tools/virtiofsd/passthrough_ll.c

   1 /*
   2  * FUSE: Filesystem in Userspace
   3  * Copyright (C) 2001-2007  Miklos Szeredi <miklos@szeredi.hu>
   4  *
   5  * This program can be distributed under the terms of the GNU GPLv2.
   6  * See the file COPYING.
   7  */
   8
   9 /*
  10  *
  11  * This file system mirrors the existing file system hierarchy of the
  12  * system, starting at the root file system. This is implemented by
  13  * just "passing through" all requests to the corresponding user-space
  14  * libc functions. In contrast to passthrough.c and passthrough_fh.c,
  15  * this implementation uses the low-level API. Its performance should
  16  * be the least bad among the three, but many operations are not
  17  * implemented. In particular, it is not possible to remove files (or
  18  * directories) because the code necessary to defer actual removal
  19  * until the file is not opened anymore would make the example much
  20  * more complicated.
  21  *
  22  * When writeback caching is enabled (-o writeback mount option), it
  23  * is only possible to write to files for which the mounting user has
  24  * read permissions. This is because the writeback cache requires the
  25  * kernel to be able to issue read requests for all files (which the
  26  * passthrough filesystem cannot satisfy if it can't read the file in
  27  * the underlying filesystem).
  28  *
  29  * Compile with:
  30  *
  31  *     gcc -Wall passthrough_ll.c `pkg-config fuse3 --cflags --libs` -o
  32  * passthrough_ll
  33  *
  34  * ## Source code ##
  35  * \include passthrough_ll.c
  36  */
  37
  38 #include "qemu/osdep.h"
  39 #include "qemu/timer.h"
  40 #include "fuse_virtio.h"
  41 #include "fuse_log.h"
  42 #include "fuse_lowlevel.h"
  43 #include <assert.h>
  44 #include <cap-ng.h>
  45 #include <dirent.h>
  46 #include <errno.h>
  47 #include <glib.h>
  48 #include <inttypes.h>
  49 #include <limits.h>
  50 #include <pthread.h>
  51 #include <stdbool.h>
  52 #include <stddef.h>
  53 #include <stdio.h>
  54 #include <stdlib.h>
  55 #include <string.h>
  56 #include <sys/file.h>
  57 #include <sys/mount.h>
  58 #include <sys/prctl.h>
  59 #include <sys/resource.h>
  60 #include <sys/syscall.h>
  61 #include <sys/types.h>
  62 #include <sys/wait.h>
  63 #include <sys/xattr.h>
  64 #include <syslog.h>
  65 #include <unistd.h>
  66
  67 #include "passthrough_helpers.h"
  68 #include "seccomp.h"
  69
  70 /* Keep track of inode posix locks for each owner. */
  71 struct lo_inode_plock {
  72     uint64_t lock_owner;
  73     int fd; /* fd for OFD locks */
  74 };
  75
  76 struct lo_map_elem {
  77     union {
  78         struct lo_inode *inode;
  79         struct lo_dirp *dirp;
  80         int fd;
  81         ssize_t freelist;
  82     };
  83     bool in_use;
  84 };
  85
  86 /* Maps FUSE fh or ino values to internal objects */
  87 struct lo_map {
  88     struct lo_map_elem *elems;
  89     size_t nelems;
  90     ssize_t freelist;
  91 };
  92
  93 struct lo_key {
  94     ino_t ino;
  95     dev_t dev;
  96 };
  97
  98 struct lo_inode {
  99     int fd;
 100
 101     /*
 102      * Atomic reference count for this object.  The nlookup field holds a
 103      * reference and release it when nlookup reaches 0.
 104      */
 105     gint refcount;
 106
 107     struct lo_key key;
 108
 109     /*
 110      * This counter keeps the inode alive during the FUSE session.
 111      * Incremented when the FUSE inode number is sent in a reply
 112      * (FUSE_LOOKUP, FUSE_READDIRPLUS, etc).  Decremented when an inode is
 113      * released by requests like FUSE_FORGET, FUSE_RMDIR, FUSE_RENAME, etc.
 114      *
 115      * Note that this value is untrusted because the client can manipulate
 116      * it arbitrarily using FUSE_FORGET requests.
 117      *
 118      * Protected by lo->mutex.
 119      */
 120     uint64_t nlookup;
 121
 122     fuse_ino_t fuse_ino;
 123     pthread_mutex_t plock_mutex;
 124     GHashTable *posix_locks; /* protected by lo_inode->plock_mutex */
 125
 126     mode_t filetype;
 127 };
 128
 129 struct lo_cred {
 130     uid_t euid;
 131     gid_t egid;
 132 };
 133
 134 enum {
 135     CACHE_NONE,
 136     CACHE_AUTO,
 137     CACHE_ALWAYS,
 138 };
 139
 140 struct lo_data {
 141     pthread_mutex_t mutex;
 142     int debug;
 143     int norace;
 144     int writeback;
 145     int flock;
 146     int posix_lock;
 147     int xattr;
 148     char *source;
 149     double timeout;
 150     int cache;
 151     int timeout_set;
 152     int readdirplus_set;
 153     int readdirplus_clear;
 154     struct lo_inode root;
 155     GHashTable *inodes; /* protected by lo->mutex */
 156     struct lo_map ino_map; /* protected by lo->mutex */
 157     struct lo_map dirp_map; /* protected by lo->mutex */
 158     struct lo_map fd_map; /* protected by lo->mutex */
 159
 160     /* An O_PATH file descriptor to /proc/self/fd/ */
 161     int proc_self_fd;
 162 };
 163
 164 static const struct fuse_opt lo_opts[] = {
 165     { "writeback", offsetof(struct lo_data, writeback), 1 },
 166     { "no_writeback", offsetof(struct lo_data, writeback), 0 },
 167     { "source=%s", offsetof(struct lo_data, source), 0 },
 168     { "flock", offsetof(struct lo_data, flock), 1 },
 169     { "no_flock", offsetof(struct lo_data, flock), 0 },
 170     { "posix_lock", offsetof(struct lo_data, posix_lock), 1 },
 171     { "no_posix_lock", offsetof(struct lo_data, posix_lock), 0 },
 172     { "xattr", offsetof(struct lo_data, xattr), 1 },
 173     { "no_xattr", offsetof(struct lo_data, xattr), 0 },
 174     { "timeout=%lf", offsetof(struct lo_data, timeout), 0 },
 175     { "timeout=", offsetof(struct lo_data, timeout_set), 1 },
 176     { "cache=none", offsetof(struct lo_data, cache), CACHE_NONE },
 177     { "cache=auto", offsetof(struct lo_data, cache), CACHE_AUTO },
 178     { "cache=always", offsetof(struct lo_data, cache), CACHE_ALWAYS },
 179     { "norace", offsetof(struct lo_data, norace), 1 },
 180     { "readdirplus", offsetof(struct lo_data, readdirplus_set), 1 },
 181     { "no_readdirplus", offsetof(struct lo_data, readdirplus_clear), 1 },
 182     FUSE_OPT_END
 183 };
 184 static bool use_syslog = false;
 185 static int current_log_level;
 186 static void unref_inode_lolocked(struct lo_data *lo, struct lo_inode *inode,
 187                                  uint64_t n);
 188
 189 static struct {
 190     pthread_mutex_t mutex;
 191     void *saved;
 192 } cap;
 193 /* That we loaded cap-ng in the current thread from the saved */
 194 static __thread bool cap_loaded = 0;
 195
 196 static struct lo_inode *lo_find(struct lo_data *lo, struct stat *st);
 197
 198 static int is_dot_or_dotdot(const char *name)
 199 {
 200     return name[0] == '.' &&
 201            (name[1] == '\0' || (name[1] == '.' && name[2] == '\0'));
 202 }
 203
 204 /* Is `path` a single path component that is not "." or ".."? */
 205 static int is_safe_path_component(const char *path)
 206 {
 207     if (strchr(path, '/')) {
 208         return 0;
 209     }
 210
 211     return !is_dot_or_dotdot(path);
 212 }
 213
 214 static struct lo_data *lo_data(fuse_req_t req)
 215 {
 216     return (struct lo_data *)fuse_req_userdata(req);
 217 }
 218
 219 /*
 220  * Load capng's state from our saved state if the current thread
 221  * hadn't previously been loaded.
 222  * returns 0 on success
 223  */
 224 static int load_capng(void)
 225 {
 226     if (!cap_loaded) {
 227         pthread_mutex_lock(&cap.mutex);
 228         capng_restore_state(&cap.saved);
 229         /*
 230          * restore_state free's the saved copy
 231          * so make another.
 232          */
 233         cap.saved = capng_save_state();
 234         if (!cap.saved) {
 235             pthread_mutex_unlock(&cap.mutex);
 236             fuse_log(FUSE_LOG_ERR, "capng_save_state (thread)\n");
 237             return -EINVAL;
 238         }
 239         pthread_mutex_unlock(&cap.mutex);
 240
 241         /*
 242          * We want to use the loaded state for our pid,
 243          * not the original
 244          */
 245         capng_setpid(syscall(SYS_gettid));
 246         cap_loaded = true;
 247     }
 248     return 0;
 249 }
 250
 251 /*
 252  * Helpers for dropping and regaining effective capabilities. Returns 0
 253  * on success, error otherwise
 254  */
 255 static int drop_effective_cap(const char *cap_name, bool *cap_dropped)
 256 {
 257     int cap, ret;
 258
 259     cap = capng_name_to_capability(cap_name);
 260     if (cap < 0) {
 261         ret = errno;
 262         fuse_log(FUSE_LOG_ERR, "capng_name_to_capability(%s) failed:%s\n",
 263                  cap_name, strerror(errno));
 264         goto out;
 265     }
 266
 267     if (load_capng()) {
 268         ret = errno;
 269         fuse_log(FUSE_LOG_ERR, "load_capng() failed\n");
 270         goto out;
 271     }
 272
 273     /* We dont have this capability in effective set already. */
 274     if (!capng_have_capability(CAPNG_EFFECTIVE, cap)) {
 275         ret = 0;
 276         goto out;
 277     }
 278
 279     if (capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, cap)) {
 280         ret = errno;
 281         fuse_log(FUSE_LOG_ERR, "capng_update(DROP,) failed\n");
 282         goto out;
 283     }
 284
 285     if (capng_apply(CAPNG_SELECT_CAPS)) {
 286         ret = errno;
 287         fuse_log(FUSE_LOG_ERR, "drop:capng_apply() failed\n");
 288         goto out;
 289     }
 290
 291     ret = 0;
 292     if (cap_dropped) {
 293         *cap_dropped = true;
 294     }
 295
 296 out:
 297     return ret;
 298 }
 299
 300 static int gain_effective_cap(const char *cap_name)
 301 {
 302     int cap;
 303     int ret = 0;
 304
 305     cap = capng_name_to_capability(cap_name);
 306     if (cap < 0) {
 307         ret = errno;
 308         fuse_log(FUSE_LOG_ERR, "capng_name_to_capability(%s) failed:%s\n",
 309                  cap_name, strerror(errno));
 310         goto out;
 311     }
 312
 313     if (load_capng()) {
 314         ret = errno;
 315         fuse_log(FUSE_LOG_ERR, "load_capng() failed\n");
 316         goto out;
 317     }
 318
 319     if (capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, cap)) {
