce_dev_perms, CTLFLAG_RW,
121 &fuse_enforce_dev_perms, 0,
122 "enforce fuse device permissions for secondary mounts");
123static unsigned sync_unmount = 1;
124
125SYSCTL_UINT(_vfs_fuse, OID_AUTO, sync_unmount, CTLFLAG_RW,
126 &sync_unmount, 0, "specify when to use synchronous unmount");
127
128MALLOC_DEFINE(M_FUSEVFS, "fuse_filesystem", "buffer for fuse vfs layer");
129
130static int
131fuse_getdevice(const char *fspec, struct thread *td, struct cdev **fdevp)
132{
133 struct nameidata nd, *ndp = &nd;
134 struct vnode *devvp;
135 struct cdev *fdev;
136 int err;
137
138 /*
139 * Not an update, or updating the name: look up the name
140 * and verify that it refers to a sensible disk device.
141 */
142
143 NDINIT(ndp, LOOKUP, FOLLOW, UIO_SYSSPACE, fspec, td);
144 if ((err = namei(ndp)) != 0)
145 return err;
146 NDFREE(ndp, NDF_ONLY_PNBUF);
147 devvp = ndp->ni_vp;
148
149 if (devvp->v_type != VCHR) {
150 vrele(devvp);
151 return ENXIO;
152 }
153 fdev = devvp->v_rdev;
154 dev_ref(fdev);
155
156 if (fuse_enforce_dev_perms) {
157 /*
158 * Check if mounter can open the fuse device.
159 *
160 * This has significance only if we are doing a secondary mount
161 * which doesn't involve actually opening fuse devices, but we
162 * still want to enforce the permissions of the device (in
163 * order to keep control over the circle of fuse users).
164 *
165 * (In case of primary mounts, we are either the superuser so
166 * we can do anything anyway, or we can mount only if the
167 * device is already opened by us, ie. we are permitted to open
168 * the device.)
169 */
170#if 0
171#ifdef MAC
172 err = mac_check_vnode_open(td->td_ucred, devvp, VREAD | VWRITE);
173 if (!err)
174#endif
175#endif /* 0 */
176 err = VOP_ACCESS(devvp, VREAD | VWRITE, td->td_ucred, td);
177 if (err) {
178 vrele(devvp);
179 dev_rel(fdev);
180 return err;
181 }
182 }
183 /*
184 * according to coda code, no extra lock is needed --
185 * although in sys/vnode.h this field is marked "v"
186 */
187 vrele(devvp);
188
189 if (!fdev->si_devsw ||
190 strcmp("fuse", fdev->si_devsw->d_name)) {
191 dev_rel(fdev);
192 return ENXIO;
193 }
194 *fdevp = fdev;
195
196 return 0;
197}
198
199#define FUSE_FLAGOPT(fnam, fval) do { \
200 vfs_flagopt(opts, #fnam, &mntopts, fval); \
201 vfs_flagopt(opts, "__" #fnam, &__mntopts, fval); \
202} while (0)
203
204static int
205fuse_vfsop_mount(struct mount *mp)
206{
207 int err;
208
209 uint64_t mntopts, __mntopts;
210 int max_read_set;
211 uint32_t max_read;
212 int daemon_timeout;
213 int fd;
214
215 size_t len;
216
217 struct cdev *fdev;
218 struct fuse_data *data;
219 struct thread *td;
220 struct file *fp, *fptmp;
221 char *fspec, *subtype;
222 struct vfsoptlist *opts;
223 cap_rights_t rights;
224
225 subtype = NULL;
