tools/virtiofsd/passthrough_ll.c

   1 /*
   2  * FUSE: Filesystem in Userspace
   3  * Copyright (C) 2001-2007  Miklos Szeredi <miklos@szeredi.hu>
   4  *
   5  * This program can be distributed under the terms of the GNU GPLv2.
   6  * See the file COPYING.
   7  */
   8
   9 /*
  10  *
  11  * This file system mirrors the existing file system hierarchy of the
  12  * system, starting at the root file system. This is implemented by
  13  * just "passing through" all requests to the corresponding user-space
  14  * libc functions. In contrast to passthrough.c and passthrough_fh.c,
  15  * this implementation uses the low-level API. Its performance should
  16  * be the least bad among the three, but many operations are not
  17  * implemented. In particular, it is not possible to remove files (or
  18  * directories) because the code necessary to defer actual removal
  19  * until the file is not opened anymore would make the example much
  20  * more complicated.
  21  *
  22  * When writeback caching is enabled (-o writeback mount option), it
  23  * is only possible to write to files for which the mounting user has
  24  * read permissions. This is because the writeback cache requires the
  25  * kernel to be able to issue read requests for all files (which the
  26  * passthrough filesystem cannot satisfy if it can't read the file in
  27  * the underlying filesystem).
  28  *
  29  * Compile with:
  30  *
  31  *     gcc -Wall passthrough_ll.c `pkg-config fuse3 --cflags --libs` -o
  32  * passthrough_ll
  33  *
  34  * ## Source code ##
  35  * \include passthrough_ll.c
  36  */
  37
  38 #include "qemu/osdep.h"
  39 #include "qemu/timer.h"
  40 #include "fuse_virtio.h"
  41 #include "fuse_log.h"
  42 #include "fuse_lowlevel.h"
  43 #include <assert.h>
  44 #include <cap-ng.h>
  45 #include <dirent.h>
  46 #include <errno.h>
  47 #include <glib.h>
  48 #include <inttypes.h>
  49 #include <limits.h>
  50 #include <pthread.h>
  51 #include <stdbool.h>
  52 #include <stddef.h>
  53 #include <stdio.h>
  54 #include <stdlib.h>
  55 #include <string.h>
  56 #include <sys/file.h>
  57 #include <sys/mount.h>
  58 #include <sys/prctl.h>
  59 #include <sys/resource.h>
  60 #include <sys/syscall.h>
  61 #include <sys/types.h>
  62 #include <sys/wait.h>
  63 #include <sys/xattr.h>
  64 #include <syslog.h>
  65 #include <unistd.h>
  66
  67 #include "passthrough_helpers.h"
  68 #include "seccomp.h"
  69
  70 struct lo_map_elem {
  71     union {
  72         struct lo_inode *inode;
  73         struct lo_dirp *dirp;
  74         int fd;
  75         ssize_t freelist;
  76     };
  77     bool in_use;
  78 };
  79
  80 /* Maps FUSE fh or ino values to internal objects */
  81 struct lo_map {
  82     struct lo_map_elem *elems;
  83     size_t nelems;
  84     ssize_t freelist;
  85 };
  86
  87 struct lo_key {
  88     ino_t ino;
  89     dev_t dev;
  90 };
  91
  92 struct lo_inode {
  93     int fd;
  94     bool is_symlink;
  95     struct lo_key key;
  96     uint64_t refcount; /* protected by lo->mutex */
  97     fuse_ino_t fuse_ino;
  98 };
  99
 100 struct lo_cred {
 101     uid_t euid;
 102     gid_t egid;
 103 };
 104
 105 enum {
 106     CACHE_NONE,
 107     CACHE_AUTO,
 108     CACHE_ALWAYS,
 109 };
 110
 111 struct lo_data {
 112     pthread_mutex_t mutex;
 113     int debug;
 114     int norace;
 115     int writeback;
 116     int flock;
 117     int xattr;
 118     const char *source;
 119     double timeout;
 120     int cache;
 121     int timeout_set;
 122     int readdirplus_set;
 123     int readdirplus_clear;
 124     struct lo_inode root;
 125     GHashTable *inodes; /* protected by lo->mutex */
 126     struct lo_map ino_map; /* protected by lo->mutex */
 127     struct lo_map dirp_map; /* protected by lo->mutex */
 128     struct lo_map fd_map; /* protected by lo->mutex */
 129
 130     /* An O_PATH file descriptor to /proc/self/fd/ */
 131     int proc_self_fd;
 132 };
 133
 134 static const struct fuse_opt lo_opts[] = {
 135     { "writeback", offsetof(struct lo_data, writeback), 1 },
 136     { "no_writeback", offsetof(struct lo_data, writeback), 0 },
 137     { "source=%s", offsetof(struct lo_data, source), 0 },
 138     { "flock", offsetof(struct lo_data, flock), 1 },
 139     { "no_flock", offsetof(struct lo_data, flock), 0 },
 140     { "xattr", offsetof(struct lo_data, xattr), 1 },
 141     { "no_xattr", offsetof(struct lo_data, xattr), 0 },
 142     { "timeout=%lf", offsetof(struct lo_data, timeout), 0 },
 143     { "timeout=", offsetof(struct lo_data, timeout_set), 1 },
 144     { "cache=none", offsetof(struct lo_data, cache), CACHE_NONE },
 145     { "cache=auto", offsetof(struct lo_data, cache), CACHE_AUTO },
 146     { "cache=always", offsetof(struct lo_data, cache), CACHE_ALWAYS },
 147     { "norace", offsetof(struct lo_data, norace), 1 },
 148     { "readdirplus", offsetof(struct lo_data, readdirplus_set), 1 },
 149     { "no_readdirplus", offsetof(struct lo_data, readdirplus_clear), 1 },
 150     FUSE_OPT_END
 151 };
 152 static bool use_syslog = false;
 153 static int current_log_level;
 154 static void unref_inode_lolocked(struct lo_data *lo, struct lo_inode *inode,
 155                                  uint64_t n);
 156
 157 static struct {
 158     pthread_mutex_t mutex;
 159     void *saved;
 160 } cap;
 161 /* That we loaded cap-ng in the current thread from the saved */
 162 static __thread bool cap_loaded = 0;
 163
 164 static struct lo_inode *lo_find(struct lo_data *lo, struct stat *st);
 165
 166 static int is_dot_or_dotdot(const char *name)
 167 {
 168     return name[0] == '.' &&
 169            (name[1] == '\0' || (name[1] == '.' && name[2] == '\0'));
 170 }
 171
 172 /* Is `path` a single path component that is not "." or ".."? */
 173 static int is_safe_path_component(const char *path)
 174 {
 175     if (strchr(path, '/')) {
 176         return 0;
 177     }
 178
 179     return !is_dot_or_dotdot(path);
 180 }
 181
 182 static struct lo_data *lo_data(fuse_req_t req)
 183 {
 184     return (struct lo_data *)fuse_req_userdata(req);
 185 }
 186
 187 /*
 188  * Load capng's state from our saved state if the current thread
 189  * hadn't previously been loaded.
 190  * returns 0 on success
 191  */
 192 static int load_capng(void)
 193 {
 194     if (!cap_loaded) {
 195         pthread_mutex_lock(&cap.mutex);
 196         capng_restore_state(&cap.saved);
 197         /*
 198          * restore_state free's the saved copy
 199          * so make another.