 320         ret = errno;
 321         fuse_log(FUSE_LOG_ERR, "capng_update(ADD,) failed\n");
 322         goto out;
 323     }
 324
 325     if (capng_apply(CAPNG_SELECT_CAPS)) {
 326         ret = errno;
 327         fuse_log(FUSE_LOG_ERR, "gain:capng_apply() failed\n");
 328         goto out;
 329     }
 330     ret = 0;
 331
 332 out:
 333     return ret;
 334 }
 335
 336 static void lo_map_init(struct lo_map *map)
 337 {
 338     map->elems = NULL;
 339     map->nelems = 0;
 340     map->freelist = -1;
 341 }
 342
 343 static void lo_map_destroy(struct lo_map *map)
 344 {
 345     free(map->elems);
 346 }
 347
 348 static int lo_map_grow(struct lo_map *map, size_t new_nelems)
 349 {
 350     struct lo_map_elem *new_elems;
 351     size_t i;
 352
 353     if (new_nelems <= map->nelems) {
 354         return 1;
 355     }
 356
 357     new_elems = realloc(map->elems, sizeof(map->elems[0]) * new_nelems);
 358     if (!new_elems) {
 359         return 0;
 360     }
 361
 362     for (i = map->nelems; i < new_nelems; i++) {
 363         new_elems[i].freelist = i + 1;
 364         new_elems[i].in_use = false;
 365     }
 366     new_elems[new_nelems - 1].freelist = -1;
 367
 368     map->elems = new_elems;
 369     map->freelist = map->nelems;
 370     map->nelems = new_nelems;
 371     return 1;
 372 }
 373
 374 static struct lo_map_elem *lo_map_alloc_elem(struct lo_map *map)
 375 {
 376     struct lo_map_elem *elem;
 377
 378     if (map->freelist == -1 && !lo_map_grow(map, map->nelems + 256)) {
 379         return NULL;
 380     }
 381
 382     elem = &map->elems[map->freelist];
 383     map->freelist = elem->freelist;
 384
 385     elem->in_use = true;
 386
 387     return elem;
 388 }
 389
 390 static struct lo_map_elem *lo_map_reserve(struct lo_map *map, size_t key)
 391 {
 392     ssize_t *prev;
 393
 394     if (!lo_map_grow(map, key + 1)) {
 395         return NULL;
 396     }
 397
 398     for (prev = &map->freelist; *prev != -1;
 399          prev = &map->elems[*prev].freelist) {
 400         if (*prev == key) {
 401             struct lo_map_elem *elem = &map->elems[key];
 402
 403             *prev = elem->freelist;
 404             elem->in_use = true;
 405             return elem;
 406         }
 407     }
 408     return NULL;
 409 }
 410
 411 static struct lo_map_elem *lo_map_get(struct lo_map *map, size_t key)
 412 {
 413     if (key >= map->nelems) {
 414         return NULL;
 415     }
 416     if (!map->elems[key].in_use) {
 417         return NULL;
 418     }
 419     return &map->elems[key];
 420 }
 421
 422 static void lo_map_remove(struct lo_map *map, size_t key)
 423 {
 424     struct lo_map_elem *elem;
 425
 426     if (key >= map->nelems) {
 427         return;
 428     }
 429
 430     elem = &map->elems[key];
 431     if (!elem->in_use) {
 432         return;
 433     }
 434
 435     elem->in_use = false;
 436
 437     elem->freelist = map->freelist;
 438     map->freelist = key;
 439 }
 440
 441 /* Assumes lo->mutex is held */
 442 static ssize_t lo_add_fd_mapping(fuse_req_t req, int fd)
 443 {
 444     struct lo_map_elem *elem;
 445
 446     elem = lo_map_alloc_elem(&lo_data(req)->fd_map);
 447     if (!elem) {
 448         return -1;
 449     }
 450
 451     elem->fd = fd;
 452     return elem - lo_data(req)->fd_map.elems;
 453 }
 454
 455 /* Assumes lo->mutex is held */
 456 static ssize_t lo_add_dirp_mapping(fuse_req_t req, struct lo_dirp *dirp)
 457 {
 458     struct lo_map_elem *elem;
 459
 460     elem = lo_map_alloc_elem(&lo_data(req)->dirp_map);
 461     if (!elem) {
 462         return -1;
 463     }
 464
 465     elem->dirp = dirp;
 466     return elem - lo_data(req)->dirp_map.elems;
 467 }
 468
 469 /* Assumes lo->mutex is held */
 470 static ssize_t lo_add_inode_mapping(fuse_req_t req, struct lo_inode *inode)
 471 {
 472     struct lo_map_elem *elem;
 473
 474     elem = lo_map_alloc_elem(&lo_data(req)->ino_map);
 475     if (!elem) {
 476         return -1;
 477     }
 478
 479     elem->inode = inode;
 480     return elem - lo_data(req)->ino_map.elems;
 481 }
 482
 483 static void lo_inode_put(struct lo_data *lo, struct lo_inode **inodep)
 484 {
 485     struct lo_inode *inode = *inodep;
 486
 487     if (!inode) {
 488         return;
 489     }
 490
 491     *inodep = NULL;
 492
 493     if (g_atomic_int_dec_and_test(&inode->refcount)) {
 494         close(inode->fd);
 495         free(inode);
 496     }
 497 }
 498
 499 /* Caller must release refcount using lo_inode_put() */
 500 static struct lo_inode *lo_inode(fuse_req_t req, fuse_ino_t ino)
 501 {
 502     struct lo_data *lo = lo_data(req);
 503     struct lo_map_elem *elem;
 504
 505     pthread_mutex_lock(&lo->mutex);
 506     elem = lo_map_get(&lo->ino_map, ino);
 507     if (elem) {
 508         g_atomic_int_inc(&elem->inode->refcount);
 509     }
 510     pthread_mutex_unlock(&lo->mutex);
 511
 512     if (!elem) {
 513         return NULL;
 514     }
 515
 516     return elem->inode;
 517 }
 518
 519 /*
 520  * TODO Remove this helper and force callers to hold an inode refcount until
 521  * they are done with the fd.  This will be done in a later patch to make
 522  * review easier.
 523  */
 524 static int lo_fd(fuse_req_t req, fuse_ino_t ino)
 525 {
 526     struct lo_inode *inode = lo_inode(req, ino);
 527     int fd;
 528
 529     if (!inode) {
 530         return -1;
 531     }
 532
 533     fd = inode->fd;
 534     lo_inode_put(lo_data(req), &inode);
 535     return fd;
 536 }
 537
 538 static void lo_init(void *userdata, struct fuse_conn_info *conn)
 539 {
 540     struct lo_data *lo = (struct lo_data *)userdata;
 541
 542     if (conn->capable & FUSE_CAP_EXPORT_SUPPORT) {
 543         conn->want |= FUSE_CAP_EXPORT_SUPPORT;
 544     }
 545
 546     if (lo->writeback && conn->capable & FUSE_CAP_WRITEBACK_CACHE) {
 547         fuse_log(FUSE_LOG_DEBUG, "lo_init: activating writeback\n");
 548         conn->want |= FUSE_CAP_WRITEBACK_CACHE;
 549     }
 550     if (conn->capable & FUSE_CAP_FLOCK_LOCKS) {
 551         if (lo->flock) {
 552             fuse_log(FUSE_LOG_DEBUG, "lo_init: activating flock locks\n");
 553             conn->want |= FUSE_CAP_FLOCK_LOCKS;
 554         } else {
 555             fuse_log(FUSE_LOG_DEBUG, "lo_init: disabling flock locks\n");
 556             conn->want &= ~FUSE_CAP_FLOCK_LOCKS;
 557         }
 558     }
 559
 560     if (conn->capable & FUSE_CAP_POSIX_LOCKS) {
 561         if (lo->posix_lock) {
 562             fuse_log(FUSE_LOG_DEBUG, "lo_init: activating posix locks\n");
 563             conn->want |= FUSE_CAP_POSIX_LOCKS;
 564         } else {
 565             fuse_log(FUSE_LOG_DEBUG, "lo_init: disabling posix locks\n");
 566             conn->want &= ~FUSE_CAP_POSIX_LOCKS;
 567         }
 568     }
 569
 570     if ((lo->cache == CACHE_NONE && !lo->readdirplus_set) ||
 571         lo->readdirplus_clear) {
 572         fuse_log(FUSE_LOG_DEBUG, "lo_init: disabling readdirplus\n");
 573         conn->want &= ~FUSE_CAP_READDIRPLUS;
 574     }
 575 }
 576
 577 static void lo_getattr(fuse_req_t req, fuse_ino_t ino,
 578                        struct fuse_file_info *fi)
 579 {
 580     int res;
 581     struct stat buf;
 582     struct lo_data *lo = lo_data(req);
 583
 584     (void)fi;
 585
 586     res =
 587         fstatat(lo_fd(req, ino), "", &buf, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
 588     if (res == -1) {
 589         return (void)fuse_reply_err(req, errno);
 590     }
 591
 592     fuse_reply_attr(req, &buf, lo->timeout);
 593 }
 594
 595 /*
 596  * Increments parent->nlookup and caller must release refcount using
 597  * lo_inode_put(&parent).
 598  */
 599 static int lo_parent_and_name(struct lo_data *lo, struct lo_inode *inode,
 600                               char path[PATH_MAX], struct lo_inode **parent)
 601 {
 602     char procname[64];
 603     char *last;
 604     struct stat stat;
 605     struct lo_inode *p;
 606     int retries = 2;
 607     int res;
 608
 609 retry:
 610     sprintf(procname, "%i", inode->fd);
 611
 612     res = readlinkat(lo->proc_self_fd, procname, path, PATH_MAX);
 613     if (res < 0) {
 614         fuse_log(FUSE_LOG_WARNING, "%s: readlink failed: %m\n", __func__);
 615         goto fail_noretry;
 616     }
 617
 618     if (res >= PATH_MAX) {
 619         fuse_log(FUSE_LOG_WARNING, "%s: readlink overflowed\n", __func__);
 620         goto fail_noretry;
 621     }
 622     path[res] = '\0';
 623
 624     last = strrchr(path, '/');
 625     if (last == NULL) {
 626         /* Shouldn't happen */
 627         fuse_log(
 628             FUSE_LOG_WARNING,
 629             "%s: INTERNAL ERROR: bad path read from proc\n", __func__);
 630         goto fail_noretry;
 631     }
 632     if (last == path) {
 633         p = &lo->root;
 634         pthread_mutex_lock(&lo->mutex);
 635         p->nlookup++;
 636         g_atomic_int_inc(&p->refcount);
 637         pthread_mutex_unlock(&lo->mutex);
 638     } else {
 639         *last = '\0';
 640         res = fstatat(AT_FDCWD, last == path ? "/" : path, &stat, 0);
 641         if (res == -1) {
 642             if (!retries) {
 643                 fuse_log(FUSE_LOG_WARNING,
 644                          "%s: failed to stat parent: %m\n", __func__);
 645             }
 646             goto fail;
 647         }
 648         p = lo_find(lo, &stat);
 649         if (p == NULL) {
 650             if (!retries) {
 651                 fuse_log(FUSE_LOG_WARNING,
 652                          "%s: failed to find parent\n", __func__);
 653             }
 654             goto fail;
 655         }
 656     }
 657     last++;
 658     res = fstatat(p->fd, last, &stat, AT_SYMLINK_NOFOLLOW);
 659     if (res == -1) {
 660         if (!retries) {
 661             fuse_log(FUSE_LOG_WARNING,
 662                      "%s: failed to stat last\n", __func__);
 663         }
 664         goto fail_unref;
 665     }
 666     if (stat.st_dev != inode->key.dev || stat.st_ino != inode->key.ino) {
 667         if (!retries) {
 668             fuse_log(FUSE_LOG_WARNING,
 669                      "%s: failed to match last\n", __func__);
 670         }
 671         goto fail_unref;