226 max_read_set = 0;
227 max_read = ~0;
228 err = 0;
229 mntopts = 0;
230 __mntopts = 0;
231 td = curthread;
232
233 fuse_trace_printf_vfsop();
234
235 if (mp->mnt_flag & MNT_UPDATE)
236 return EOPNOTSUPP;
237
238 MNT_ILOCK(mp);
239 mp->mnt_flag |= MNT_SYNCHRONOUS;
240 mp->mnt_data = NULL;
241 MNT_IUNLOCK(mp);
242 /* Get the new options passed to mount */
243 opts = mp->mnt_optnew;
244
245 if (!opts)
246 return EINVAL;
247
248 /* `fspath' contains the mount point (eg. /mnt/fuse/sshfs); REQUIRED */
249 if (!vfs_getopts(opts, "fspath", &err))
250 return err;
251
252 /* `from' contains the device name (eg. /dev/fuse0); REQUIRED */
253 fspec = vfs_getopts(opts, "from", &err);
254 if (!fspec)
255 return err;
256
257 /* `fd' contains the filedescriptor for this session; REQUIRED */
258 if (vfs_scanopt(opts, "fd", "%d", &fd) != 1)
259 return EINVAL;
260
261 err = fuse_getdevice(fspec, td, &fdev);
262 if (err != 0)
263 return err;
264
265 /*
266 * With the help of underscored options the mount program
267 * can inform us from the flags it sets by default
268 */
269 FUSE_FLAGOPT(allow_other, FSESS_DAEMON_CAN_SPY);
270 FUSE_FLAGOPT(push_symlinks_in, FSESS_PUSH_SYMLINKS_IN);
271 FUSE_FLAGOPT(default_permissions, FSESS_DEFAULT_PERMISSIONS);
272 FUSE_FLAGOPT(no_attrcache, FSESS_NO_ATTRCACHE);
273 FUSE_FLAGOPT(no_readahed, FSESS_NO_READAHEAD);
274 FUSE_FLAGOPT(no_datacache, FSESS_NO_DATACACHE);
275 FUSE_FLAGOPT(no_namecache, FSESS_NO_NAMECACHE);
276 FUSE_FLAGOPT(no_mmap, FSESS_NO_MMAP);
277 FUSE_FLAGOPT(brokenio, FSESS_BROKENIO);
278
279 if (vfs_scanopt(opts, "max_read=", "%u", &max_read) == 1)
280 max_read_set = 1;
281 if (vfs_scanopt(opts, "timeout=", "%u", &daemon_timeout) == 1) {
282 if (daemon_timeout < FUSE_MIN_DAEMON_TIMEOUT)
283 daemon_timeout = FUSE_MIN_DAEMON_TIMEOUT;
284 else if (daemon_timeout > FUSE_MAX_DAEMON_TIMEOUT)
285 daemon_timeout = FUSE_MAX_DAEMON_TIMEOUT;
286 } else {
287 daemon_timeout = FUSE_DEFAULT_DAEMON_TIMEOUT;
288 }
289 subtype = vfs_getopts(opts, "subtype=", &err);
290
291 FS_DEBUG2G("mntopts 0x%jx\n", (uintmax_t)mntopts);
292
293 err = fget(td, fd, cap_rights_init(&rights, CAP_READ), &fp);
294 if (err != 0) {
295 FS_DEBUG("invalid or not opened device: data=%p\n", data);
296 goto out;
297 }
298 fptmp = td->td_fpop;
299 td->td_fpop = fp;
300 err = devfs_get_cdevpriv((void **)&data);
301 td->td_fpop = fptmp;
302 fdrop(fp, td);
303 FUSE_LOCK();
304 if (err != 0 || data == NULL || data->mp != NULL) {
305 FS_DEBUG("invalid or not opened device: data=%p data.mp=%p\n",
306 data, data != NULL ? data->mp : NULL);
307 err = ENXIO;
308 FUSE_UNLOCK();
309 goto out;
310 }
311 if (fdata_get_dead(data)) {
312 FS_DEBUG("device is dead during mount: data=%p\n", data);
313 err = ENOTCONN;
314 FUSE_UNLOCK();