 200          */
 201         cap.saved = capng_save_state();
 202         if (!cap.saved) {
 203             fuse_log(FUSE_LOG_ERR, "capng_save_state (thread)\n");
 204             return -EINVAL;
 205         }
 206         pthread_mutex_unlock(&cap.mutex);
 207
 208         /*
 209          * We want to use the loaded state for our pid,
 210          * not the original
 211          */
 212         capng_setpid(syscall(SYS_gettid));
 213         cap_loaded = true;
 214     }
 215     return 0;
 216 }
 217
 218 /*
 219  * Helpers for dropping and regaining effective capabilities. Returns 0
 220  * on success, error otherwise
 221  */
 222 static int drop_effective_cap(const char *cap_name, bool *cap_dropped)
 223 {
 224     int cap, ret;
 225
 226     cap = capng_name_to_capability(cap_name);
 227     if (cap < 0) {
 228         ret = errno;
 229         fuse_log(FUSE_LOG_ERR, "capng_name_to_capability(%s) failed:%s\n",
 230                  cap_name, strerror(errno));
 231         goto out;
 232     }
 233
 234     if (load_capng()) {
 235         ret = errno;
 236         fuse_log(FUSE_LOG_ERR, "load_capng() failed\n");
 237         goto out;
 238     }
 239
 240     /* We dont have this capability in effective set already. */
 241     if (!capng_have_capability(CAPNG_EFFECTIVE, cap)) {
 242         ret = 0;
 243         goto out;
 244     }
 245
 246     if (capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, cap)) {
 247         ret = errno;
 248         fuse_log(FUSE_LOG_ERR, "capng_update(DROP,) failed\n");
 249         goto out;
 250     }
 251
 252     if (capng_apply(CAPNG_SELECT_CAPS)) {
 253         ret = errno;
 254         fuse_log(FUSE_LOG_ERR, "drop:capng_apply() failed\n");
 255         goto out;
 256     }
 257
 258     ret = 0;
 259     if (cap_dropped) {
 260         *cap_dropped = true;
 261     }
 262
 263 out:
 264     return ret;
 265 }
 266
 267 static int gain_effective_cap(const char *cap_name)
 268 {
 269     int cap;
 270     int ret = 0;
 271
 272     cap = capng_name_to_capability(cap_name);
 273     if (cap < 0) {
 274         ret = errno;
 275         fuse_log(FUSE_LOG_ERR, "capng_name_to_capability(%s) failed:%s\n",
 276                  cap_name, strerror(errno));
 277         goto out;
 278     }
 279
 280     if (load_capng()) {
 281         ret = errno;
 282         fuse_log(FUSE_LOG_ERR, "load_capng() failed\n");
 283         goto out;
 284     }
 285
 286     if (capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, cap)) {
 287         ret = errno;
 288         fuse_log(FUSE_LOG_ERR, "capng_update(ADD,) failed\n");
 289         goto out;
 290     }
 291
 292     if (capng_apply(CAPNG_SELECT_CAPS)) {
 293         ret = errno;
 294         fuse_log(FUSE_LOG_ERR, "gain:capng_apply() failed\n");
 295         goto out;
 296     }
 297     ret = 0;
 298
 299 out:
 300     return ret;
 301 }
 302
 303 static void lo_map_init(struct lo_map *map)
 304 {
 305     map->elems = NULL;
 306     map->nelems = 0;
 307     map->freelist = -1;
 308 }
 309
 310 static void lo_map_destroy(struct lo_map *map)
 311 {
 312     free(map->elems);
 313 }
 314
 315 static int lo_map_grow(struct lo_map *map, size_t new_nelems)
 316 {
 317     struct lo_map_elem *new_elems;
 318     size_t i;
 319
 320     if (new_nelems <= map->nelems) {
 321         return 1;
 322     }
 323
 324     new_elems = realloc(map->elems, sizeof(map->elems[0]) * new_nelems);
 325     if (!new_elems) {
 326         return 0;
 327     }
 328
 329     for (i = map->nelems; i < new_nelems; i++) {
 330         new_elems[i].freelist = i + 1;
 331         new_elems[i].in_use = false;
 332     }
 333     new_elems[new_nelems - 1].freelist = -1;
 334
 335     map->elems = new_elems;
 336     map->freelist = map->nelems;
 337     map->nelems = new_nelems;
 338     return 1;
 339 }
 340
 341 static struct lo_map_elem *lo_map_alloc_elem(struct lo_map *map)
 342 {
 343     struct lo_map_elem *elem;
 344
 345     if (map->freelist == -1 && !lo_map_grow(map, map->nelems + 256)) {
 346         return NULL;
 347     }
 348
 349     elem = &map->elems[map->freelist];
 350     map->freelist = elem->freelist;
 351
 352     elem->in_use = true;
 353
 354     return elem;
 355 }
 356
 357 static struct lo_map_elem *lo_map_reserve(struct lo_map *map, size_t key)
 358 {
 359     ssize_t *prev;
 360
 361     if (!lo_map_grow(map, key + 1)) {
 362         return NULL;
 363     }
 364
 365     for (prev = &map->freelist; *prev != -1;
 366          prev = &map->elems[*prev].freelist) {
 367         if (*prev == key) {
 368             struct lo_map_elem *elem = &map->elems[key];
 369
 370             *prev = elem->freelist;
 371             elem->in_use = true;
 372             return elem;
 373         }
 374     }
 375     return NULL;
 376 }
 377
 378 static struct lo_map_elem *lo_map_get(struct lo_map *map, size_t key)
 379 {
 380     if (key >= map->nelems) {
 381         return NULL;
 382     }
 383     if (!map->elems[key].in_use) {
 384         return NULL;
 385     }
 386     return &map->elems[key];
 387 }
 388
 389 static void lo_map_remove(struct lo_map *map, size_t key)
 390 {
 391     struct lo_map_elem *elem;
 392
 393     if (key >= map->nelems) {
 394         return;
 395     }
 396
 397     elem = &map->elems[key];
 398     if (!elem->in_use) {
 399         return;
 400     }
 401
 402     elem->in_use = false;
 403
 404     elem->freelist = map->freelist;
 405     map->freelist = key;
 406 }
 407
 408 /* Assumes lo->mutex is held */
 409 static ssize_t lo_add_fd_mapping(fuse_req_t req, int fd)
 410 {
 411     struct lo_map_elem *elem;
 412
 413     elem = lo_map_alloc_elem(&lo_data(req)->fd_map);
 414     if (!elem) {
 415         return -1;
 416     }
 417
 418     elem->fd = fd;
 419     return elem - lo_data(req)->fd_map.elems;
 420 }
 421
 422 /* Assumes lo->mutex is held */
 423 static ssize_t lo_add_dirp_mapping(fuse_req_t req, struct lo_dirp *dirp)
 424 {
 425     struct lo_map_elem *elem;
 426
 427     elem = lo_map_alloc_elem(&lo_data(req)->dirp_map);
 428     if (!elem) {
 429         return -1;
 430     }
 431
 432     elem->dirp = dirp;
 433     return elem - lo_data(req)->dirp_map.elems;
 434 }
 435
 436 /* Assumes lo->mutex is held */
 437 static ssize_t lo_add_inode_mapping(fuse_req_t req, struct lo_inode *inode)
 438 {
 439     struct lo_map_elem *elem;
 440
 441     elem = lo_map_alloc_elem(&lo_data(req)->ino_map);
 442     if (!elem) {
 443         return -1;
 444     }
 445
 446     elem->inode = inode;
 447     return elem - lo_data(req)->ino_map.elems;
 448 }
 449
 450 static struct lo_inode *lo_inode(fuse_req_t req, fuse_ino_t ino)
 451 {
 452     struct lo_data *lo = lo_data(req);
 453     struct lo_map_elem *elem;
 454
 455     pthread_mutex_lock(&lo->mutex);
 456     elem = lo_map_get(&lo->ino_map, ino);
 457     pthread_mutex_unlock(&lo->mutex);
 458
 459     if (!elem) {
 460         return NULL;
 461     }
 462
 463     return elem->inode;
 464 }
 465
 466 static int lo_fd(fuse_req_t req, fuse_ino_t ino)
 467 {
 468     struct lo_inode *inode = lo_inode(req, ino);
 469     return inode ? inode->fd : -1;
 470 }
 471
 472 static void lo_init(void *userdata, struct fuse_conn_info *conn)
 473 {
 474     struct lo_data *lo = (struct lo_data *)userdata;
 475
 476     if (conn->capable & FUSE_CAP_EXPORT_SUPPORT) {
 477         conn->want |= FUSE_CAP_EXPORT_SUPPORT;
 478     }
 479
 480     if (lo->writeback && conn->capable & FUSE_CAP_WRITEBACK_CACHE) {
 481         fuse_log(FUSE_LOG_DEBUG, "lo_init: activating writeback\n");
 482         conn->want |= FUSE_CAP_WRITEBACK_CACHE;
 483     }
 484     if (lo->flock && conn->capable & FUSE_CAP_FLOCK_LOCKS) {
 485         fuse_log(FUSE_LOG_DEBUG, "lo_init: activating flock locks\n");
 486         conn->want |= FUSE_CAP_FLOCK_LOCKS;
 487     }
 488     if ((lo->cache == CACHE_NONE && !lo->readdirplus_set) ||
 489         lo->readdirplus_clear) {
 490         fuse_log(FUSE_LOG_DEBUG, "lo_init: disabling readdirplus\n");
 491         conn->want &= ~FUSE_CAP_READDIRPLUS;
 492     }
 493 }
 494
 495 static void lo_getattr(fuse_req_t req, fuse_ino_t ino,
 496                        struct fuse_file_info *fi)
 497 {
 498     int res;
 499     struct stat buf;
 500     struct lo_data *lo = lo_data(req);
 501
 502     (void)fi;
 503
 504     res =
 505         fstatat(lo_fd(req, ino), "", &buf, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
 506     if (res == -1) {