 672     }
 673     *parent = p;
 674     memmove(path, last, strlen(last) + 1);
 675
 676     return 0;
 677
 678 fail_unref:
 679     unref_inode_lolocked(lo, p, 1);
 680     lo_inode_put(lo, &p);
 681 fail:
 682     if (retries) {
 683         retries--;
 684         goto retry;
 685     }
 686 fail_noretry:
 687     errno = EIO;
 688     return -1;
 689 }
 690
 691 static int utimensat_empty(struct lo_data *lo, struct lo_inode *inode,
 692                            const struct timespec *tv)
 693 {
 694     int res;
 695     struct lo_inode *parent;
 696     char path[PATH_MAX];
 697
 698     if (S_ISLNK(inode->filetype)) {
 699         res = utimensat(inode->fd, "", tv, AT_EMPTY_PATH);
 700         if (res == -1 && errno == EINVAL) {
 701             /* Sorry, no race free way to set times on symlink. */
 702             if (lo->norace) {
 703                 errno = EPERM;
 704             } else {
 705                 goto fallback;
 706             }
 707         }
 708         return res;
 709     }
 710     sprintf(path, "%i", inode->fd);
 711
 712     return utimensat(lo->proc_self_fd, path, tv, 0);
 713
 714 fallback:
 715     res = lo_parent_and_name(lo, inode, path, &parent);
 716     if (res != -1) {
 717         res = utimensat(parent->fd, path, tv, AT_SYMLINK_NOFOLLOW);
 718         unref_inode_lolocked(lo, parent, 1);
 719         lo_inode_put(lo, &parent);
 720     }
 721
 722     return res;
 723 }
 724
 725 static int lo_fi_fd(fuse_req_t req, struct fuse_file_info *fi)
 726 {
 727     struct lo_data *lo = lo_data(req);
 728     struct lo_map_elem *elem;
 729
 730     pthread_mutex_lock(&lo->mutex);
 731     elem = lo_map_get(&lo->fd_map, fi->fh);
 732     pthread_mutex_unlock(&lo->mutex);
 733
 734     if (!elem) {
 735         return -1;
 736     }
 737
 738     return elem->fd;
 739 }
 740
 741 static void lo_setattr(fuse_req_t req, fuse_ino_t ino, struct stat *attr,
 742                        int valid, struct fuse_file_info *fi)
 743 {
 744     int saverr;
 745     char procname[64];
 746     struct lo_data *lo = lo_data(req);
 747     struct lo_inode *inode;
 748     int ifd;
 749     int res;
 750     int fd;
 751
 752     inode = lo_inode(req, ino);
 753     if (!inode) {
 754         fuse_reply_err(req, EBADF);
 755         return;
 756     }
 757
 758     ifd = inode->fd;
 759
 760     /* If fi->fh is invalid we'll report EBADF later */
 761     if (fi) {
 762         fd = lo_fi_fd(req, fi);
 763     }
 764
 765     if (valid & FUSE_SET_ATTR_MODE) {
 766         if (fi) {
 767             res = fchmod(fd, attr->st_mode);
 768         } else {
 769             sprintf(procname, "%i", ifd);
 770             res = fchmodat(lo->proc_self_fd, procname, attr->st_mode, 0);
 771         }
 772         if (res == -1) {
 773             goto out_err;
 774         }
 775     }
 776     if (valid & (FUSE_SET_ATTR_UID | FUSE_SET_ATTR_GID)) {
 777         uid_t uid = (valid & FUSE_SET_ATTR_UID) ? attr->st_uid : (uid_t)-1;
 778         gid_t gid = (valid & FUSE_SET_ATTR_GID) ? attr->st_gid : (gid_t)-1;
 779
 780         res = fchownat(ifd, "", uid, gid, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
 781         if (res == -1) {
 782             goto out_err;
 783         }
 784     }
 785     if (valid & FUSE_SET_ATTR_SIZE) {
 786         int truncfd;
 787
 788         if (fi) {
 789             truncfd = fd;
 790         } else {
 791             sprintf(procname, "%i", ifd);
 792             truncfd = openat(lo->proc_self_fd, procname, O_RDWR);
 793             if (truncfd < 0) {
 794                 goto out_err;
 795             }
 796         }
 797
 798         res = ftruncate(truncfd, attr->st_size);
 799         if (!fi) {
 800             saverr = errno;
 801             close(truncfd);
 802             errno = saverr;
 803         }
 804         if (res == -1) {
 805             goto out_err;
 806         }
 807     }
 808     if (valid & (FUSE_SET_ATTR_ATIME | FUSE_SET_ATTR_MTIME)) {
 809         struct timespec tv[2];
 810
 811         tv[0].tv_sec = 0;
 812         tv[1].tv_sec = 0;
 813         tv[0].tv_nsec = UTIME_OMIT;
 814         tv[1].tv_nsec = UTIME_OMIT;
 815
 816         if (valid & FUSE_SET_ATTR_ATIME_NOW) {
 817             tv[0].tv_nsec = UTIME_NOW;
 818         } else if (valid & FUSE_SET_ATTR_ATIME) {
 819             tv[0] = attr->st_atim;
 820         }
 821
 822         if (valid & FUSE_SET_ATTR_MTIME_NOW) {
 823             tv[1].tv_nsec = UTIME_NOW;
 824         } else if (valid & FUSE_SET_ATTR_MTIME) {
 825             tv[1] = attr->st_mtim;
 826         }
 827
 828         if (fi) {
 829             res = futimens(fd, tv);
 830         } else {
 831             res = utimensat_empty(lo, inode, tv);
 832         }
 833         if (res == -1) {
 834             goto out_err;
 835         }
 836     }
 837     lo_inode_put(lo, &inode);
 838
 839     return lo_getattr(req, ino, fi);
 840
 841 out_err:
 842     saverr = errno;
 843     lo_inode_put(lo, &inode);
 844     fuse_reply_err(req, saverr);
 845 }
 846
 847 static struct lo_inode *lo_find(struct lo_data *lo, struct stat *st)
 848 {
 849     struct lo_inode *p;
 850     struct lo_key key = {
 851         .ino = st->st_ino,
 852         .dev = st->st_dev,
 853     };
 854
 855     pthread_mutex_lock(&lo->mutex);
 856     p = g_hash_table_lookup(lo->inodes, &key);
 857     if (p) {
 858         assert(p->nlookup > 0);
 859         p->nlookup++;
 860         g_atomic_int_inc(&p->refcount);
 861     }
 862     pthread_mutex_unlock(&lo->mutex);
 863
 864     return p;
 865 }
 866
 867 /* value_destroy_func for posix_locks GHashTable */
 868 static void posix_locks_value_destroy(gpointer data)
 869 {
 870     struct lo_inode_plock *plock = data;
 871
 872     /*
 873      * We had used open() for locks and had only one fd. So
 874      * closing this fd should release all OFD locks.
 875      */
 876     close(plock->fd);
 877     free(plock);
 878 }
 879
 880 /*
 881  * Increments nlookup and caller must release refcount using
 882  * lo_inode_put(&parent).
 883  */
 884 static int lo_do_lookup(fuse_req_t req, fuse_ino_t parent, const char *name,
 885                         struct fuse_entry_param *e)
 886 {
 887     int newfd;
 888     int res;
 889     int saverr;
 890     struct lo_data *lo = lo_data(req);
 891     struct lo_inode *inode = NULL;
 892     struct lo_inode *dir = lo_inode(req, parent);
 893
 894     /*
 895      * name_to_handle_at() and open_by_handle_at() can reach here with fuse
 896      * mount point in guest, but we don't have its inode info in the
 897      * ino_map.
 898      */
 899     if (!dir) {
 900         return ENOENT;
 901     }
 902
 903     memset(e, 0, sizeof(*e));
 904     e->attr_timeout = lo->timeout;
 905     e->entry_timeout = lo->timeout;
 906
 907     /* Do not allow escaping root directory */
 908     if (dir == &lo->root && strcmp(name, "..") == 0) {
 909         name = ".";
 910     }
 911
 912     newfd = openat(dir->fd, name, O_PATH | O_NOFOLLOW);
 913     if (newfd == -1) {
 914         goto out_err;
 915     }
 916
 917     res = fstatat(newfd, "", &e->attr, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
 918     if (res == -1) {
 919         goto out_err;
 920     }
 921
 922     inode = lo_find(lo, &e->attr);
 923     if (inode) {
 924         close(newfd);
 925     } else {
 926         inode = calloc(1, sizeof(struct lo_inode));
 927         if (!inode) {
 928             goto out_err;
 929         }
 930
 931         /* cache only filetype */
 932         inode->filetype = (e->attr.st_mode & S_IFMT);
 933
 934         /*
 935          * One for the caller and one for nlookup (released in
 936          * unref_inode_lolocked())
 937          */
 938         g_atomic_int_set(&inode->refcount, 2);
 939
 940         inode->nlookup = 1;
 941         inode->fd = newfd;
 942         inode->key.ino = e->attr.st_ino;
 943         inode->key.dev = e->attr.st_dev;
 944         pthread_mutex_init(&inode->plock_mutex, NULL);
 945         inode->posix_locks = g_hash_table_new_full(
 946             g_direct_hash, g_direct_equal, NULL, posix_locks_value_destroy);
 947
 948         pthread_mutex_lock(&lo->mutex);
 949         inode->fuse_ino = lo_add_inode_mapping(req, inode);
 950         g_hash_table_insert(lo->inodes, &inode->key, inode);
 951         pthread_mutex_unlock(&lo->mutex);
 952     }
 953     e->ino = inode->fuse_ino;
 954     lo_inode_put(lo, &inode);
 955     lo_inode_put(lo, &dir);
 956
 957     fuse_log(FUSE_LOG_DEBUG, "  %lli/%s -> %lli\n", (unsigned long long)parent,
 958              name, (unsigned long long)e->ino);
 959
 960     return 0;
 961
 962 out_err:
 963     saverr = errno;
 964     if (newfd != -1) {
 965         close(newfd);
 966     }
 967     lo_inode_put(lo, &inode);
 968     lo_inode_put(lo, &dir);
 969     return saverr;
 970 }
 971
 972 static void lo_lookup(fuse_req_t req, fuse_ino_t parent, const char *name)
 973 {
 974     struct fuse_entry_param e;
 975     int err;
 976
 977     fuse_log(FUSE_LOG_DEBUG, "lo_lookup(parent=%" PRIu64 ", name=%s)\n", parent,
 978              name);
 979
 980     /*
 981      * Don't use is_safe_path_component(), allow "." and ".." for NFS export
 982      * support.
 983      */
 984     if (strchr(name, '/')) {
 985         fuse_reply_err(req, EINVAL);
 986         return;
 987     }
 988
 989     err = lo_do_lookup(req, parent, name, &e);
 990     if (err) {
 991         fuse_reply_err(req, err);
 992     } else {
 993         fuse_reply_entry(req, &e);
 994     }
 995 }
 996
 997 /*
 998  * On some archs, setres*id is limited to 2^16 but they
 999  * provide setres*id32 variants that allow 2^32.
1000  * Others just let setres*id do 2^32 anyway.
1001  */
1002 #ifdef SYS_setresgid32
1003 #define OURSYS_setresgid SYS_setresgid32
1004 #else
1005 #define OURSYS_setresgid SYS_setresgid
1006 #endif
1007
1008 #ifdef SYS_setresuid32
1009 #define OURSYS_setresuid SYS_setresuid32
1010 #else
1011 #define OURSYS_setresuid SYS_setresuid
1012 #endif
1013
1014 /*
1015  * Change to uid/gid of caller so that file is created with
1016  * ownership of caller.
1017  * TODO: What about selinux context?