315 goto out;
316 }
317 /* Sanity + permission checks */
318 if (!data->daemoncred)
319 panic("fuse daemon found, but identity unknown");
320 if (mntopts & FSESS_DAEMON_CAN_SPY)
321 err = priv_check(td, PRIV_VFS_FUSE_ALLOWOTHER);
322 if (err == 0 && td->td_ucred->cr_uid != data->daemoncred->cr_uid)
323 /* are we allowed to do the first mount? */
324 err = priv_check(td, PRIV_VFS_FUSE_MOUNT_NONUSER);
325 if (err) {
326 FUSE_UNLOCK();
327 goto out;
328 }
329 data->ref++;
330 data->mp = mp;
331 data->dataflags |= mntopts;
332 data->max_read = max_read;
333 data->daemon_timeout = daemon_timeout;
334 FUSE_UNLOCK();
335
336 vfs_getnewfsid(mp);
337 MNT_ILOCK(mp);
338 mp->mnt_data = data;
339 mp->mnt_flag |= MNT_LOCAL;
340 MNT_IUNLOCK(mp);
341 /* We need this here as this slot is used by getnewvnode() */
342 mp->mnt_stat.f_iosize = PAGE_SIZE;
343 if (subtype) {
344 strlcat(mp->mnt_stat.f_fstypename, ".", MFSNAMELEN);
345 strlcat(mp->mnt_stat.f_fstypename, subtype, MFSNAMELEN);
346 }
347 copystr(fspec, mp->mnt_stat.f_mntfromname, MNAMELEN - 1, &len);
348 bzero(mp->mnt_stat.f_mntfromname + len, MNAMELEN - len);
349 FS_DEBUG2G("mp %p: %s\n", mp, mp->mnt_stat.f_mntfromname);
350
351 /* Now handshaking with daemon */
352 fuse_internal_send_init(data, td);
353
354out:
355 if (err) {
356 FUSE_LOCK();
357 if (data->mp == mp) {
358 /*
359 * Destroy device only if we acquired reference to
360 * it
361 */
362 FS_DEBUG("mount failed, destroy device: data=%p mp=%p"
363 " err=%d\n",
364 data, mp, err);
365 data->mp = NULL;
366 fdata_trydestroy(data);
367 }
368 FUSE_UNLOCK();
369 dev_rel(fdev);
370 }
371 return err;
372}
373
374static int
375fuse_vfsop_unmount(struct mount *mp, int mntflags)
376{
377 int err = 0;
378 int flags = 0;
379
380 struct cdev *fdev;
381 struct fuse_data *data;
382 struct fuse_dispatcher fdi;
383 struct thread *td = curthread;
384
385 fuse_trace_printf_vfsop();
386
387 if (mntflags & MNT_FORCE) {
388 flags |= FORCECLOSE;
389 }
390 data = fuse_get_mpdata(mp);
391 if (!data) {
392 panic("no private data for mount point?");
393 }
394 /* There is 1 extra root vnode reference (mp->mnt_data). */
395 FUSE_LOCK();
396 if (data->vroot != NULL) {
397 struct vnode *vroot = data->vroot;
398
399 data->vroot = NULL;
400 FUSE_UNLOCK();
401 vrele(vroot);
402 } else
403 FUSE_UNLOCK();
404 err = vflush(mp, 0, flags, td);
405 if (err) {
406 debug_printf("vflush failed");
407 return err;
408 }
409 if (fdata_get_dead(data)) {
410 goto alreadydead;
411 }
412 fdisp_init(&fdi, 0);
413 fdisp_make(&fdi, FUSE_DESTROY, mp, 0, td, NULL);
414
415 err = fdisp_wait_answ(&fdi);
416 fdisp_destroy(&fdi);
417
418 fdata_set_dead(data);
419
420alreadydead:
421 FUSE_LOCK();
422 data->mp = NULL;
423 fdev = data->fdev;
424 fdata_trydestroy(data);