 507         return (void)fuse_reply_err(req, errno);
 508     }
 509
 510     fuse_reply_attr(req, &buf, lo->timeout);
 511 }
 512
 513 static int lo_parent_and_name(struct lo_data *lo, struct lo_inode *inode,
 514                               char path[PATH_MAX], struct lo_inode **parent)
 515 {
 516     char procname[64];
 517     char *last;
 518     struct stat stat;
 519     struct lo_inode *p;
 520     int retries = 2;
 521     int res;
 522
 523 retry:
 524     sprintf(procname, "%i", inode->fd);
 525
 526     res = readlinkat(lo->proc_self_fd, procname, path, PATH_MAX);
 527     if (res < 0) {
 528         fuse_log(FUSE_LOG_WARNING, "%s: readlink failed: %m\n", __func__);
 529         goto fail_noretry;
 530     }
 531
 532     if (res >= PATH_MAX) {
 533         fuse_log(FUSE_LOG_WARNING, "%s: readlink overflowed\n", __func__);
 534         goto fail_noretry;
 535     }
 536     path[res] = '\0';
 537
 538     last = strrchr(path, '/');
 539     if (last == NULL) {
 540         /* Shouldn't happen */
 541         fuse_log(
 542             FUSE_LOG_WARNING,
 543             "%s: INTERNAL ERROR: bad path read from proc\n", __func__);
 544         goto fail_noretry;
 545     }
 546     if (last == path) {
 547         p = &lo->root;
 548         pthread_mutex_lock(&lo->mutex);
 549         p->refcount++;
 550         pthread_mutex_unlock(&lo->mutex);
 551     } else {
 552         *last = '\0';
 553         res = fstatat(AT_FDCWD, last == path ? "/" : path, &stat, 0);
 554         if (res == -1) {
 555             if (!retries) {
 556                 fuse_log(FUSE_LOG_WARNING,
 557                          "%s: failed to stat parent: %m\n", __func__);
 558             }
 559             goto fail;
 560         }
 561         p = lo_find(lo, &stat);
 562         if (p == NULL) {
 563             if (!retries) {
 564                 fuse_log(FUSE_LOG_WARNING,
 565                          "%s: failed to find parent\n", __func__);
 566             }
 567             goto fail;
 568         }
 569     }
 570     last++;
 571     res = fstatat(p->fd, last, &stat, AT_SYMLINK_NOFOLLOW);
 572     if (res == -1) {
 573         if (!retries) {
 574             fuse_log(FUSE_LOG_WARNING,
 575                      "%s: failed to stat last\n", __func__);
 576         }
 577         goto fail_unref;
 578     }
 579     if (stat.st_dev != inode->key.dev || stat.st_ino != inode->key.ino) {
 580         if (!retries) {
 581             fuse_log(FUSE_LOG_WARNING,
 582                      "%s: failed to match last\n", __func__);
 583         }
 584         goto fail_unref;
 585     }
 586     *parent = p;
 587     memmove(path, last, strlen(last) + 1);
 588
 589     return 0;
 590
 591 fail_unref:
 592     unref_inode_lolocked(lo, p, 1);
 593 fail:
 594     if (retries) {
 595         retries--;
 596         goto retry;
 597     }
 598 fail_noretry:
 599     errno = EIO;
 600     return -1;
 601 }
 602
 603 static int utimensat_empty(struct lo_data *lo, struct lo_inode *inode,
 604                            const struct timespec *tv)
 605 {
 606     int res;
 607     struct lo_inode *parent;
 608     char path[PATH_MAX];
 609
 610     if (inode->is_symlink) {
 611         res = utimensat(inode->fd, "", tv, AT_EMPTY_PATH);
 612         if (res == -1 && errno == EINVAL) {
 613             /* Sorry, no race free way to set times on symlink. */
 614             if (lo->norace) {
 615                 errno = EPERM;
 616             } else {
 617                 goto fallback;
 618             }
 619         }
 620         return res;
 621     }
 622     sprintf(path, "%i", inode->fd);
 623
 624     return utimensat(lo->proc_self_fd, path, tv, 0);
 625
 626 fallback:
 627     res = lo_parent_and_name(lo, inode, path, &parent);
 628     if (res != -1) {
 629         res = utimensat(parent->fd, path, tv, AT_SYMLINK_NOFOLLOW);
 630         unref_inode_lolocked(lo, parent, 1);
 631     }
 632
 633     return res;
 634 }
 635
 636 static int lo_fi_fd(fuse_req_t req, struct fuse_file_info *fi)
 637 {
 638     struct lo_data *lo = lo_data(req);
 639     struct lo_map_elem *elem;
 640
 641     pthread_mutex_lock(&lo->mutex);
 642     elem = lo_map_get(&lo->fd_map, fi->fh);
 643     pthread_mutex_unlock(&lo->mutex);
 644
 645     if (!elem) {
 646         return -1;
 647     }
 648
 649     return elem->fd;
 650 }
 651
 652 static void lo_setattr(fuse_req_t req, fuse_ino_t ino, struct stat *attr,
 653                        int valid, struct fuse_file_info *fi)
 654 {
 655     int saverr;
 656     char procname[64];
 657     struct lo_data *lo = lo_data(req);
 658     struct lo_inode *inode;
 659     int ifd;
 660     int res;
 661     int fd;
 662
 663     inode = lo_inode(req, ino);
 664     if (!inode) {
 665         fuse_reply_err(req, EBADF);
 666         return;
 667     }
 668
 669     ifd = inode->fd;
 670
 671     /* If fi->fh is invalid we'll report EBADF later */
 672     if (fi) {
 673         fd = lo_fi_fd(req, fi);
 674     }
 675
 676     if (valid & FUSE_SET_ATTR_MODE) {
 677         if (fi) {
 678             res = fchmod(fd, attr->st_mode);
 679         } else {
 680             sprintf(procname, "%i", ifd);
 681             res = fchmodat(lo->proc_self_fd, procname, attr->st_mode, 0);
 682         }
 683         if (res == -1) {
 684             goto out_err;
 685         }
 686     }
 687     if (valid & (FUSE_SET_ATTR_UID | FUSE_SET_ATTR_GID)) {
 688         uid_t uid = (valid & FUSE_SET_ATTR_UID) ? attr->st_uid : (uid_t)-1;
 689         gid_t gid = (valid & FUSE_SET_ATTR_GID) ? attr->st_gid : (gid_t)-1;
 690
 691         res = fchownat(ifd, "", uid, gid, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
 692         if (res == -1) {
 693             goto out_err;
 694         }
 695     }
 696     if (valid & FUSE_SET_ATTR_SIZE) {
 697         int truncfd;
 698
 699         if (fi) {
 700             truncfd = fd;
 701         } else {
 702             sprintf(procname, "%i", ifd);
 703             truncfd = openat(lo->proc_self_fd, procname, O_RDWR);
 704             if (truncfd < 0) {
 705                 goto out_err;
 706             }
 707         }
 708
 709         res = ftruncate(truncfd, attr->st_size);
 710         if (!fi) {
 711             saverr = errno;
 712             close(truncfd);
 713             errno = saverr;
 714         }
 715         if (res == -1) {
 716             goto out_err;
 717         }
 718     }
 719     if (valid & (FUSE_SET_ATTR_ATIME | FUSE_SET_ATTR_MTIME)) {
 720         struct timespec tv[2];
 721
 722         tv[0].tv_sec = 0;
 723         tv[1].tv_sec = 0;
 724         tv[0].tv_nsec = UTIME_OMIT;
 725         tv[1].tv_nsec = UTIME_OMIT;
 726
 727         if (valid & FUSE_SET_ATTR_ATIME_NOW) {
 728             tv[0].tv_nsec = UTIME_NOW;
 729         } else if (valid & FUSE_SET_ATTR_ATIME) {
 730             tv[0] = attr->st_atim;
 731         }
 732
 733         if (valid & FUSE_SET_ATTR_MTIME_NOW) {
 734             tv[1].tv_nsec = UTIME_NOW;
 735         } else if (valid & FUSE_SET_ATTR_MTIME) {
 736             tv[1] = attr->st_mtim;
 737         }
 738
 739         if (fi) {
 740             res = futimens(fd, tv);
 741         } else {
 742             res = utimensat_empty(lo, inode, tv);
 743         }
 744         if (res == -1) {
 745             goto out_err;
 746         }
 747     }
 748
 749     return lo_getattr(req, ino, fi);
 750
 751 out_err:
 752     saverr = errno;
 753     fuse_reply_err(req, saverr);
 754 }
 755
 756 static struct lo_inode *lo_find(struct lo_data *lo, struct stat *st)
 757 {
 758     struct lo_inode *p;
 759     struct lo_key key = {
 760         .ino = st->st_ino,
 761         .dev = st->st_dev,
 762     };
 763
 764     pthread_mutex_lock(&lo->mutex);
 765     p = g_hash_table_lookup(lo->inodes, &key);
 766     if (p) {
 767         assert(p->refcount > 0);
 768         p->refcount++;
 769     }
 770     pthread_mutex_unlock(&lo->mutex);
 771
 772     return p;
 773 }
 774
 775 static int lo_do_lookup(fuse_req_t req, fuse_ino_t parent, const char *name,
 776                         struct fuse_entry_param *e)
 777 {
 778     int newfd;
 779     int res;
 780     int saverr;
 781     struct lo_data *lo = lo_data(req);
 782     struct lo_inode *inode, *dir = lo_inode(req, parent);
 783
 784     /*
 785      * name_to_handle_at() and open_by_handle_at() can reach here with fuse
 786      * mount point in guest, but we don't have its inode info in the
 787      * ino_map.