1018  */
1019 static int lo_change_cred(fuse_req_t req, struct lo_cred *old)
1020 {
1021     int res;
1022
1023     old->euid = geteuid();
1024     old->egid = getegid();
1025
1026     res = syscall(OURSYS_setresgid, -1, fuse_req_ctx(req)->gid, -1);
1027     if (res == -1) {
1028         return errno;
1029     }
1030
1031     res = syscall(OURSYS_setresuid, -1, fuse_req_ctx(req)->uid, -1);
1032     if (res == -1) {
1033         int errno_save = errno;
1034
1035         syscall(OURSYS_setresgid, -1, old->egid, -1);
1036         return errno_save;
1037     }
1038
1039     return 0;
1040 }
1041
1042 /* Regain Privileges */
1043 static void lo_restore_cred(struct lo_cred *old)
1044 {
1045     int res;
1046
1047     res = syscall(OURSYS_setresuid, -1, old->euid, -1);
1048     if (res == -1) {
1049         fuse_log(FUSE_LOG_ERR, "seteuid(%u): %m\n", old->euid);
1050         exit(1);
1051     }
1052
1053     res = syscall(OURSYS_setresgid, -1, old->egid, -1);
1054     if (res == -1) {
1055         fuse_log(FUSE_LOG_ERR, "setegid(%u): %m\n", old->egid);
1056         exit(1);
1057     }
1058 }
1059
1060 static void lo_mknod_symlink(fuse_req_t req, fuse_ino_t parent,
1061                              const char *name, mode_t mode, dev_t rdev,
1062                              const char *link)
1063 {
1064     int res;
1065     int saverr;
1066     struct lo_data *lo = lo_data(req);
1067     struct lo_inode *dir;
1068     struct fuse_entry_param e;
1069     struct lo_cred old = {};
1070
1071     if (!is_safe_path_component(name)) {
1072         fuse_reply_err(req, EINVAL);
1073         return;
1074     }
1075
1076     dir = lo_inode(req, parent);
1077     if (!dir) {
1078         fuse_reply_err(req, EBADF);
1079         return;
1080     }
1081
1082     saverr = lo_change_cred(req, &old);
1083     if (saverr) {
1084         goto out;
1085     }
1086
1087     res = mknod_wrapper(dir->fd, name, link, mode, rdev);
1088
1089     saverr = errno;
1090
1091     lo_restore_cred(&old);
1092
1093     if (res == -1) {
1094         goto out;
1095     }
1096
1097     saverr = lo_do_lookup(req, parent, name, &e);
1098     if (saverr) {
1099         goto out;
1100     }
1101
1102     fuse_log(FUSE_LOG_DEBUG, "  %lli/%s -> %lli\n", (unsigned long long)parent,
1103              name, (unsigned long long)e.ino);
1104
1105     fuse_reply_entry(req, &e);
1106     lo_inode_put(lo, &dir);
1107     return;
1108
1109 out:
1110     lo_inode_put(lo, &dir);
1111     fuse_reply_err(req, saverr);
1112 }
1113
1114 static void lo_mknod(fuse_req_t req, fuse_ino_t parent, const char *name,
1115                      mode_t mode, dev_t rdev)
1116 {
1117     lo_mknod_symlink(req, parent, name, mode, rdev, NULL);
1118 }
1119
1120 static void lo_mkdir(fuse_req_t req, fuse_ino_t parent, const char *name,
1121                      mode_t mode)
1122 {
1123     lo_mknod_symlink(req, parent, name, S_IFDIR | mode, 0, NULL);
1124 }
1125
1126 static void lo_symlink(fuse_req_t req, const char *link, fuse_ino_t parent,
1127                        const char *name)
1128 {
1129     lo_mknod_symlink(req, parent, name, S_IFLNK, 0, link);
1130 }
1131
1132 static int linkat_empty_nofollow(struct lo_data *lo, struct lo_inode *inode,
1133                                  int dfd, const char *name)
1134 {
1135     int res;
1136     struct lo_inode *parent;
1137     char path[PATH_MAX];
1138
1139     if (S_ISLNK(inode->filetype)) {
1140         res = linkat(inode->fd, "", dfd, name, AT_EMPTY_PATH);
1141         if (res == -1 && (errno == ENOENT || errno == EINVAL)) {
1142             /* Sorry, no race free way to hard-link a symlink. */
1143             if (lo->norace) {
1144                 errno = EPERM;
1145             } else {
1146                 goto fallback;
1147             }
1148         }
1149         return res;
1150     }
1151
1152     sprintf(path, "%i", inode->fd);
1153
1154     return linkat(lo->proc_self_fd, path, dfd, name, AT_SYMLINK_FOLLOW);
1155
1156 fallback:
1157     res = lo_parent_and_name(lo, inode, path, &parent);
1158     if (res != -1) {
1159         res = linkat(parent->fd, path, dfd, name, 0);
1160         unref_inode_lolocked(lo, parent, 1);
1161         lo_inode_put(lo, &parent);
1162     }
1163
1164     return res;
1165 }
1166
1167 static void lo_link(fuse_req_t req, fuse_ino_t ino, fuse_ino_t parent,
1168                     const char *name)
1169 {
1170     int res;
1171     struct lo_data *lo = lo_data(req);
1172     struct lo_inode *parent_inode;
1173     struct lo_inode *inode;
1174     struct fuse_entry_param e;
1175     int saverr;
1176
1177     if (!is_safe_path_component(name)) {
1178         fuse_reply_err(req, EINVAL);
1179         return;
1180     }
1181
1182     parent_inode = lo_inode(req, parent);
1183     inode = lo_inode(req, ino);
1184     if (!parent_inode || !inode) {
1185         errno = EBADF;
1186         goto out_err;
1187     }
1188
1189     memset(&e, 0, sizeof(struct fuse_entry_param));
1190     e.attr_timeout = lo->timeout;
1191     e.entry_timeout = lo->timeout;
1192
1193     res = linkat_empty_nofollow(lo, inode, parent_inode->fd, name);
1194     if (res == -1) {
1195         goto out_err;
1196     }
1197
1198     res = fstatat(inode->fd, "", &e.attr, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
1199     if (res == -1) {
1200         goto out_err;
1201     }
1202
1203     pthread_mutex_lock(&lo->mutex);
1204     inode->nlookup++;
1205     pthread_mutex_unlock(&lo->mutex);
1206     e.ino = inode->fuse_ino;
1207
1208     fuse_log(FUSE_LOG_DEBUG, "  %lli/%s -> %lli\n", (unsigned long long)parent,
1209              name, (unsigned long long)e.ino);
1210
1211     fuse_reply_entry(req, &e);
1212     lo_inode_put(lo, &parent_inode);
1213     lo_inode_put(lo, &inode);
1214     return;
1215
1216 out_err:
1217     saverr = errno;
1218     lo_inode_put(lo, &parent_inode);
1219     lo_inode_put(lo, &inode);
1220     fuse_reply_err(req, saverr);
1221 }
1222
1223 /* Increments nlookup and caller must release refcount using lo_inode_put() */
1224 static struct lo_inode *lookup_name(fuse_req_t req, fuse_ino_t parent,
1225                                     const char *name)
1226 {
1227     int res;
1228     struct stat attr;
1229
1230     res = fstatat(lo_fd(req, parent), name, &attr,
1231                   AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
1232     if (res == -1) {
1233         return NULL;
1234     }
1235
1236     return lo_find(lo_data(req), &attr);
1237 }
1238
1239 static void lo_rmdir(fuse_req_t req, fuse_ino_t parent, const char *name)
1240 {
1241     int res;
1242     struct lo_inode *inode;
1243     struct lo_data *lo = lo_data(req);
1244
1245     if (!is_safe_path_component(name)) {
1246         fuse_reply_err(req, EINVAL);
1247         return;
1248     }
1249
1250     inode = lookup_name(req, parent, name);
1251     if (!inode) {
1252         fuse_reply_err(req, EIO);
1253         return;
1254     }
1255
1256     res = unlinkat(lo_fd(req, parent), name, AT_REMOVEDIR);
1257
1258     fuse_reply_err(req, res == -1 ? errno : 0);
1259     unref_inode_lolocked(lo, inode, 1);
1260     lo_inode_put(lo, &inode);
1261 }
1262
1263 static void lo_rename(fuse_req_t req, fuse_ino_t parent, const char *name,
1264                       fuse_ino_t newparent, const char *newname,
1265                       unsigned int flags)
1266 {
1267     int res;
1268     struct lo_inode *parent_inode;
1269     struct lo_inode *newparent_inode;
1270     struct lo_inode *oldinode = NULL;
1271     struct lo_inode *newinode = NULL;
1272     struct lo_data *lo = lo_data(req);
1273
1274     if (!is_safe_path_component(name) || !is_safe_path_component(newname)) {
1275         fuse_reply_err(req, EINVAL);
1276         return;
1277     }
1278
1279     parent_inode = lo_inode(req, parent);
1280     newparent_inode = lo_inode(req, newparent);
1281     if (!parent_inode || !newparent_inode) {
1282         fuse_reply_err(req, EBADF);
1283         goto out;
1284     }
1285
1286     oldinode = lookup_name(req, parent, name);
1287     newinode = lookup_name(req, newparent, newname);
1288
1289     if (!oldinode) {
1290         fuse_reply_err(req, EIO);
1291         goto out;
1292     }
1293
1294     if (flags) {
1295 #ifndef SYS_renameat2
1296         fuse_reply_err(req, EINVAL);
1297 #else
1298         res = syscall(SYS_renameat2, parent_inode->fd, name,
1299                         newparent_inode->fd, newname, flags);
1300         if (res == -1 && errno == ENOSYS) {
1301             fuse_reply_err(req, EINVAL);
1302         } else {
1303             fuse_reply_err(req, res == -1 ? errno : 0);
1304         }
1305 #endif
1306         goto out;
1307     }
1308
1309     res = renameat(parent_inode->fd, name, newparent_inode->fd, newname);
1310
1311     fuse_reply_err(req, res == -1 ? errno : 0);
1312 out:
1313     unref_inode_lolocked(lo, oldinode, 1);
1314     unref_inode_lolocked(lo, newinode, 1);
1315     lo_inode_put(lo, &oldinode);