425 FUSE_UNLOCK();
426
427 MNT_ILOCK(mp);
428 mp->mnt_data = NULL;
429 mp->mnt_flag &= ~MNT_LOCAL;
430 MNT_IUNLOCK(mp);
431
432 dev_rel(fdev);
433
434 return 0;
435}
436
437static int
438fuse_vfsop_root(struct mount *mp, int lkflags, struct vnode **vpp)
439{
440 struct fuse_data *data = fuse_get_mpdata(mp);
441 int err = 0;
442
443 if (data->vroot != NULL) {
444 err = vget(data->vroot, lkflags, curthread);
445 if (err == 0)
446 *vpp = data->vroot;
447 } else {
448 err = fuse_vnode_get(mp, FUSE_ROOT_ID, NULL, vpp, NULL, VDIR);
449 if (err == 0) {
450 FUSE_LOCK();
451 MPASS(data->vroot == NULL || data->vroot == *vpp);
452 if (data->vroot == NULL) {
453 FS_DEBUG("new root vnode\n");
454 data->vroot = *vpp;
455 FUSE_UNLOCK();
456 vref(*vpp);
457 } else if (data->vroot != *vpp) {
458 FS_DEBUG("root vnode race\n");
459 FUSE_UNLOCK();
460 VOP_UNLOCK(*vpp, 0);
461 vrele(*vpp);
462 vrecycle(*vpp);
463 *vpp = data->vroot;
464 } else
465 FUSE_UNLOCK();
466 }
467 }
468 return err;
469}
470
471static int
472fuse_vfsop_statfs(struct mount *mp, struct statfs *sbp)
473{
474 struct fuse_dispatcher fdi;
475 int err = 0;
476
477 struct fuse_statfs_out *fsfo;
478 struct fuse_data *data;
479
480 FS_DEBUG2G("mp %p: %s\n", mp, mp->mnt_stat.f_mntfromname);
481 data = fuse_get_mpdata(mp);
482
483 if (!(data->dataflags & FSESS_INITED))
484 goto fake;
485
486 fdisp_init(&fdi, 0);
487 fdisp_make(&fdi, FUSE_STATFS, mp, FUSE_ROOT_ID, NULL, NULL);
488 err = fdisp_wait_answ(&fdi);
489 if (err) {
490 fdisp_destroy(&fdi);
491 if (err == ENOTCONN) {
492 /*
493 * We want to seem a legitimate fs even if the daemon
494 * is stiff dead... (so that, eg., we can still do path
495 * based unmounting after the daemon dies).
496 */
497 goto fake;
498 }
499 return err;
500 }
501 fsfo = fdi.answ;
502
503 sbp->f_blocks = fsfo->st.blocks;
504 sbp->f_bfree = fsfo->st.bfree;
505 sbp->f_bavail = fsfo->st.bavail;
506 sbp->f_files = fsfo->st.files;
507 sbp->f_ffree = fsfo->st.ffree; /* cast from uint64_t to int64_t */
508 sbp->f_namemax = fsfo->st.namelen;
509 sbp->f_bsize = fsfo->st.frsize; /* cast from uint32_t to uint64_t */
510
511 FS_DEBUG("fuse_statfs_out -- blocks: %llu, bfree: %llu, bavail: %llu, "
512 "fil es: %llu, ffree: %llu, bsize: %i, namelen: %i\n",
513 (unsigned long long)fsfo->st.blocks,
514 (unsigned long long)fsfo->st.bfree,
515 (unsigned long long)fsfo->st.bavail,
516 (unsigned long long)fsfo->st.files,
517 (unsigned long long)fsfo->st.ffree, fsfo->st.bsize,
518 fsfo->st.namelen);
519
520 fdisp_destroy(&fdi);
521 return 0;
522
523fake:
524 sbp->f_blocks = 0;
525 sbp->f_bfree = 0;
526 sbp->f_bavail = 0;
527 sbp->f_files = 0;
528 sbp->f_ffree = 0;
529 sbp->f_namemax = 0;
530 sbp->f_bsize = FUSE_DEFAULT_BLOCKSIZE;
531
532 return 0;
533}
|