 788      */
 789     if (!dir) {
 790         return ENOENT;
 791     }
 792
 793     memset(e, 0, sizeof(*e));
 794     e->attr_timeout = lo->timeout;
 795     e->entry_timeout = lo->timeout;
 796
 797     /* Do not allow escaping root directory */
 798     if (dir == &lo->root && strcmp(name, "..") == 0) {
 799         name = ".";
 800     }
 801
 802     newfd = openat(dir->fd, name, O_PATH | O_NOFOLLOW);
 803     if (newfd == -1) {
 804         goto out_err;
 805     }
 806
 807     res = fstatat(newfd, "", &e->attr, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
 808     if (res == -1) {
 809         goto out_err;
 810     }
 811
 812     inode = lo_find(lo, &e->attr);
 813     if (inode) {
 814         close(newfd);
 815         newfd = -1;
 816     } else {
 817         saverr = ENOMEM;
 818         inode = calloc(1, sizeof(struct lo_inode));
 819         if (!inode) {
 820             goto out_err;
 821         }
 822
 823         inode->is_symlink = S_ISLNK(e->attr.st_mode);
 824         inode->refcount = 1;
 825         inode->fd = newfd;
 826         newfd = -1;
 827         inode->key.ino = e->attr.st_ino;
 828         inode->key.dev = e->attr.st_dev;
 829
 830         pthread_mutex_lock(&lo->mutex);
 831         inode->fuse_ino = lo_add_inode_mapping(req, inode);
 832         g_hash_table_insert(lo->inodes, &inode->key, inode);
 833         pthread_mutex_unlock(&lo->mutex);
 834     }
 835     e->ino = inode->fuse_ino;
 836
 837     fuse_log(FUSE_LOG_DEBUG, "  %lli/%s -> %lli\n", (unsigned long long)parent,
 838              name, (unsigned long long)e->ino);
 839
 840     return 0;
 841
 842 out_err:
 843     saverr = errno;
 844     if (newfd != -1) {
 845         close(newfd);
 846     }
 847     return saverr;
 848 }
 849
 850 static void lo_lookup(fuse_req_t req, fuse_ino_t parent, const char *name)
 851 {
 852     struct fuse_entry_param e;
 853     int err;
 854
 855     fuse_log(FUSE_LOG_DEBUG, "lo_lookup(parent=%" PRIu64 ", name=%s)\n", parent,
 856              name);
 857
 858     /*
 859      * Don't use is_safe_path_component(), allow "." and ".." for NFS export
 860      * support.
 861      */
 862     if (strchr(name, '/')) {
 863         fuse_reply_err(req, EINVAL);
 864         return;
 865     }
 866
 867     err = lo_do_lookup(req, parent, name, &e);
 868     if (err) {
 869         fuse_reply_err(req, err);
 870     } else {
 871         fuse_reply_entry(req, &e);
 872     }
 873 }
 874
 875 /*
 876  * On some archs, setres*id is limited to 2^16 but they
 877  * provide setres*id32 variants that allow 2^32.
 878  * Others just let setres*id do 2^32 anyway.
 879  */
 880 #ifdef SYS_setresgid32
 881 #define OURSYS_setresgid SYS_setresgid32
 882 #else
 883 #define OURSYS_setresgid SYS_setresgid
 884 #endif
 885
 886 #ifdef SYS_setresuid32
 887 #define OURSYS_setresuid SYS_setresuid32
 888 #else
 889 #define OURSYS_setresuid SYS_setresuid
 890 #endif
 891
 892 /*
 893  * Change to uid/gid of caller so that file is created with
 894  * ownership of caller.
 895  * TODO: What about selinux context?
 896  */
 897 static int lo_change_cred(fuse_req_t req, struct lo_cred *old)
 898 {
 899     int res;
 900
 901     old->euid = geteuid();
 902     old->egid = getegid();
 903
 904     res = syscall(OURSYS_setresgid, -1, fuse_req_ctx(req)->gid, -1);
 905     if (res == -1) {
 906         return errno;
 907     }
 908
 909     res = syscall(OURSYS_setresuid, -1, fuse_req_ctx(req)->uid, -1);
 910     if (res == -1) {
 911         int errno_save = errno;
 912
 913         syscall(OURSYS_setresgid, -1, old->egid, -1);
 914         return errno_save;
 915     }
 916
 917     return 0;
 918 }
 919
 920 /* Regain Privileges */
 921 static void lo_restore_cred(struct lo_cred *old)
 922 {
 923     int res;
 924
 925     res = syscall(OURSYS_setresuid, -1, old->euid, -1);
 926     if (res == -1) {
 927         fuse_log(FUSE_LOG_ERR, "seteuid(%u): %m\n", old->euid);
 928         exit(1);
 929     }
 930
 931     res = syscall(OURSYS_setresgid, -1, old->egid, -1);
 932     if (res == -1) {
 933         fuse_log(FUSE_LOG_ERR, "setegid(%u): %m\n", old->egid);
 934         exit(1);
 935     }
 936 }
 937
 938 static void lo_mknod_symlink(fuse_req_t req, fuse_ino_t parent,
 939                              const char *name, mode_t mode, dev_t rdev,
 940                              const char *link)
 941 {
 942     int res;
 943     int saverr;
 944     struct lo_inode *dir;
 945     struct fuse_entry_param e;
 946     struct lo_cred old = {};
 947
 948     if (!is_safe_path_component(name)) {
 949         fuse_reply_err(req, EINVAL);
 950         return;
 951     }
 952
 953     dir = lo_inode(req, parent);
 954     if (!dir) {
 955         fuse_reply_err(req, EBADF);
 956         return;
 957     }
 958
 959     saverr = ENOMEM;
 960
 961     saverr = lo_change_cred(req, &old);
 962     if (saverr) {
 963         goto out;
 964     }
 965
 966     res = mknod_wrapper(dir->fd, name, link, mode, rdev);
 967
 968     saverr = errno;
 969
 970     lo_restore_cred(&old);
 971
 972     if (res == -1) {
 973         goto out;
 974     }
 975
 976     saverr = lo_do_lookup(req, parent, name, &e);
 977     if (saverr) {
 978         goto out;
 979     }
 980
 981     fuse_log(FUSE_LOG_DEBUG, "  %lli/%s -> %lli\n", (unsigned long long)parent,
 982              name, (unsigned long long)e.ino);
 983
 984     fuse_reply_entry(req, &e);
 985     return;
 986
 987 out:
 988     fuse_reply_err(req, saverr);
 989 }
 990
 991 static void lo_mknod(fuse_req_t req, fuse_ino_t parent, const char *name,
 992                      mode_t mode, dev_t rdev)
 993 {
 994     lo_mknod_symlink(req, parent, name, mode, rdev, NULL);
 995 }
 996
 997 static void lo_mkdir(fuse_req_t req, fuse_ino_t parent, const char *name,
 998                      mode_t mode)
 999 {
1000     lo_mknod_symlink(req, parent, name, S_IFDIR | mode, 0, NULL);
1001 }
1002
1003 static void lo_symlink(fuse_req_t req, const char *link, fuse_ino_t parent,
1004                        const char *name)
1005 {
1006     lo_mknod_symlink(req, parent, name, S_IFLNK, 0, link);
1007 }
1008
1009 static int linkat_empty_nofollow(struct lo_data *lo, struct lo_inode *inode,
1010                                  int dfd, const char *name)
1011 {
1012     int res;
1013     struct lo_inode *parent;
1014     char path[PATH_MAX];
1015
1016     if (inode->is_symlink) {
1017         res = linkat(inode->fd, "", dfd, name, AT_EMPTY_PATH);
1018         if (res == -1 && (errno == ENOENT || errno == EINVAL)) {
1019             /* Sorry, no race free way to hard-link a symlink. */
1020             if (lo->norace) {
1021                 errno = EPERM;
1022             } else {
1023                 goto fallback;
1024             }
1025         }
1026         return res;
1027     }
1028
1029     sprintf(path, "%i", inode->fd);
1030
1031     return linkat(lo->proc_self_fd, path, dfd, name, AT_SYMLINK_FOLLOW);
1032
1033 fallback:
1034     res = lo_parent_and_name(lo, inode, path, &parent);
1035     if (res != -1) {
1036         res = linkat(parent->fd, path, dfd, name, 0);
1037         unref_inode_lolocked(lo, parent, 1);
1038     }
1039
1040     return res;
1041 }
1042
1043 static void lo_link(fuse_req_t req, fuse_ino_t ino, fuse_ino_t parent,
1044                     const char *name)
1045 {