1316     lo_inode_put(lo, &newinode);
1317     lo_inode_put(lo, &parent_inode);
1318     lo_inode_put(lo, &newparent_inode);
1319 }
1320
1321 static void lo_unlink(fuse_req_t req, fuse_ino_t parent, const char *name)
1322 {
1323     int res;
1324     struct lo_inode *inode;
1325     struct lo_data *lo = lo_data(req);
1326
1327     if (!is_safe_path_component(name)) {
1328         fuse_reply_err(req, EINVAL);
1329         return;
1330     }
1331
1332     inode = lookup_name(req, parent, name);
1333     if (!inode) {
1334         fuse_reply_err(req, EIO);
1335         return;
1336     }
1337
1338     res = unlinkat(lo_fd(req, parent), name, 0);
1339
1340     fuse_reply_err(req, res == -1 ? errno : 0);
1341     unref_inode_lolocked(lo, inode, 1);
1342     lo_inode_put(lo, &inode);
1343 }
1344
1345 /* To be called with lo->mutex held */
1346 static void unref_inode(struct lo_data *lo, struct lo_inode *inode, uint64_t n)
1347 {
1348     if (!inode) {
1349         return;
1350     }
1351
1352     assert(inode->nlookup >= n);
1353     inode->nlookup -= n;
1354     if (!inode->nlookup) {
1355         lo_map_remove(&lo->ino_map, inode->fuse_ino);
1356         g_hash_table_remove(lo->inodes, &inode->key);
1357         if (g_hash_table_size(inode->posix_locks)) {
1358             fuse_log(FUSE_LOG_WARNING, "Hash table is not empty\n");
1359         }
1360         g_hash_table_destroy(inode->posix_locks);
1361         pthread_mutex_destroy(&inode->plock_mutex);
1362
1363         /* Drop our refcount from lo_do_lookup() */
1364         lo_inode_put(lo, &inode);
1365     }
1366 }
1367
1368 static void unref_inode_lolocked(struct lo_data *lo, struct lo_inode *inode,
1369                                  uint64_t n)
1370 {
1371     if (!inode) {
1372         return;
1373     }
1374
1375     pthread_mutex_lock(&lo->mutex);
1376     unref_inode(lo, inode, n);
1377     pthread_mutex_unlock(&lo->mutex);
1378 }
1379
1380 static void lo_forget_one(fuse_req_t req, fuse_ino_t ino, uint64_t nlookup)
1381 {
1382     struct lo_data *lo = lo_data(req);
1383     struct lo_inode *inode;
1384
1385     inode = lo_inode(req, ino);
1386     if (!inode) {
1387         return;
1388     }
1389
1390     fuse_log(FUSE_LOG_DEBUG, "  forget %lli %lli -%lli\n",
1391              (unsigned long long)ino, (unsigned long long)inode->nlookup,
1392              (unsigned long long)nlookup);
1393
1394     unref_inode_lolocked(lo, inode, nlookup);
1395     lo_inode_put(lo, &inode);
1396 }
1397
1398 static void lo_forget(fuse_req_t req, fuse_ino_t ino, uint64_t nlookup)
1399 {
1400     lo_forget_one(req, ino, nlookup);
1401     fuse_reply_none(req);
1402 }
1403
1404 static void lo_forget_multi(fuse_req_t req, size_t count,
1405                             struct fuse_forget_data *forgets)
1406 {
1407     int i;
1408
1409     for (i = 0; i < count; i++) {
1410         lo_forget_one(req, forgets[i].ino, forgets[i].nlookup);
1411     }
1412     fuse_reply_none(req);
1413 }
1414
1415 static void lo_readlink(fuse_req_t req, fuse_ino_t ino)
1416 {
1417     char buf[PATH_MAX + 1];
1418     int res;
1419
1420     res = readlinkat(lo_fd(req, ino), "", buf, sizeof(buf));
1421     if (res == -1) {
1422         return (void)fuse_reply_err(req, errno);
1423     }
1424
1425     if (res == sizeof(buf)) {
1426         return (void)fuse_reply_err(req, ENAMETOOLONG);
1427     }
1428
1429     buf[res] = '\0';
1430
1431     fuse_reply_readlink(req, buf);
1432 }
1433
1434 struct lo_dirp {
1435     gint refcount;
1436     DIR *dp;
1437     struct dirent *entry;
1438     off_t offset;
1439 };
1440
1441 static void lo_dirp_put(struct lo_dirp **dp)
1442 {
1443     struct lo_dirp *d = *dp;
1444
1445     if (!d) {
1446         return;
1447     }
1448     *dp = NULL;
1449
1450     if (g_atomic_int_dec_and_test(&d->refcount)) {
1451         closedir(d->dp);
1452         free(d);
1453     }
1454 }
1455
1456 /* Call lo_dirp_put() on the return value when no longer needed */
1457 static struct lo_dirp *lo_dirp(fuse_req_t req, struct fuse_file_info *fi)
1458 {
1459     struct lo_data *lo = lo_data(req);
1460     struct lo_map_elem *elem;
1461
1462     pthread_mutex_lock(&lo->mutex);
1463     elem = lo_map_get(&lo->dirp_map, fi->fh);
1464     if (elem) {
1465         g_atomic_int_inc(&elem->dirp->refcount);
1466     }
1467     pthread_mutex_unlock(&lo->mutex);
1468     if (!elem) {
1469         return NULL;
1470     }
1471
1472     return elem->dirp;
1473 }
1474
1475 static void lo_opendir(fuse_req_t req, fuse_ino_t ino,
1476                        struct fuse_file_info *fi)
1477 {
1478     int error = ENOMEM;
1479     struct lo_data *lo = lo_data(req);
1480     struct lo_dirp *d;
1481     int fd;
1482     ssize_t fh;
1483
1484     d = calloc(1, sizeof(struct lo_dirp));
1485     if (d == NULL) {
1486         goto out_err;
1487     }
1488
1489     fd = openat(lo_fd(req, ino), ".", O_RDONLY);
1490     if (fd == -1) {
1491         goto out_errno;
1492     }
1493
1494     d->dp = fdopendir(fd);
1495     if (d->dp == NULL) {
1496         goto out_errno;
1497     }
1498
1499     d->offset = 0;
1500     d->entry = NULL;
1501
1502     g_atomic_int_set(&d->refcount, 1); /* paired with lo_releasedir() */
1503     pthread_mutex_lock(&lo->mutex);
1504     fh = lo_add_dirp_mapping(req, d);
1505     pthread_mutex_unlock(&lo->mutex);
1506     if (fh == -1) {
1507         goto out_err;
1508     }
1509
1510     fi->fh = fh;
1511     if (lo->cache == CACHE_ALWAYS) {
1512         fi->cache_readdir = 1;
1513     }
1514     fuse_reply_open(req, fi);
1515     return;
1516
1517 out_errno:
1518     error = errno;
1519 out_err:
1520     if (d) {
1521         if (d->dp) {
1522             closedir(d->dp);
1523         } else if (fd != -1) {
1524             close(fd);
1525         }
1526         free(d);
1527     }
1528     fuse_reply_err(req, error);
1529 }
1530
1531 static void lo_do_readdir(fuse_req_t req, fuse_ino_t ino, size_t size,
1532                           off_t offset, struct fuse_file_info *fi, int plus)
1533 {
1534     struct lo_data *lo = lo_data(req);
1535     struct lo_dirp *d = NULL;
1536     struct lo_inode *dinode;
1537     char *buf = NULL;
1538     char *p;
1539     size_t rem = size;
1540     int err = EBADF;
1541
1542     dinode = lo_inode(req, ino);
1543     if (!dinode) {
1544         goto error;
1545     }
1546
1547     d = lo_dirp(req, fi);
1548     if (!d) {
1549         goto error;
1550     }
1551
1552     err = ENOMEM;
1553     buf = calloc(1, size);
1554     if (!buf) {
1555         goto error;
1556     }
1557     p = buf;
1558
1559     if (offset != d->offset) {
1560         seekdir(d->dp, offset);
1561         d->entry = NULL;
1562         d->offset = offset;
1563     }
1564     while (1) {
1565         size_t entsize;
1566         off_t nextoff;
1567         const char *name;
1568
1569         if (!d->entry) {
1570             errno = 0;
1571             d->entry = readdir(d->dp);
1572             if (!d->entry) {
1573                 if (errno) { /* Error */
1574                     err = errno;
1575                     goto error;
1576                 } else { /* End of stream */
1577                     break;
1578                 }
1579             }
1580         }
1581         nextoff = d->entry->d_off;
1582         name = d->entry->d_name;
1583
1584         fuse_ino_t entry_ino = 0;
1585         struct fuse_entry_param e = (struct fuse_entry_param){
1586             .attr.st_ino = d->entry->d_ino,
1587             .attr.st_mode = d->entry->d_type << 12,
1588         };
1589
1590         /* Hide root's parent directory */
1591         if (dinode == &lo->root && strcmp(name, "..") == 0) {
1592             e.attr.st_ino = lo->root.key.ino;
1593             e.attr.st_mode = DT_DIR << 12;
1594         }
1595
1596         if (plus) {
1597             if (!is_dot_or_dotdot(name)) {
1598                 err = lo_do_lookup(req, ino, name, &e);
1599                 if (err) {
1600                     goto error;
1601                 }
1602                 entry_ino = e.ino;
1603             }
1604
1605             entsize = fuse_add_direntry_plus(req, p, rem, name, &e, nextoff);
1606         } else {
1607             entsize = fuse_add_direntry(req, p, rem, name, &e.attr, nextoff);
1608         }
1609         if (entsize > rem) {
1610             if (entry_ino != 0) {
1611                 lo_forget_one(req, entry_ino, 1);
1612             }
1613             break;
1614         }
1615
1616         p += entsize;
1617         rem -= entsize;
1618
1619         d->entry = NULL;
1620         d->offset = nextoff;
1621     }
1622
1623     err = 0;
1624 error:
1625     lo_dirp_put(&d);
1626     lo_inode_put(lo, &dinode);
1627
1628     /*
1629      * If there's an error, we can only signal it if we haven't stored
1630      * any entries yet - otherwise we'd end up with wrong lookup
1631      * counts for the entries that are already in the buffer. So we
1632      * return what we've collected until that point.
1633      */
1634     if (err && rem == size) {
1635         fuse_reply_err(req, err);
1636     } else {
1637         fuse_reply_buf(req, buf, size - rem);
1638     }
1639     free(buf);
1640 }
1641
1642 static void lo_readdir(fuse_req_t req, fuse_ino_t ino, size_t size,
1643                        off_t offset, struct fuse_file_info *fi)
1644 {
1645     lo_do_readdir(req, ino, size, offset, fi, 0);
1646 }
1647
1648 static void lo_readdirplus(fuse_req_t req, fuse_ino_t ino, size_t size,
1649                            off_t offset, struct fuse_file_info *fi)
1650 {
1651     lo_do_readdir(req, ino, size, offset, fi, 1);
1652 }
1653
1654 static void lo_releasedir(fuse_req_t req, fuse_ino_t ino,
1655                           struct fuse_file_info *fi)
1656 {
1657     struct lo_data *lo = lo_data(req);
1658     struct lo_map_elem *elem;
1659     struct lo_dirp *d;
1660
1661     (void)ino;
1662
1663     pthread_mutex_lock(&lo->mutex);
1664     elem = lo_map_get(&lo->dirp_map, fi->fh);
1665     if (!elem) {
1666         pthread_mutex_unlock(&lo->mutex);
1667         fuse_reply_err(req, EBADF);
1668         return;
1669     }
1670
1671     d = elem->dirp;
1672     lo_map_remove(&lo->dirp_map, fi->fh);
1673     pthread_mutex_unlock(&lo->mutex);
1674
1675     lo_dirp_put(&d); /* paired with lo_opendir() */
1676
1677     fuse_reply_err(req, 0);
1678 }
1679
1680 static void update_open_flags(int writeback, struct fuse_file_info *fi)
1681 {
1682     /*
1683      * With writeback cache, kernel may send read requests even
1684      * when userspace opened write-only
1685      */
1686     if (writeback && (fi->flags & O_ACCMODE) == O_WRONLY) {
1687         fi->flags &= ~O_ACCMODE;
1688         fi->flags |= O_RDWR;
1689     }
1690
1691     /*
1692      * With writeback cache, O_APPEND is handled by the kernel.
1693      * This breaks atomicity (since the file may change in the
1694      * underlying filesystem, so that the kernel's idea of the
1695      * end of the file isn't accurate anymore). In this example,
1696      * we just accept that. A more rigorous filesystem may want
1697      * to return an error here
1698      */
1699     if (writeback && (fi->flags & O_APPEND)) {
1700         fi->flags &= ~O_APPEND;
1701     }
1702
1703     /*
1704      * O_DIRECT in guest should not necessarily mean bypassing page
1705      * cache on host as well. If somebody needs that behavior, it
1706      * probably should be a configuration knob in daemon.
1707      */
1708     fi->flags &= ~O_DIRECT;
1709 }
1710
1711 static void lo_create(fuse_req_t req, fuse_ino_t parent, const char *name,
1712                       mode_t mode, struct fuse_file_info *fi)
1713 {
1714     int fd;
1715     struct lo_data *lo = lo_data(req);
1716     struct lo_inode *parent_inode;
1717     struct fuse_entry_param e;
1718     int err;
1719     struct lo_cred old = {};
1720
1721     fuse_log(FUSE_LOG_DEBUG, "lo_create(parent=%" PRIu64 ", name=%s)\n", parent,
1722              name);
1723
1724     if (!is_safe_path_component(name)) {
1725         fuse_reply_err(req, EINVAL);
1726         return;
1727     }
1728
1729     parent_inode = lo_inode(req, parent);
1730     if (!parent_inode) {
1731         fuse_reply_err(req, EBADF);
1732         return;
1733     }
1734
1735     err = lo_change_cred(req, &old);
1736     if (err) {
1737         goto out;
1738     }
1739
1740     update_open_flags(lo->writeback, fi);
1741
1742     fd = openat(parent_inode->fd, name, (fi->flags | O_CREAT) & ~O_NOFOLLOW,
1743                 mode);
1744     err = fd == -1 ? errno : 0;
1745     lo_restore_cred(&old);
1746
1747     if (!err) {
1748         ssize_t fh;
1749
1750         pthread_mutex_lock(&lo->mutex);
1751         fh = lo_add_fd_mapping(req, fd);
1752         pthread_mutex_unlock(&lo->mutex);
1753         if (fh == -1) {
1754             close(fd);
1755             err = ENOMEM;
1756             goto out;
1757         }
1758
1759         fi->fh = fh;
1760         err = lo_do_lookup(req, parent, name, &e);
1761     }
1762     if (lo->cache == CACHE_NONE) {
1763         fi->direct_io = 1;
1764     } else if (lo->cache == CACHE_ALWAYS) {
1765         fi->keep_cache = 1;
1766     }
1767
1768 out:
1769     lo_inode_put(lo, &parent_inode);
1770
1771     if (err) {
1772         fuse_reply_err(req, err);
1773     } else {
1774         fuse_reply_create(req, &e, fi);
1775     }
1776 }
1777
1778 /* Should be called with inode->plock_mutex held */
1779 static struct lo_inode_plock *lookup_create_plock_ctx(struct lo_data *lo,
1780                                                       struct lo_inode *inode,
1781                                                       uint64_t lock_owner,
1782                                                       pid_t pid, int *err)
1783 {
1784     struct lo_inode_plock *plock;
1785     char procname[64];
1786     int fd;
1787
1788     plock =
1789         g_hash_table_lookup(inode->posix_locks, GUINT_TO_POINTER(lock_owner));
1790
1791     if (plock) {
1792         return plock;
1793     }
1794
1795     plock = malloc(sizeof(struct lo_inode_plock));
1796     if (!plock) {
1797         *err = ENOMEM;
1798         return NULL;
1799     }
1800
1801     /* Open another instance of file which can be used for ofd locks. */
1802     sprintf(procname, "%i", inode->fd);
1803
1804     /* TODO: What if file is not writable? */
1805     fd = openat(lo->proc_self_fd, procname, O_RDWR);
1806     if (fd == -1) {
1807         *err = errno;
1808         free(plock);
1809         return NULL;
1810     }
1811
1812     plock->lock_owner = lock_owner;
1813     plock->fd = fd;
1814     g_hash_table_insert(inode->posix_locks, GUINT_TO_POINTER(plock->lock_owner),
1815                         plock);
1816     return plock;
1817 }
1818
1819 static void lo_getlk(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi,
1820                      struct flock *lock)
1821 {
1822     struct lo_data *lo = lo_data(req);
1823     struct lo_inode *inode;
1824     struct lo_inode_plock *plock;
1825     int ret, saverr = 0;
1826
1827     fuse_log(FUSE_LOG_DEBUG,
1828              "lo_getlk(ino=%" PRIu64 ", flags=%d)"
1829              " owner=0x%lx, l_type=%d l_start=0x%lx"
1830              " l_len=0x%lx\n",
1831              ino, fi->flags, fi->lock_owner, lock->l_type, lock->l_start,
1832              lock->l_len);
1833
1834     inode = lo_inode(req, ino);
1835     if (!inode) {
1836         fuse_reply_err(req, EBADF);
1837         return;
1838     }
1839
1840     pthread_mutex_lock(&inode->plock_mutex);
1841     plock =
1842         lookup_create_plock_ctx(lo, inode, fi->lock_owner, lock->l_pid, &ret);
1843     if (!plock) {
1844         saverr = ret;
1845         goto out;
1846     }
1847
1848     ret = fcntl(plock->fd, F_OFD_GETLK, lock);
1849     if (ret == -1) {
1850         saverr = errno;
1851     }
1852
1853 out:
1854     pthread_mutex_unlock(&inode->plock_mutex);
1855     lo_inode_put(lo, &inode);
1856
1857     if (saverr) {
1858         fuse_reply_err(req, saverr);
1859     } else {
1860         fuse_reply_lock(req, lock);
1861     }
1862 }
1863
1864 static void lo_setlk(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi,
1865                      struct flock *lock, int sleep)
1866 {
1867     struct lo_data *lo = lo_data(req);
1868     struct lo_inode *inode;
1869     struct lo_inode_plock *plock;
1870     int ret, saverr = 0;
1871
1872     fuse_log(FUSE_LOG_DEBUG,
1873              "lo_setlk(ino=%" PRIu64 ", flags=%d)"
1874              " cmd=%d pid=%d owner=0x%lx sleep=%d l_whence=%d"
1875              " l_start=0x%lx l_len=0x%lx\n",
1876              ino, fi->flags, lock->l_type, lock->l_pid, fi->lock_owner, sleep,
1877              lock->l_whence, lock->l_start, lock->l_len);
1878
1879     if (sleep) {
1880         fuse_reply_err(req, EOPNOTSUPP);
1881         return;
1882     }
1883
1884     inode = lo_inode(req, ino);
1885     if (!inode) {
1886         fuse_reply_err(req, EBADF);
1887         return;
1888     }
1889
1890     pthread_mutex_lock(&inode->plock_mutex);
1891     plock =
1892         lookup_create_plock_ctx(lo, inode, fi->lock_owner, lock->l_pid, &ret);
1893
1894     if (!plock) {
1895         saverr = ret;
1896         goto out;
1897     }
1898
1899     /* TODO: Is it alright to modify flock? */
1900     lock->l_pid = 0;
1901     ret = fcntl(plock->fd, F_OFD_SETLK, lock);
1902     if (ret == -1) {
1903         saverr = errno;
1904     }
1905
1906 out:
1907     pthread_mutex_unlock(&inode->plock_mutex);
1908     lo_inode_put(lo, &inode);
1909
1910     fuse_reply_err(req, saverr);
1911 }
1912
1913 static void lo_fsyncdir(fuse_req_t req, fuse_ino_t ino, int datasync,
1914                         struct fuse_file_info *fi)
1915 {
1916     int res;
1917     struct lo_dirp *d;
1918     int fd;
1919
1920     (void)ino;
1921
1922     d = lo_dirp(req, fi);
1923     if (!d) {
1924         fuse_reply_err(req, EBADF);
1925         return;
1926     }
1927
1928     fd = dirfd(d->dp);
1929     if (datasync) {
1930         res = fdatasync(fd);
1931     } else {
1932         res = fsync(fd);
1933     }
1934
1935     lo_dirp_put(&d);
1936
1937     fuse_reply_err(req, res == -1 ? errno : 0);
1938 }
1939
1940 static void lo_open(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi)
1941 {
1942     int fd;
1943     ssize_t fh;
1944     char buf[64];
1945     struct lo_data *lo = lo_data(req);
1946
1947     fuse_log(FUSE_LOG_DEBUG, "lo_open(ino=%" PRIu64 ", flags=%d)\n", ino,
1948              fi->flags);
1949
1950     update_open_flags(lo->writeback, fi);
1951
1952     sprintf(buf, "%i", lo_fd(req, ino));
1953     fd = openat(lo->proc_self_fd, buf, fi->flags & ~O_NOFOLLOW);
1954     if (fd == -1) {
1955         return (void)fuse_reply_err(req, errno);
1956     }
1957
1958     pthread_mutex_lock(&lo->mutex);
1959     fh = lo_add_fd_mapping(req, fd);
1960     pthread_mutex_unlock(&lo->mutex);
1961     if (fh == -1) {
1962         close(fd);
1963         fuse_reply_err(req, ENOMEM);
1964         return;
1965     }
1966
1967     fi->fh = fh;
1968     if (lo->cache == CACHE_NONE) {
1969         fi->direct_io = 1;
1970     } else if (lo->cache == CACHE_ALWAYS) {
1971         fi->keep_cache = 1;
1972     }
1973     fuse_reply_open(req, fi);
1974 }
1975
1976 static void lo_release(fuse_req_t req, fuse_ino_t ino,
1977                        struct fuse_file_info *fi)
1978 {
1979     struct lo_data *lo = lo_data(req);
1980     struct lo_map_elem *elem;
1981     int fd = -1;
1982
1983     (void)ino;
1984
1985     pthread_mutex_lock(&lo->mutex);
1986     elem = lo_map_get(&lo->fd_map, fi->fh);
1987     if (elem) {
1988         fd = elem->fd;
1989         elem = NULL;
1990         lo_map_remove(&lo->fd_map, fi->fh);
1991     }
1992     pthread_mutex_unlock(&lo->mutex);
1993
1994     close(fd);
1995     fuse_reply_err(req, 0);
1996 }
1997
1998 static void lo_flush(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi)
1999 {
2000     int res;
2001     (void)ino;
2002     struct lo_inode *inode;
2003
2004     inode = lo_inode(req, ino);
2005     if (!inode) {
2006         fuse_reply_err(req, EBADF);
2007         return;
2008     }
2009
2010     /* An fd is going away. Cleanup associated posix locks */
2011     pthread_mutex_lock(&inode->plock_mutex);
2012     g_hash_table_remove(inode->posix_locks, GUINT_TO_POINTER(fi->lock_owner));
2013     pthread_mutex_unlock(&inode->plock_mutex);
2014
2015     res = close(dup(lo_fi_fd(req, fi)));
2016     lo_inode_put(lo_data(req), &inode);
2017     fuse_reply_err(req, res == -1 ? errno : 0);
2018 }
2019
2020 static void lo_fsync(fuse_req_t req, fuse_ino_t ino, int datasync,
2021                      struct fuse_file_info *fi)
2022 {
2023     int res;
2024     int fd;
2025     char *buf;
2026
2027     fuse_log(FUSE_LOG_DEBUG, "lo_fsync(ino=%" PRIu64 ", fi=0x%p)\n", ino,
2028              (void *)fi);
2029
2030     if (!fi) {
2031         struct lo_data *lo = lo_data(req);
2032
2033         res = asprintf(&buf, "%i", lo_fd(req, ino));
2034         if (res == -1) {
2035             return (void)fuse_reply_err(req, errno);
2036         }
2037
2038         fd = openat(lo->proc_self_fd, buf, O_RDWR);
2039         free(buf);
2040         if (fd == -1) {
2041             return (void)fuse_reply_err(req, errno);
2042         }
2043     } else {
2044         fd = lo_fi_fd(req, fi);
2045     }
2046
2047     if (datasync) {
2048         res = fdatasync(fd);
2049     } else {
2050         res = fsync(fd);
2051     }
2052     if (!fi) {
2053         close(fd);
2054     }
2055     fuse_reply_err(req, res == -1 ? errno : 0);
2056 }
2057
2058 static void lo_read(fuse_req_t req, fuse_ino_t ino, size_t size, off_t offset,
2059                     struct fuse_file_info *fi)
2060 {
2061     struct fuse_bufvec buf = FUSE_BUFVEC_INIT(size);
2062
2063     fuse_log(FUSE_LOG_DEBUG,
2064              "lo_read(ino=%" PRIu64 ", size=%zd, "
2065              "off=%lu)\n",
2066              ino, size, (unsigned long)offset);
2067
2068     buf.buf[0].flags = FUSE_BUF_IS_FD | FUSE_BUF_FD_SEEK;
2069     buf.buf[0].fd = lo_fi_fd(req, fi);
2070     buf.buf[0].pos = offset;
2071
2072     fuse_reply_data(req, &buf);
2073 }
2074
2075 static void lo_write_buf(fuse_req_t req, fuse_ino_t ino,
2076                          struct fuse_bufvec *in_buf, off_t off,
2077                          struct fuse_file_info *fi)
2078 {
2079     (void)ino;
2080     ssize_t res;
2081     struct fuse_bufvec out_buf = FUSE_BUFVEC_INIT(fuse_buf_size(in_buf));
2082     bool cap_fsetid_dropped = false;
2083
2084     out_buf.buf[0].flags = FUSE_BUF_IS_FD | FUSE_BUF_FD_SEEK;
2085     out_buf.buf[0].fd = lo_fi_fd(req, fi);
2086     out_buf.buf[0].pos = off;
2087
2088     fuse_log(FUSE_LOG_DEBUG,
2089              "lo_write_buf(ino=%" PRIu64 ", size=%zd, off=%lu)\n", ino,
2090              out_buf.buf[0].size, (unsigned long)off);
2091
2092     /*
2093      * If kill_priv is set, drop CAP_FSETID which should lead to kernel
2094      * clearing setuid/setgid on file.
2095      */
2096     if (fi->kill_priv) {
2097         res = drop_effective_cap("FSETID", &cap_fsetid_dropped);
2098         if (res != 0) {
2099             fuse_reply_err(req, res);
2100             return;
2101         }
2102     }
2103
2104     res = fuse_buf_copy(&out_buf, in_buf);
2105     if (res < 0) {
2106         fuse_reply_err(req, -res);
2107     } else {
2108         fuse_reply_write(req, (size_t)res);
2109     }
2110
2111     if (cap_fsetid_dropped) {
2112         res = gain_effective_cap("FSETID");
2113         if (res) {
2114             fuse_log(FUSE_LOG_ERR, "Failed to gain CAP_FSETID\n");
2115         }
2116     }
2117 }
2118
2119 static void lo_statfs(fuse_req_t req, fuse_ino_t ino)
2120 {
2121     int res;
2122     struct statvfs stbuf;
2123
2124     res = fstatvfs(lo_fd(req, ino), &stbuf);
2125     if (res == -1) {
2126         fuse_reply_err(req, errno);
2127     } else {
2128         fuse_reply_statfs(req, &stbuf);
2129     }
2130 }
2131
2132 static void lo_fallocate(fuse_req_t req, fuse_ino_t ino, int mode, off_t offset,
2133                          off_t length, struct fuse_file_info *fi)
2134 {
2135     int err = EOPNOTSUPP;
2136     (void)ino;
2137
2138 #ifdef CONFIG_FALLOCATE
2139     err = fallocate(lo_fi_fd(req, fi), mode, offset, length);
2140     if (err < 0) {
2141         err = errno;
2142     }
2143
2144 #elif defined(CONFIG_POSIX_FALLOCATE)
2145     if (mode) {
2146         fuse_reply_err(req, EOPNOTSUPP);
2147         return;
2148     }
2149
2150     err = posix_fallocate(lo_fi_fd(req, fi), offset, length);
2151 #endif
2152
2153     fuse_reply_err(req, err);
2154 }
2155
2156 static void lo_flock(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi,
2157                      int op)
2158 {
2159     int res;
2160     (void)ino;
2161
2162     res = flock(lo_fi_fd(req, fi), op);
2163
2164     fuse_reply_err(req, res == -1 ? errno : 0);
2165 }
2166
2167 static void lo_getxattr(fuse_req_t req, fuse_ino_t ino, const char *name,
2168                         size_t size)
2169 {
2170     struct lo_data *lo = lo_data(req);
2171     char *value = NULL;
2172     char procname[64];
2173     struct lo_inode *inode;
2174     ssize_t ret;
2175     int saverr;
2176     int fd = -1;
2177
2178     inode = lo_inode(req, ino);
2179     if (!inode) {
2180         fuse_reply_err(req, EBADF);
2181         return;
2182     }
2183
2184     saverr = ENOSYS;
2185     if (!lo_data(req)->xattr) {
2186         goto out;
2187     }
2188
2189     fuse_log(FUSE_LOG_DEBUG, "lo_getxattr(ino=%" PRIu64 ", name=%s size=%zd)\n",
2190              ino, name, size);
2191
2192     if (size) {
2193         value = malloc(size);
2194         if (!value) {
2195             goto out_err;
2196         }
2197     }
2198
2199     sprintf(procname, "%i", inode->fd);
2200     /*
2201      * It is not safe to open() non-regular/non-dir files in file server
2202      * unless O_PATH is used, so use that method for regular files/dir
2203      * only (as it seems giving less performance overhead).
2204      * Otherwise, call fchdir() to avoid open().