1046     int res;
1047     struct lo_data *lo = lo_data(req);
1048     struct lo_inode *inode;
1049     struct fuse_entry_param e;
1050     int saverr;
1051
1052     if (!is_safe_path_component(name)) {
1053         fuse_reply_err(req, EINVAL);
1054         return;
1055     }
1056
1057     inode = lo_inode(req, ino);
1058     if (!inode) {
1059         fuse_reply_err(req, EBADF);
1060         return;
1061     }
1062
1063     memset(&e, 0, sizeof(struct fuse_entry_param));
1064     e.attr_timeout = lo->timeout;
1065     e.entry_timeout = lo->timeout;
1066
1067     res = linkat_empty_nofollow(lo, inode, lo_fd(req, parent), name);
1068     if (res == -1) {
1069         goto out_err;
1070     }
1071
1072     res = fstatat(inode->fd, "", &e.attr, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
1073     if (res == -1) {
1074         goto out_err;
1075     }
1076
1077     pthread_mutex_lock(&lo->mutex);
1078     inode->refcount++;
1079     pthread_mutex_unlock(&lo->mutex);
1080     e.ino = inode->fuse_ino;
1081
1082     fuse_log(FUSE_LOG_DEBUG, "  %lli/%s -> %lli\n", (unsigned long long)parent,
1083              name, (unsigned long long)e.ino);
1084
1085     fuse_reply_entry(req, &e);
1086     return;
1087
1088 out_err:
1089     saverr = errno;
1090     fuse_reply_err(req, saverr);
1091 }
1092
1093 static void lo_rmdir(fuse_req_t req, fuse_ino_t parent, const char *name)
1094 {
1095     int res;
1096     if (!is_safe_path_component(name)) {
1097         fuse_reply_err(req, EINVAL);
1098         return;
1099     }
1100
1101     res = unlinkat(lo_fd(req, parent), name, AT_REMOVEDIR);
1102
1103     fuse_reply_err(req, res == -1 ? errno : 0);
1104 }
1105
1106 static void lo_rename(fuse_req_t req, fuse_ino_t parent, const char *name,
1107                       fuse_ino_t newparent, const char *newname,
1108                       unsigned int flags)
1109 {
1110     int res;
1111
1112     if (!is_safe_path_component(name) || !is_safe_path_component(newname)) {
1113         fuse_reply_err(req, EINVAL);
1114         return;
1115     }
1116
1117     if (flags) {
1118 #ifndef SYS_renameat2
1119         fuse_reply_err(req, EINVAL);
1120 #else
1121         res = syscall(SYS_renameat2, lo_fd(req, parent), name,
1122                        lo_fd(req, newparent), newname, flags);
1123         if (res == -1 && errno == ENOSYS) {
1124             fuse_reply_err(req, EINVAL);
1125         } else {
1126             fuse_reply_err(req, res == -1 ? errno : 0);
1127         }
1128 #endif
1129         return;
1130     }
1131
1132     res = renameat(lo_fd(req, parent), name, lo_fd(req, newparent), newname);
1133
1134     fuse_reply_err(req, res == -1 ? errno : 0);
1135 }
1136
1137 static void lo_unlink(fuse_req_t req, fuse_ino_t parent, const char *name)
1138 {
1139     int res;
1140
1141     if (!is_safe_path_component(name)) {
1142         fuse_reply_err(req, EINVAL);
1143         return;
1144     }
1145
1146     res = unlinkat(lo_fd(req, parent), name, 0);
1147
1148     fuse_reply_err(req, res == -1 ? errno : 0);
1149 }
1150
1151 static void unref_inode_lolocked(struct lo_data *lo, struct lo_inode *inode,
1152                                  uint64_t n)
1153 {
1154     if (!inode) {
1155         return;
1156     }
1157
1158     pthread_mutex_lock(&lo->mutex);
1159     assert(inode->refcount >= n);
1160     inode->refcount -= n;
1161     if (!inode->refcount) {
1162         lo_map_remove(&lo->ino_map, inode->fuse_ino);
1163         g_hash_table_remove(lo->inodes, &inode->key);
1164         pthread_mutex_unlock(&lo->mutex);
1165         close(inode->fd);
1166         free(inode);
1167     } else {
1168         pthread_mutex_unlock(&lo->mutex);
1169     }
1170 }
1171
1172 static int unref_all_inodes_cb(gpointer key, gpointer value, gpointer user_data)
1173 {
1174     struct lo_inode *inode = value;
1175     struct lo_data *lo = user_data;
1176
1177     inode->refcount = 0;
1178     lo_map_remove(&lo->ino_map, inode->fuse_ino);
1179     close(inode->fd);
1180
1181     return TRUE;
1182 }
1183
1184 static void unref_all_inodes(struct lo_data *lo)
1185 {
1186     pthread_mutex_lock(&lo->mutex);
1187     g_hash_table_foreach_remove(lo->inodes, unref_all_inodes_cb, lo);
1188     pthread_mutex_unlock(&lo->mutex);
1189 }
1190
1191 static void lo_forget_one(fuse_req_t req, fuse_ino_t ino, uint64_t nlookup)
1192 {
1193     struct lo_data *lo = lo_data(req);
1194     struct lo_inode *inode;
1195
1196     inode = lo_inode(req, ino);
1197     if (!inode) {
1198         return;
1199     }
1200
1201     fuse_log(FUSE_LOG_DEBUG, "  forget %lli %lli -%lli\n",
1202              (unsigned long long)ino, (unsigned long long)inode->refcount,
1203              (unsigned long long)nlookup);
1204
1205     unref_inode_lolocked(lo, inode, nlookup);
1206 }
1207
1208 static void lo_forget(fuse_req_t req, fuse_ino_t ino, uint64_t nlookup)
1209 {
1210     lo_forget_one(req, ino, nlookup);
1211     fuse_reply_none(req);
1212 }
1213
1214 static void lo_forget_multi(fuse_req_t req, size_t count,
1215                             struct fuse_forget_data *forgets)
1216 {
1217     int i;
1218
1219     for (i = 0; i < count; i++) {
1220         lo_forget_one(req, forgets[i].ino, forgets[i].nlookup);
1221     }
1222     fuse_reply_none(req);
1223 }
1224
1225 static void lo_readlink(fuse_req_t req, fuse_ino_t ino)
1226 {
1227     char buf[PATH_MAX + 1];
1228     int res;
1229
1230     res = readlinkat(lo_fd(req, ino), "", buf, sizeof(buf));
1231     if (res == -1) {
1232         return (void)fuse_reply_err(req, errno);
1233     }
1234
1235     if (res == sizeof(buf)) {
1236         return (void)fuse_reply_err(req, ENAMETOOLONG);
1237     }
1238
1239     buf[res] = '\0';
1240
1241     fuse_reply_readlink(req, buf);
1242 }
1243
1244 struct lo_dirp {
1245     DIR *dp;
1246     struct dirent *entry;
1247     off_t offset;
1248 };
1249
1250 static struct lo_dirp *lo_dirp(fuse_req_t req, struct fuse_file_info *fi)
1251 {
1252     struct lo_data *lo = lo_data(req);
1253     struct lo_map_elem *elem;
1254
1255     pthread_mutex_lock(&lo->mutex);
1256     elem = lo_map_get(&lo->dirp_map, fi->fh);
1257     pthread_mutex_unlock(&lo->mutex);
1258     if (!elem) {
1259         return NULL;
1260     }
1261
1262     return elem->dirp;
1263 }
1264
1265 static void lo_opendir(fuse_req_t req, fuse_ino_t ino,
1266                        struct fuse_file_info *fi)
1267 {
1268     int error = ENOMEM;
1269     struct lo_data *lo = lo_data(req);
1270     struct lo_dirp *d;
1271     int fd;
1272     ssize_t fh;
1273
1274     d = calloc(1, sizeof(struct lo_dirp));
1275     if (d == NULL) {
1276         goto out_err;
1277     }
1278
1279     fd = openat(lo_fd(req, ino), ".", O_RDONLY);
1280     if (fd == -1) {
1281         goto out_errno;
1282     }
1283
1284     d->dp = fdopendir(fd);
1285     if (d->dp == NULL) {
1286         goto out_errno;
1287     }
1288
1289     d->offset = 0;
1290     d->entry = NULL;
1291
1292     pthread_mutex_lock(&lo->mutex);
1293     fh = lo_add_dirp_mapping(req, d);
1294     pthread_mutex_unlock(&lo->mutex);
1295     if (fh == -1) {
1296         goto out_err;
1297     }
1298
1299     fi->fh = fh;
1300     if (lo->cache == CACHE_ALWAYS) {
1301         fi->keep_cache = 1;
1302     }
1303     fuse_reply_open(req, fi);
1304     return;
1305
1306 out_errno:
1307     error = errno;
1308 out_err:
1309     if (d) {
1310         if (d->dp) {
1311             closedir(d->dp);
1312         }
1313         if (fd != -1) {
1314             close(fd);
1315         }
1316         free(d);
1317     }
1318     fuse_reply_err(req, error);
1319 }
1320
1321 static void lo_do_readdir(fuse_req_t req, fuse_ino_t ino, size_t size,
1322                           off_t offset, struct fuse_file_info *fi, int plus)
1323 {
1324     struct lo_data *lo = lo_data(req);
1325     struct lo_dirp *d;
1326     struct lo_inode *dinode;
1327     char *buf = NULL;
1328     char *p;
1329     size_t rem = size;
1330     int err = EBADF;
1331
1332     dinode = lo_inode(req, ino);
1333     if (!dinode) {
1334         goto error;
1335     }
1336
1337     d = lo_dirp(req, fi);
1338     if (!d) {
1339         goto error;
1340     }
1341
1342     err = ENOMEM;
1343     buf = calloc(1, size);
1344     if (!buf) {
1345         goto error;
1346     }
1347     p = buf;
1348
1349     if (offset != d->offset) {
1350         seekdir(d->dp, offset);
1351         d->entry = NULL;
1352         d->offset = offset;
1353     }
1354     while (1) {
1355         size_t entsize;
1356         off_t nextoff;
1357         const char *name;
1358
1359         if (!d->entry) {
1360             errno = 0;
1361             d->entry = readdir(d->dp);
1362             if (!d->entry) {
1363                 if (errno) { /* Error */
1364                     err = errno;
1365                     goto error;
1366                 } else { /* End of stream */
1367                     break;
1368                 }
1369             }
1370         }
1371         nextoff = d->entry->d_off;
1372         name = d->entry->d_name;
1373
1374         fuse_ino_t entry_ino = 0;
1375         struct fuse_entry_param e = (struct fuse_entry_param){
1376             .attr.st_ino = d->entry->d_ino,
1377             .attr.st_mode = d->entry->d_type << 12,
1378         };
1379
1380         /* Hide root's parent directory */
1381         if (dinode == &lo->root && strcmp(name, "..") == 0) {
1382             e.attr.st_ino = lo->root.key.ino;
1383             e.attr.st_mode = DT_DIR << 12;
1384         }
1385
1386         if (plus) {
1387             if (!is_dot_or_dotdot(name)) {
1388                 err = lo_do_lookup(req, ino, name, &e);
1389                 if (err) {
1390                     goto error;
1391                 }
1392                 entry_ino = e.ino;
1393             }
1394
1395             entsize = fuse_add_direntry_plus(req, p, rem, name, &e, nextoff);
1396         } else {
1397             entsize = fuse_add_direntry(req, p, rem, name, &e.attr, nextoff);
1398         }
1399         if (entsize > rem) {
1400             if (entry_ino != 0) {
1401                 lo_forget_one(req, entry_ino, 1);
1402             }
1403             break;
1404         }
1405
1406         p += entsize;
1407         rem -= entsize;
1408
1409         d->entry = NULL;
1410         d->offset = nextoff;
1411     }
1412
1413     err = 0;
1414 error:
1415     /*
1416      * If there's an error, we can only signal it if we haven't stored
1417      * any entries yet - otherwise we'd end up with wrong lookup
1418      * counts for the entries that are already in the buffer. So we
1419      * return what we've collected until that point.
1420      */
1421     if (err && rem == size) {
1422         fuse_reply_err(req, err);
1423     } else {
1424         fuse_reply_buf(req, buf, size - rem);
1425     }
1426     free(buf);
1427 }
1428
1429 static void lo_readdir(fuse_req_t req, fuse_ino_t ino, size_t size,
1430                        off_t offset, struct fuse_file_info *fi)
1431 {
1432     lo_do_readdir(req, ino, size, offset, fi, 0);
1433 }
1434
1435 static void lo_readdirplus(fuse_req_t req, fuse_ino_t ino, size_t size,
1436                            off_t offset, struct fuse_file_info *fi)
1437 {
1438     lo_do_readdir(req, ino, size, offset, fi, 1);
1439 }
1440
1441 static void lo_releasedir(fuse_req_t req, fuse_ino_t ino,
1442                           struct fuse_file_info *fi)
1443 {
1444     struct lo_data *lo = lo_data(req);
1445     struct lo_dirp *d;
1446
1447     (void)ino;
1448
1449     d = lo_dirp(req, fi);
1450     if (!d) {
1451         fuse_reply_err(req, EBADF);
1452         return;
1453     }
1454
1455     pthread_mutex_lock(&lo->mutex);
1456     lo_map_remove(&lo->dirp_map, fi->fh);
1457     pthread_mutex_unlock(&lo->mutex);
1458
1459     closedir(d->dp);
1460     free(d);
1461     fuse_reply_err(req, 0);
1462 }
1463
1464 static void lo_create(fuse_req_t req, fuse_ino_t parent, const char *name,
1465                       mode_t mode, struct fuse_file_info *fi)
1466 {
1467     int fd;
1468     struct lo_data *lo = lo_data(req);
1469     struct fuse_entry_param e;
1470     int err;
1471     struct lo_cred old = {};
1472
1473     fuse_log(FUSE_LOG_DEBUG, "lo_create(parent=%" PRIu64 ", name=%s)\n", parent,
1474              name);
1475
1476     if (!is_safe_path_component(name)) {
1477         fuse_reply_err(req, EINVAL);
1478         return;
1479     }
1480
1481     err = lo_change_cred(req, &old);
1482     if (err) {
1483         goto out;
1484     }
1485
1486     fd = openat(lo_fd(req, parent), name, (fi->flags | O_CREAT) & ~O_NOFOLLOW,
1487                 mode);
1488     err = fd == -1 ? errno : 0;
1489     lo_restore_cred(&old);
1490
1491     if (!err) {
1492         ssize_t fh;
1493
1494         pthread_mutex_lock(&lo->mutex);
1495         fh = lo_add_fd_mapping(req, fd);
1496         pthread_mutex_unlock(&lo->mutex);
1497         if (fh == -1) {
1498             close(fd);
1499             fuse_reply_err(req, ENOMEM);
1500             return;
1501         }
1502
1503         fi->fh = fh;
1504         err = lo_do_lookup(req, parent, name, &e);
1505     }
1506     if (lo->cache == CACHE_NONE) {
1507         fi->direct_io = 1;
1508     } else if (lo->cache == CACHE_ALWAYS) {
1509         fi->keep_cache = 1;
1510     }
1511
1512 out:
1513     if (err) {
1514         fuse_reply_err(req, err);
1515     } else {
1516         fuse_reply_create(req, &e, fi);
1517     }
1518 }
1519
1520 static void lo_fsyncdir(fuse_req_t req, fuse_ino_t ino, int datasync,
1521                         struct fuse_file_info *fi)
1522 {
1523     int res;
1524     struct lo_dirp *d;
1525     int fd;
1526
1527     (void)ino;
1528
1529     d = lo_dirp(req, fi);
1530     if (!d) {
1531         fuse_reply_err(req, EBADF);
1532         return;
1533     }
1534
1535     fd = dirfd(d->dp);
1536     if (datasync) {
1537         res = fdatasync(fd);
1538     } else {
1539         res = fsync(fd);
1540     }
1541     fuse_reply_err(req, res == -1 ? errno : 0);
1542 }
1543
1544 static void lo_open(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi)
1545 {
1546     int fd;
1547     ssize_t fh;
1548     char buf[64];
1549     struct lo_data *lo = lo_data(req);
1550
1551     fuse_log(FUSE_LOG_DEBUG, "lo_open(ino=%" PRIu64 ", flags=%d)\n", ino,
1552              fi->flags);
1553
1554     /*
1555      * With writeback cache, kernel may send read requests even
1556      * when userspace opened write-only
1557      */
1558     if (lo->writeback && (fi->flags & O_ACCMODE) == O_WRONLY) {
1559         fi->flags &= ~O_ACCMODE;
1560         fi->flags |= O_RDWR;
1561     }
1562
1563     /*
1564      * With writeback cache, O_APPEND is handled by the kernel.