2205      */
2206     if (S_ISREG(inode->filetype) || S_ISDIR(inode->filetype)) {
2207         fd = openat(lo->proc_self_fd, procname, O_RDONLY);
2208         if (fd < 0) {
2209             goto out_err;
2210         }
2211         ret = fgetxattr(fd, name, value, size);
2212     } else {
2213         /* fchdir should not fail here */
2214         assert(fchdir(lo->proc_self_fd) == 0);
2215         ret = getxattr(procname, name, value, size);
2216         assert(fchdir(lo->root.fd) == 0);
2217     }
2218
2219     if (ret == -1) {
2220         goto out_err;
2221     }
2222     if (size) {
2223         saverr = 0;
2224         if (ret == 0) {
2225             goto out;
2226         }
2227         fuse_reply_buf(req, value, ret);
2228     } else {
2229         fuse_reply_xattr(req, ret);
2230     }
2231 out_free:
2232     free(value);
2233
2234     if (fd >= 0) {
2235         close(fd);
2236     }
2237
2238     lo_inode_put(lo, &inode);
2239     return;
2240
2241 out_err:
2242     saverr = errno;
2243 out:
2244     fuse_reply_err(req, saverr);
2245     goto out_free;
2246 }
2247
2248 static void lo_listxattr(fuse_req_t req, fuse_ino_t ino, size_t size)
2249 {
2250     struct lo_data *lo = lo_data(req);
2251     char *value = NULL;
2252     char procname[64];
2253     struct lo_inode *inode;
2254     ssize_t ret;
2255     int saverr;
2256     int fd = -1;
2257
2258     inode = lo_inode(req, ino);
2259     if (!inode) {
2260         fuse_reply_err(req, EBADF);
2261         return;
2262     }
2263
2264     saverr = ENOSYS;
2265     if (!lo_data(req)->xattr) {
2266         goto out;
2267     }
2268
2269     fuse_log(FUSE_LOG_DEBUG, "lo_listxattr(ino=%" PRIu64 ", size=%zd)\n", ino,
2270              size);
2271
2272     if (size) {
2273         value = malloc(size);
2274         if (!value) {
2275             goto out_err;
2276         }
2277     }
2278
2279     sprintf(procname, "%i", inode->fd);
2280     if (S_ISREG(inode->filetype) || S_ISDIR(inode->filetype)) {
2281         fd = openat(lo->proc_self_fd, procname, O_RDONLY);
2282         if (fd < 0) {
2283             goto out_err;
2284         }
2285         ret = flistxattr(fd, value, size);
2286     } else {
2287         /* fchdir should not fail here */
2288         assert(fchdir(lo->proc_self_fd) == 0);
2289         ret = listxattr(procname, value, size);
2290         assert(fchdir(lo->root.fd) == 0);
2291     }
2292
2293     if (ret == -1) {
2294         goto out_err;
2295     }
2296     if (size) {
2297         saverr = 0;
2298         if (ret == 0) {
2299             goto out;
2300         }
2301         fuse_reply_buf(req, value, ret);
2302     } else {
2303         fuse_reply_xattr(req, ret);
2304     }
2305 out_free:
2306     free(value);
2307
2308     if (fd >= 0) {
2309         close(fd);
2310     }
2311
2312     lo_inode_put(lo, &inode);
2313     return;
2314
2315 out_err:
2316     saverr = errno;
2317 out:
2318     fuse_reply_err(req, saverr);
2319     goto out_free;
2320 }
2321
2322 static void lo_setxattr(fuse_req_t req, fuse_ino_t ino, const char *name,
2323                         const char *value, size_t size, int flags)
2324 {
2325     char procname[64];
2326     struct lo_data *lo = lo_data(req);
2327     struct lo_inode *inode;
2328     ssize_t ret;
2329     int saverr;
2330     int fd = -1;
2331
2332     inode = lo_inode(req, ino);
2333     if (!inode) {
2334         fuse_reply_err(req, EBADF);
2335         return;
2336     }
2337
2338     saverr = ENOSYS;
2339     if (!lo_data(req)->xattr) {
2340         goto out;
2341     }
2342
2343     fuse_log(FUSE_LOG_DEBUG, "lo_setxattr(ino=%" PRIu64
2344              ", name=%s value=%s size=%zd)\n", ino, name, value, size);
2345
2346     sprintf(procname, "%i", inode->fd);
2347     if (S_ISREG(inode->filetype) || S_ISDIR(inode->filetype)) {
2348         fd = openat(lo->proc_self_fd, procname, O_RDONLY);
2349         if (fd < 0) {
2350             saverr = errno;
2351             goto out;
2352         }
2353         ret = fsetxattr(fd, name, value, size, flags);
2354     } else {
2355         /* fchdir should not fail here */
2356         assert(fchdir(lo->proc_self_fd) == 0);
2357         ret = setxattr(procname, name, value, size, flags);
2358         assert(fchdir(lo->root.fd) == 0);
2359     }
2360
2361     saverr = ret == -1 ? errno : 0;
2362
2363 out:
2364     if (fd >= 0) {
2365         close(fd);
2366     }
2367
2368     lo_inode_put(lo, &inode);
2369     fuse_reply_err(req, saverr);
2370 }
2371
2372 static void lo_removexattr(fuse_req_t req, fuse_ino_t ino, const char *name)
2373 {
2374     char procname[64];
2375     struct lo_data *lo = lo_data(req);
2376     struct lo_inode *inode;
2377     ssize_t ret;
2378     int saverr;
2379     int fd = -1;
2380
2381     inode = lo_inode(req, ino);
2382     if (!inode) {
2383         fuse_reply_err(req, EBADF);
2384         return;
2385     }
2386
2387     saverr = ENOSYS;
2388     if (!lo_data(req)->xattr) {
2389         goto out;
2390     }
2391
2392     fuse_log(FUSE_LOG_DEBUG, "lo_removexattr(ino=%" PRIu64 ", name=%s)\n", ino,
2393              name);
2394
2395     sprintf(procname, "%i", inode->fd);
2396     if (S_ISREG(inode->filetype) || S_ISDIR(inode->filetype)) {
2397         fd = openat(lo->proc_self_fd, procname, O_RDONLY);
2398         if (fd < 0) {
2399             saverr = errno;
2400             goto out;
2401         }
2402         ret = fremovexattr(fd, name);
2403     } else {
2404         /* fchdir should not fail here */
2405         assert(fchdir(lo->proc_self_fd) == 0);
2406         ret = removexattr(procname, name);
2407         assert(fchdir(lo->root.fd) == 0);
2408     }
2409
2410     saverr = ret == -1 ? errno : 0;
2411
2412 out:
2413     if (fd >= 0) {
2414         close(fd);
2415     }
2416
2417     lo_inode_put(lo, &inode);
2418     fuse_reply_err(req, saverr);
2419 }
2420
2421 #ifdef HAVE_COPY_FILE_RANGE
2422 static void lo_copy_file_range(fuse_req_t req, fuse_ino_t ino_in, off_t off_in,
2423                                struct fuse_file_info *fi_in, fuse_ino_t ino_out,
2424                                off_t off_out, struct fuse_file_info *fi_out,
2425                                size_t len, int flags)
2426 {
2427     int in_fd, out_fd;
2428     ssize_t res;
2429
2430     in_fd = lo_fi_fd(req, fi_in);
2431     out_fd = lo_fi_fd(req, fi_out);
2432
2433     fuse_log(FUSE_LOG_DEBUG,
2434              "lo_copy_file_range(ino=%" PRIu64 "/fd=%d, "
2435              "off=%lu, ino=%" PRIu64 "/fd=%d, "
2436              "off=%lu, size=%zd, flags=0x%x)\n",
2437              ino_in, in_fd, off_in, ino_out, out_fd, off_out, len, flags);
2438
2439     res = copy_file_range(in_fd, &off_in, out_fd, &off_out, len, flags);
2440     if (res < 0) {
2441         fuse_reply_err(req, errno);
2442     } else {
2443         fuse_reply_write(req, res);
2444     }
2445 }
2446 #endif
2447
2448 static void lo_lseek(fuse_req_t req, fuse_ino_t ino, off_t off, int whence,
2449                      struct fuse_file_info *fi)
2450 {
2451     off_t res;
2452
2453     (void)ino;
2454     res = lseek(lo_fi_fd(req, fi), off, whence);
2455     if (res != -1) {
2456         fuse_reply_lseek(req, res);
2457     } else {
2458         fuse_reply_err(req, errno);
2459     }
2460 }
2461
2462 static void lo_destroy(void *userdata)
2463 {
2464     struct lo_data *lo = (struct lo_data *)userdata;
2465
2466     pthread_mutex_lock(&lo->mutex);
2467     while (true) {
2468         GHashTableIter iter;
2469         gpointer key, value;
2470
2471         g_hash_table_iter_init(&iter, lo->inodes);
2472         if (!g_hash_table_iter_next(&iter, &key, &value)) {
2473             break;
2474         }
2475
2476         struct lo_inode *inode = value;
2477         unref_inode(lo, inode, inode->nlookup);
2478     }
2479     pthread_mutex_unlock(&lo->mutex);
2480 }
2481
2482 static struct fuse_lowlevel_ops lo_oper = {
2483     .init = lo_init,
2484     .lookup = lo_lookup,
2485     .mkdir = lo_mkdir,
2486     .mknod = lo_mknod,
2487     .symlink = lo_symlink,
2488     .link = lo_link,
2489     .unlink = lo_unlink,
2490     .rmdir = lo_rmdir,
2491     .rename = lo_rename,
2492     .forget = lo_forget,
2493     .forget_multi = lo_forget_multi,
2494     .getattr = lo_getattr,
2495     .setattr = lo_setattr,
2496     .readlink = lo_readlink,
2497     .opendir = lo_opendir,
2498     .readdir = lo_readdir,
2499     .readdirplus = lo_readdirplus,
2500     .releasedir = lo_releasedir,
2501     .fsyncdir = lo_fsyncdir,
2502     .create = lo_create,
2503     .getlk = lo_getlk,
2504     .setlk = lo_setlk,
2505     .open = lo_open,
2506     .release = lo_release,
2507     .flush = lo_flush,
2508     .fsync = lo_fsync,
2509     .read = lo_read,
2510     .write_buf = lo_write_buf,
2511     .statfs = lo_statfs,
2512     .fallocate = lo_fallocate,
2513     .flock = lo_flock,
2514     .getxattr = lo_getxattr,
2515     .listxattr = lo_listxattr,
2516     .setxattr = lo_setxattr,
2517     .removexattr = lo_removexattr,
2518 #ifdef HAVE_COPY_FILE_RANGE
2519     .copy_file_range = lo_copy_file_range,
2520 #endif
2521     .lseek = lo_lseek,
2522     .destroy = lo_destroy,
2523 };
2524
2525 /* Print vhost-user.json backend program capabilities */
2526 static void print_capabilities(void)
2527 {
2528     printf("{\n");
2529     printf("  \"type\": \"fs\"\n");
2530     printf("}\n");
2531 }
2532
2533 /*
2534  * Move to a new mount, net, and pid namespaces to isolate this process.
2535  */
2536 static void setup_namespaces(struct lo_data *lo, struct fuse_session *se)
2537 {
2538     pid_t child;
2539
2540     /*
2541      * Create a new pid namespace for *child* processes.  We'll have to
2542      * fork in order to enter the new pid namespace.  A new mount namespace
2543      * is also needed so that we can remount /proc for the new pid
2544      * namespace.
2545      *
2546      * Our UNIX domain sockets have been created.  Now we can move to
2547      * an empty network namespace to prevent TCP/IP and other network
2548      * activity in case this process is compromised.
2549      */
2550     if (unshare(CLONE_NEWPID | CLONE_NEWNS | CLONE_NEWNET) != 0) {
2551         fuse_log(FUSE_LOG_ERR, "unshare(CLONE_NEWPID | CLONE_NEWNS): %m\n");
2552         exit(1);
2553     }
2554
2555     child = fork();
2556     if (child < 0) {
2557         fuse_log(FUSE_LOG_ERR, "fork() failed: %m\n");
2558         exit(1);
2559     }
2560     if (child > 0) {
2561         pid_t waited;
2562         int wstatus;
2563
2564         /* The parent waits for the child */
2565         do {
2566             waited = waitpid(child, &wstatus, 0);
2567         } while (waited < 0 && errno == EINTR && !se->exited);
2568
2569         /* We were terminated by a signal, see fuse_signals.c */
2570         if (se->exited) {
2571             exit(0);
2572         }
2573
2574         if (WIFEXITED(wstatus)) {
2575             exit(WEXITSTATUS(wstatus));
2576         }
2577
2578         exit(1);
2579     }
2580
2581     /* Send us SIGTERM when the parent thread terminates, see prctl(2) */
2582     prctl(PR_SET_PDEATHSIG, SIGTERM);
2583
2584     /*
2585      * If the mounts have shared propagation then we want to opt out so our
2586      * mount changes don't affect the parent mount namespace.
2587      */
2588     if (mount(NULL, "/", NULL, MS_REC | MS_SLAVE, NULL) < 0) {
2589         fuse_log(FUSE_LOG_ERR, "mount(/, MS_REC|MS_SLAVE): %m\n");
2590         exit(1);
2591     }
2592
2593     /* The child must remount /proc to use the new pid namespace */
2594     if (mount("proc", "/proc", "proc",
2595               MS_NODEV | MS_NOEXEC | MS_NOSUID | MS_RELATIME, NULL) < 0) {
2596         fuse_log(FUSE_LOG_ERR, "mount(/proc): %m\n");
2597         exit(1);
2598     }
2599
2600     /* Now we can get our /proc/self/fd directory file descriptor */
2601     lo->proc_self_fd = open("/proc/self/fd", O_PATH);
2602     if (lo->proc_self_fd == -1) {
2603         fuse_log(FUSE_LOG_ERR, "open(/proc/self/fd, O_PATH): %m\n");
2604         exit(1);
2605     }
2606 }
2607
2608 /*
2609  * Capture the capability state, we'll need to restore this for individual
2610  * threads later; see load_capng.
2611  */
2612 static void setup_capng(void)
2613 {
2614     /* Note this accesses /proc so has to happen before the sandbox */
2615     if (capng_get_caps_process()) {
2616         fuse_log(FUSE_LOG_ERR, "capng_get_caps_process\n");
2617         exit(1);
2618     }
2619     pthread_mutex_init(&cap.mutex, NULL);
2620     pthread_mutex_lock(&cap.mutex);
2621     cap.saved = capng_save_state();
2622     if (!cap.saved) {
2623         fuse_log(FUSE_LOG_ERR, "capng_save_state\n");
2624         exit(1);
2625     }
2626     pthread_mutex_unlock(&cap.mutex);
2627 }
2628
2629 static void cleanup_capng(void)
2630 {
2631     free(cap.saved);
2632     cap.saved = NULL;
2633     pthread_mutex_destroy(&cap.mutex);
2634 }
2635
2636
2637 /*
2638  * Make the source directory our root so symlinks cannot escape and no other
2639  * files are accessible.  Assumes unshare(CLONE_NEWNS) was already called.