1565      * This breaks atomicity (since the file may change in the
1566      * underlying filesystem, so that the kernel's idea of the
1567      * end of the file isn't accurate anymore). In this example,
1568      * we just accept that. A more rigorous filesystem may want
1569      * to return an error here
1570      */
1571     if (lo->writeback && (fi->flags & O_APPEND)) {
1572         fi->flags &= ~O_APPEND;
1573     }
1574
1575     sprintf(buf, "%i", lo_fd(req, ino));
1576     fd = openat(lo->proc_self_fd, buf, fi->flags & ~O_NOFOLLOW);
1577     if (fd == -1) {
1578         return (void)fuse_reply_err(req, errno);
1579     }
1580
1581     pthread_mutex_lock(&lo->mutex);
1582     fh = lo_add_fd_mapping(req, fd);
1583     pthread_mutex_unlock(&lo->mutex);
1584     if (fh == -1) {
1585         close(fd);
1586         fuse_reply_err(req, ENOMEM);
1587         return;
1588     }
1589
1590     fi->fh = fh;
1591     if (lo->cache == CACHE_NONE) {
1592         fi->direct_io = 1;
1593     } else if (lo->cache == CACHE_ALWAYS) {
1594         fi->keep_cache = 1;
1595     }
1596     fuse_reply_open(req, fi);
1597 }
1598
1599 static void lo_release(fuse_req_t req, fuse_ino_t ino,
1600                        struct fuse_file_info *fi)
1601 {
1602     struct lo_data *lo = lo_data(req);
1603     int fd;
1604
1605     (void)ino;
1606
1607     fd = lo_fi_fd(req, fi);
1608
1609     pthread_mutex_lock(&lo->mutex);
1610     lo_map_remove(&lo->fd_map, fi->fh);
1611     pthread_mutex_unlock(&lo->mutex);
1612
1613     close(fd);
1614     fuse_reply_err(req, 0);
1615 }
1616
1617 static void lo_flush(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi)
1618 {
1619     int res;
1620     (void)ino;
1621     res = close(dup(lo_fi_fd(req, fi)));
1622     fuse_reply_err(req, res == -1 ? errno : 0);
1623 }
1624
1625 static void lo_fsync(fuse_req_t req, fuse_ino_t ino, int datasync,
1626                      struct fuse_file_info *fi)
1627 {
1628     int res;
1629     int fd;
1630     char *buf;
1631
1632     fuse_log(FUSE_LOG_DEBUG, "lo_fsync(ino=%" PRIu64 ", fi=0x%p)\n", ino,
1633              (void *)fi);
1634
1635     if (!fi) {
1636         struct lo_data *lo = lo_data(req);
1637
1638         res = asprintf(&buf, "%i", lo_fd(req, ino));
1639         if (res == -1) {
1640             return (void)fuse_reply_err(req, errno);
1641         }
1642
1643         fd = openat(lo->proc_self_fd, buf, O_RDWR);
1644         free(buf);
1645         if (fd == -1) {
1646             return (void)fuse_reply_err(req, errno);
1647         }
1648     } else {
1649         fd = lo_fi_fd(req, fi);
1650     }
1651
1652     if (datasync) {
1653         res = fdatasync(fd);
1654     } else {
1655         res = fsync(fd);
1656     }
1657     if (!fi) {
1658         close(fd);
1659     }
1660     fuse_reply_err(req, res == -1 ? errno : 0);
1661 }
1662
1663 static void lo_read(fuse_req_t req, fuse_ino_t ino, size_t size, off_t offset,
1664                     struct fuse_file_info *fi)
1665 {
1666     struct fuse_bufvec buf = FUSE_BUFVEC_INIT(size);
1667
1668     fuse_log(FUSE_LOG_DEBUG,
1669              "lo_read(ino=%" PRIu64 ", size=%zd, "
1670              "off=%lu)\n",
1671              ino, size, (unsigned long)offset);
1672
1673     buf.buf[0].flags = FUSE_BUF_IS_FD | FUSE_BUF_FD_SEEK;
1674     buf.buf[0].fd = lo_fi_fd(req, fi);
1675     buf.buf[0].pos = offset;
1676
1677     fuse_reply_data(req, &buf);
1678 }
1679
1680 static void lo_write_buf(fuse_req_t req, fuse_ino_t ino,
1681                          struct fuse_bufvec *in_buf, off_t off,
1682                          struct fuse_file_info *fi)
1683 {
1684     (void)ino;
1685     ssize_t res;
1686     struct fuse_bufvec out_buf = FUSE_BUFVEC_INIT(fuse_buf_size(in_buf));
1687     bool cap_fsetid_dropped = false;
1688
1689     out_buf.buf[0].flags = FUSE_BUF_IS_FD | FUSE_BUF_FD_SEEK;
1690     out_buf.buf[0].fd = lo_fi_fd(req, fi);
1691     out_buf.buf[0].pos = off;
1692
1693     fuse_log(FUSE_LOG_DEBUG,
1694              "lo_write_buf(ino=%" PRIu64 ", size=%zd, off=%lu)\n", ino,
1695              out_buf.buf[0].size, (unsigned long)off);
1696
1697     /*
1698      * If kill_priv is set, drop CAP_FSETID which should lead to kernel
1699      * clearing setuid/setgid on file.
1700      */
1701     if (fi->kill_priv) {
1702         res = drop_effective_cap("FSETID", &cap_fsetid_dropped);
1703         if (res != 0) {
1704             fuse_reply_err(req, res);
1705             return;
1706         }
1707     }
1708
1709     res = fuse_buf_copy(&out_buf, in_buf);
1710     if (res < 0) {
1711         fuse_reply_err(req, -res);
1712     } else {
1713         fuse_reply_write(req, (size_t)res);
1714     }
1715
1716     if (cap_fsetid_dropped) {
1717         res = gain_effective_cap("FSETID");
1718         if (res) {
1719             fuse_log(FUSE_LOG_ERR, "Failed to gain CAP_FSETID\n");
1720         }
1721     }
1722 }
1723
1724 static void lo_statfs(fuse_req_t req, fuse_ino_t ino)
1725 {
1726     int res;
1727     struct statvfs stbuf;
1728
1729     res = fstatvfs(lo_fd(req, ino), &stbuf);
1730     if (res == -1) {
1731         fuse_reply_err(req, errno);
1732     } else {
1733         fuse_reply_statfs(req, &stbuf);
1734     }
1735 }
1736
1737 static void lo_fallocate(fuse_req_t req, fuse_ino_t ino, int mode, off_t offset,
1738                          off_t length, struct fuse_file_info *fi)
1739 {
1740     int err = EOPNOTSUPP;
1741     (void)ino;
1742
1743 #ifdef CONFIG_FALLOCATE
1744     err = fallocate(lo_fi_fd(req, fi), mode, offset, length);
1745     if (err < 0) {
1746         err = errno;
1747     }
1748
1749 #elif defined(CONFIG_POSIX_FALLOCATE)
1750     if (mode) {
1751         fuse_reply_err(req, EOPNOTSUPP);
1752         return;
1753     }
1754
1755     err = posix_fallocate(lo_fi_fd(req, fi), offset, length);
1756 #endif
1757
1758     fuse_reply_err(req, err);
1759 }
1760
1761 static void lo_flock(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi,
1762                      int op)
1763 {
1764     int res;
1765     (void)ino;
1766
1767     res = flock(lo_fi_fd(req, fi), op);
1768
1769     fuse_reply_err(req, res == -1 ? errno : 0);
1770 }
1771
1772 static void lo_getxattr(fuse_req_t req, fuse_ino_t ino, const char *name,
1773                         size_t size)
1774 {
1775     struct lo_data *lo = lo_data(req);
1776     char *value = NULL;
1777     char procname[64];
1778     struct lo_inode *inode;
1779     ssize_t ret;
1780     int saverr;
1781     int fd = -1;
1782
1783     inode = lo_inode(req, ino);
1784     if (!inode) {
1785         fuse_reply_err(req, EBADF);
1786         return;
1787     }
1788
1789     saverr = ENOSYS;
1790     if (!lo_data(req)->xattr) {
1791         goto out;
1792     }
1793
1794     fuse_log(FUSE_LOG_DEBUG, "lo_getxattr(ino=%" PRIu64 ", name=%s size=%zd)\n",
1795              ino, name, size);
1796
1797     if (inode->is_symlink) {
1798         /* Sorry, no race free way to getxattr on symlink. */
1799         saverr = EPERM;
1800         goto out;
1801     }
1802