2640  */
2641 static void setup_mounts(const char *source)
2642 {
2643     int oldroot;
2644     int newroot;
2645
2646     if (mount(source, source, NULL, MS_BIND, NULL) < 0) {
2647         fuse_log(FUSE_LOG_ERR, "mount(%s, %s, MS_BIND): %m\n", source, source);
2648         exit(1);
2649     }
2650
2651     /* This magic is based on lxc's lxc_pivot_root() */
2652     oldroot = open("/", O_DIRECTORY | O_RDONLY | O_CLOEXEC);
2653     if (oldroot < 0) {
2654         fuse_log(FUSE_LOG_ERR, "open(/): %m\n");
2655         exit(1);
2656     }
2657
2658     newroot = open(source, O_DIRECTORY | O_RDONLY | O_CLOEXEC);
2659     if (newroot < 0) {
2660         fuse_log(FUSE_LOG_ERR, "open(%s): %m\n", source);
2661         exit(1);
2662     }
2663
2664     if (fchdir(newroot) < 0) {
2665         fuse_log(FUSE_LOG_ERR, "fchdir(newroot): %m\n");
2666         exit(1);
2667     }
2668
2669     if (syscall(__NR_pivot_root, ".", ".") < 0) {
2670         fuse_log(FUSE_LOG_ERR, "pivot_root(., .): %m\n");
2671         exit(1);
2672     }
2673
2674     if (fchdir(oldroot) < 0) {
2675         fuse_log(FUSE_LOG_ERR, "fchdir(oldroot): %m\n");
2676         exit(1);
2677     }
2678
2679     if (mount("", ".", "", MS_SLAVE | MS_REC, NULL) < 0) {
2680         fuse_log(FUSE_LOG_ERR, "mount(., MS_SLAVE | MS_REC): %m\n");
2681         exit(1);
2682     }
2683
2684     if (umount2(".", MNT_DETACH) < 0) {
2685         fuse_log(FUSE_LOG_ERR, "umount2(., MNT_DETACH): %m\n");
2686         exit(1);
2687     }
2688
2689     if (fchdir(newroot) < 0) {
2690         fuse_log(FUSE_LOG_ERR, "fchdir(newroot): %m\n");
2691         exit(1);
2692     }
2693
2694     close(newroot);
2695     close(oldroot);
2696 }
2697
2698 /*
2699  * Lock down this process to prevent access to other processes or files outside
2700  * source directory.  This reduces the impact of arbitrary code execution bugs.
2701  */
2702 static void setup_sandbox(struct lo_data *lo, struct fuse_session *se,
2703                           bool enable_syslog)
2704 {
2705     setup_namespaces(lo, se);
2706     setup_mounts(lo->source);
2707     setup_seccomp(enable_syslog);
2708 }
2709
2710 /* Raise the maximum number of open file descriptors */
2711 static void setup_nofile_rlimit(void)
2712 {
2713     const rlim_t max_fds = 1000000;
2714     struct rlimit rlim;
2715
2716     if (getrlimit(RLIMIT_NOFILE, &rlim) < 0) {
2717         fuse_log(FUSE_LOG_ERR, "getrlimit(RLIMIT_NOFILE): %m\n");
2718         exit(1);
2719     }
2720
2721     if (rlim.rlim_cur >= max_fds) {
2722         return; /* nothing to do */
2723     }
2724
2725     rlim.rlim_cur = max_fds;
2726     rlim.rlim_max = max_fds;
2727
2728     if (setrlimit(RLIMIT_NOFILE, &rlim) < 0) {
2729         /* Ignore SELinux denials */
2730         if (errno == EPERM) {
2731             return;
2732         }
2733
2734         fuse_log(FUSE_LOG_ERR, "setrlimit(RLIMIT_NOFILE): %m\n");
2735         exit(1);
2736     }
2737 }
2738
2739 static void log_func(enum fuse_log_level level, const char *fmt, va_list ap)
2740 {
2741     g_autofree char *localfmt = NULL;
2742
2743     if (current_log_level < level) {
2744         return;
2745     }
2746
2747     if (current_log_level == FUSE_LOG_DEBUG) {
2748         if (!use_syslog) {
2749             localfmt = g_strdup_printf("[%" PRId64 "] [ID: %08ld] %s",
2750                                        get_clock(), syscall(__NR_gettid), fmt);
2751         } else {
2752             localfmt = g_strdup_printf("[ID: %08ld] %s", syscall(__NR_gettid),
2753                                        fmt);
2754         }
2755         fmt = localfmt;
2756     }
2757
2758     if (use_syslog) {
2759         int priority = LOG_ERR;
2760         switch (level) {
2761         case FUSE_LOG_EMERG:
2762             priority = LOG_EMERG;
2763             break;
2764         case FUSE_LOG_ALERT:
2765             priority = LOG_ALERT;
2766             break;
2767         case FUSE_LOG_CRIT:
2768             priority = LOG_CRIT;
2769             break;
2770         case FUSE_LOG_ERR:
2771             priority = LOG_ERR;
2772             break;
2773         case FUSE_LOG_WARNING:
2774             priority = LOG_WARNING;
2775             break;
2776         case FUSE_LOG_NOTICE:
2777             priority = LOG_NOTICE;
2778             break;
2779         case FUSE_LOG_INFO:
2780             priority = LOG_INFO;
2781             break;
2782         case FUSE_LOG_DEBUG:
2783             priority = LOG_DEBUG;
2784             break;
2785         }
2786         vsyslog(priority, fmt, ap);
2787     } else {
2788         vfprintf(stderr, fmt, ap);
2789     }
2790 }
2791
2792 static void setup_root(struct lo_data *lo, struct lo_inode *root)
2793 {
2794     int fd, res;
2795     struct stat stat;
2796
2797     fd = open("/", O_PATH);
2798     if (fd == -1) {
2799         fuse_log(FUSE_LOG_ERR, "open(%s, O_PATH): %m\n", lo->source);
2800         exit(1);
2801     }
2802
2803     res = fstatat(fd, "", &stat, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
2804     if (res == -1) {
2805         fuse_log(FUSE_LOG_ERR, "fstatat(%s): %m\n", lo->source);
2806         exit(1);
2807     }
2808
2809     root->filetype = S_IFDIR;
2810     root->fd = fd;
2811     root->key.ino = stat.st_ino;
2812     root->key.dev = stat.st_dev;
2813     root->nlookup = 2;
2814     g_atomic_int_set(&root->refcount, 2);
2815 }
2816
2817 static guint lo_key_hash(gconstpointer key)
2818 {
2819     const struct lo_key *lkey = key;
2820
2821     return (guint)lkey->ino + (guint)lkey->dev;
2822 }
2823
2824 static gboolean lo_key_equal(gconstpointer a, gconstpointer b)
2825 {
2826     const struct lo_key *la = a;
2827     const struct lo_key *lb = b;
2828
2829     return la->ino == lb->ino && la->dev == lb->dev;
2830 }
2831
2832 static void fuse_lo_data_cleanup(struct lo_data *lo)
2833 {
2834     if (lo->inodes) {
2835         g_hash_table_destroy(lo->inodes);
2836     }
2837     lo_map_destroy(&lo->fd_map);
2838     lo_map_destroy(&lo->dirp_map);
2839     lo_map_destroy(&lo->ino_map);
2840
2841     if (lo->proc_self_fd >= 0) {
2842         close(lo->proc_self_fd);
2843     }
2844
2845     if (lo->root.fd >= 0) {
2846         close(lo->root.fd);
2847     }
2848
2849     free(lo->source);
2850 }
2851
2852 int main(int argc, char *argv[])
2853 {
2854     struct fuse_args args = FUSE_ARGS_INIT(argc, argv);
2855     struct fuse_session *se;
2856     struct fuse_cmdline_opts opts;
2857     struct lo_data lo = {
2858         .debug = 0,
2859         .writeback = 0,
2860         .posix_lock = 1,
2861         .proc_self_fd = -1,
2862     };
2863     struct lo_map_elem *root_elem;
2864     int ret = -1;
2865
2866     /* Don't mask creation mode, kernel already did that */
2867     umask(0);
2868
2869     pthread_mutex_init(&lo.mutex, NULL);
2870     lo.inodes = g_hash_table_new(lo_key_hash, lo_key_equal);
2871     lo.root.fd = -1;
2872     lo.root.fuse_ino = FUSE_ROOT_ID;
2873     lo.cache = CACHE_AUTO;
2874
2875     /*
2876      * Set up the ino map like this:
2877      * [0] Reserved (will not be used)
2878      * [1] Root inode
2879      */
2880     lo_map_init(&lo.ino_map);
2881     lo_map_reserve(&lo.ino_map, 0)->in_use = false;
2882     root_elem = lo_map_reserve(&lo.ino_map, lo.root.fuse_ino);
2883     root_elem->inode = &lo.root;
2884
2885     lo_map_init(&lo.dirp_map);
2886     lo_map_init(&lo.fd_map);
2887
2888     if (fuse_parse_cmdline(&args, &opts) != 0) {
2889         goto err_out1;
2890     }
2891     fuse_set_log_func(log_func);
2892     use_syslog = opts.syslog;
2893     if (use_syslog) {
2894         openlog("virtiofsd", LOG_PID, LOG_DAEMON);
2895     }
2896
2897     if (opts.show_help) {
2898         printf("usage: %s [options]\n\n", argv[0]);
2899         fuse_cmdline_help();
2900         printf("    -o source=PATH             shared directory tree\n");
2901         fuse_lowlevel_help();
2902         ret = 0;
2903         goto err_out1;
2904     } else if (opts.show_version) {
2905         fuse_lowlevel_version();
2906         ret = 0;
2907         goto err_out1;
2908     } else if (opts.print_capabilities) {
2909         print_capabilities();
2910         ret = 0;
2911         goto err_out1;
2912     }
2913
2914     if (fuse_opt_parse(&args, &lo, lo_opts, NULL) == -1) {
2915         goto err_out1;
2916     }
2917
2918     /*
2919      * log_level is 0 if not configured via cmd options (0 is LOG_EMERG,
2920      * and we don't use this log level).
2921      */
2922     if (opts.log_level != 0) {
2923         current_log_level = opts.log_level;
2924     }
2925     lo.debug = opts.debug;
2926     if (lo.debug) {
2927         current_log_level = FUSE_LOG_DEBUG;
2928     }
2929     if (lo.source) {
2930         struct stat stat;
2931         int res;
2932
2933         res = lstat(lo.source, &stat);
2934         if (res == -1) {
2935             fuse_log(FUSE_LOG_ERR, "failed to stat source (\"%s\"): %m\n",
2936                      lo.source);
2937             exit(1);
2938         }
2939         if (!S_ISDIR(stat.st_mode)) {
2940             fuse_log(FUSE_LOG_ERR, "source is not a directory\n");
2941             exit(1);
2942         }
2943     } else {
2944         lo.source = strdup("/");
2945     }
2946     if (!lo.timeout_set) {
2947         switch (lo.cache) {
2948         case CACHE_NONE:
2949             lo.timeout = 0.0;
2950             break;
2951
2952         case CACHE_AUTO:
2953             lo.timeout = 1.0;
2954             break;
2955
2956         case CACHE_ALWAYS:
2957             lo.timeout = 86400.0;
2958             break;
2959         }
2960     } else if (lo.timeout < 0) {
2961         fuse_log(FUSE_LOG_ERR, "timeout is negative (%lf)\n", lo.timeout);
2962         exit(1);
2963     }
2964
2965     se = fuse_session_new(&args, &lo_oper, sizeof(lo_oper), &lo);
2966     if (se == NULL) {
2967         goto err_out1;
2968     }
2969
2970     if (fuse_set_signal_handlers(se) != 0) {
2971         goto err_out2;
2972     }
2973
2974     if (fuse_session_mount(se) != 0) {
2975         goto err_out3;
2976     }
2977
2978     fuse_daemonize(opts.foreground);
2979
2980     setup_nofile_rlimit();
2981
2982     /* Must be before sandbox since it wants /proc */
2983     setup_capng();
2984
2985     setup_sandbox(&lo, se, opts.syslog);
2986
2987     setup_root(&lo, &lo.root);
2988     /* Block until ctrl+c or fusermount -u */
2989     ret = virtio_loop(se);
2990
2991     fuse_session_unmount(se);
2992     cleanup_capng();
2993 err_out3:
2994     fuse_remove_signal_handlers(se);
2995 err_out2:
2996     fuse_session_destroy(se);
2997 err_out1:
2998     fuse_opt_free_args(&args);
2999
3000     fuse_lo_data_cleanup(&lo);
3001
3002     return ret ? 1 : 0;
3003 }