1803     sprintf(procname, "%i", inode->fd);
1804     fd = openat(lo->proc_self_fd, procname, O_RDONLY);
1805     if (fd < 0) {
1806         goto out_err;
1807     }
1808
1809     if (size) {
1810         value = malloc(size);
1811         if (!value) {
1812             goto out_err;
1813         }
1814
1815         ret = fgetxattr(fd, name, value, size);
1816         if (ret == -1) {
1817             goto out_err;
1818         }
1819         saverr = 0;
1820         if (ret == 0) {
1821             goto out;
1822         }
1823
1824         fuse_reply_buf(req, value, ret);
1825     } else {
1826         ret = fgetxattr(fd, name, NULL, 0);
1827         if (ret == -1) {
1828             goto out_err;
1829         }
1830
1831         fuse_reply_xattr(req, ret);
1832     }
1833 out_free:
1834     free(value);
1835
1836     if (fd >= 0) {
1837         close(fd);
1838     }
1839     return;
1840
1841 out_err:
1842     saverr = errno;
1843 out:
1844     fuse_reply_err(req, saverr);
1845     goto out_free;
1846 }
1847
1848 static void lo_listxattr(fuse_req_t req, fuse_ino_t ino, size_t size)
1849 {
1850     struct lo_data *lo = lo_data(req);
1851     char *value = NULL;
1852     char procname[64];
1853     struct lo_inode *inode;
1854     ssize_t ret;
1855     int saverr;
1856     int fd = -1;
1857
1858     inode = lo_inode(req, ino);
1859     if (!inode) {
1860         fuse_reply_err(req, EBADF);
1861         return;
1862     }
1863
1864     saverr = ENOSYS;
1865     if (!lo_data(req)->xattr) {
1866         goto out;
1867     }
1868
1869     fuse_log(FUSE_LOG_DEBUG, "lo_listxattr(ino=%" PRIu64 ", size=%zd)\n", ino,
1870              size);
1871
1872     if (inode->is_symlink) {
1873         /* Sorry, no race free way to listxattr on symlink. */
1874         saverr = EPERM;
1875         goto out;
1876     }
1877
1878     sprintf(procname, "%i", inode->fd);
1879     fd = openat(lo->proc_self_fd, procname, O_RDONLY);
1880     if (fd < 0) {
1881         goto out_err;
1882     }
1883
1884     if (size) {
1885         value = malloc(size);
1886         if (!value) {
1887             goto out_err;
1888         }
1889
1890         ret = flistxattr(fd, value, size);
1891         if (ret == -1) {
1892             goto out_err;
1893         }
1894         saverr = 0;
1895         if (ret == 0) {
1896             goto out;
1897         }
1898
1899         fuse_reply_buf(req, value, ret);
1900     } else {
1901         ret = flistxattr(fd, NULL, 0);
1902         if (ret == -1) {
1903             goto out_err;
1904         }
1905
1906         fuse_reply_xattr(req, ret);
1907     }
1908 out_free:
1909     free(value);
1910
1911     if (fd >= 0) {
1912         close(fd);
1913     }
1914     return;
1915
1916 out_err:
1917     saverr = errno;
1918 out:
1919     fuse_reply_err(req, saverr);
1920     goto out_free;
1921 }
1922
1923 static void lo_setxattr(fuse_req_t req, fuse_ino_t ino, const char *name,
1924                         const char *value, size_t size, int flags)
1925 {
1926     char procname[64];
1927     struct lo_data *lo = lo_data(req);
1928     struct lo_inode *inode;
1929     ssize_t ret;
1930     int saverr;
1931     int fd = -1;
1932
1933     inode = lo_inode(req, ino);
1934     if (!inode) {
1935         fuse_reply_err(req, EBADF);
1936         return;
1937     }
1938
1939     saverr = ENOSYS;
1940     if (!lo_data(req)->xattr) {
1941         goto out;
1942     }
1943
1944     fuse_log(FUSE_LOG_DEBUG, "lo_setxattr(ino=%" PRIu64
1945              ", name=%s value=%s size=%zd)\n", ino, name, value, size);
1946
1947     if (inode->is_symlink) {
1948         /* Sorry, no race free way to setxattr on symlink. */
1949         saverr = EPERM;
1950         goto out;
1951     }
1952
1953     sprintf(procname, "%i", inode->fd);
1954     fd = openat(lo->proc_self_fd, procname, O_RDWR);
1955     if (fd < 0) {
1956         saverr = errno;
1957         goto out;
1958     }
1959
1960     ret = fsetxattr(fd, name, value, size, flags);
1961     saverr = ret == -1 ? errno : 0;
1962
1963 out:
1964     if (fd >= 0) {
1965         close(fd);
1966     }
1967     fuse_reply_err(req, saverr);
1968 }
1969
1970 static void lo_removexattr(fuse_req_t req, fuse_ino_t ino, const char *name)
1971 {
1972     char procname[64];
1973     struct lo_data *lo = lo_data(req);
1974     struct lo_inode *inode;
1975     ssize_t ret;
1976     int saverr;
1977     int fd = -1;
1978
1979     inode = lo_inode(req, ino);
1980     if (!inode) {
1981         fuse_reply_err(req, EBADF);
1982         return;
1983     }
1984
1985     saverr = ENOSYS;
1986     if (!lo_data(req)->xattr) {
1987         goto out;
1988     }
1989
1990     fuse_log(FUSE_LOG_DEBUG, "lo_removexattr(ino=%" PRIu64 ", name=%s)\n", ino,
1991              name);
1992
1993     if (inode->is_symlink) {
1994         /* Sorry, no race free way to setxattr on symlink. */
1995         saverr = EPERM;
1996         goto out;
1997     }
1998
1999     sprintf(procname, "%i", inode->fd);
2000     fd = openat(lo->proc_self_fd, procname, O_RDWR);
2001     if (fd < 0) {
2002         saverr = errno;
2003         goto out;
2004     }
2005
2006     ret = fremovexattr(fd, name);
2007     saverr = ret == -1 ? errno : 0;
2008
2009 out:
2010     if (fd >= 0) {
2011         close(fd);
2012     }
2013     fuse_reply_err(req, saverr);
2014 }
2015
2016 #ifdef HAVE_COPY_FILE_RANGE
2017 static void lo_copy_file_range(fuse_req_t req, fuse_ino_t ino_in, off_t off_in,
2018                                struct fuse_file_info *fi_in, fuse_ino_t ino_out,
2019                                off_t off_out, struct fuse_file_info *fi_out,
2020                                size_t len, int flags)
2021 {
2022     int in_fd, out_fd;
2023     ssize_t res;
2024
2025     in_fd = lo_fi_fd(req, fi_in);
2026     out_fd = lo_fi_fd(req, fi_out);
2027
2028     fuse_log(FUSE_LOG_DEBUG,
2029              "lo_copy_file_range(ino=%" PRIu64 "/fd=%d, "
2030              "off=%lu, ino=%" PRIu64 "/fd=%d, "
2031              "off=%lu, size=%zd, flags=0x%x)\n",
2032              ino_in, in_fd, off_in, ino_out, out_fd, off_out, len, flags);
2033
2034     res = copy_file_range(in_fd, &off_in, out_fd, &off_out, len, flags);
2035     if (res < 0) {
2036         fuse_reply_err(req, -errno);
2037     } else {
2038         fuse_reply_write(req, res);
2039     }
2040 }
2041 #endif
2042
2043 static void lo_lseek(fuse_req_t req, fuse_ino_t ino, off_t off, int whence,
2044                      struct fuse_file_info *fi)
2045 {
2046     off_t res;
2047
2048     (void)ino;
2049     res = lseek(lo_fi_fd(req, fi), off, whence);
2050     if (res != -1) {
2051         fuse_reply_lseek(req, res);
2052     } else {
2053         fuse_reply_err(req, errno);
2054     }
2055 }
2056
2057 static void lo_destroy(void *userdata)
2058 {
2059     struct lo_data *lo = (struct lo_data *)userdata;
2060     unref_all_inodes(lo);
2061 }
2062
2063 static struct fuse_lowlevel_ops lo_oper = {
2064     .init = lo_init,
2065     .lookup = lo_lookup,
2066     .mkdir = lo_mkdir,
2067     .mknod = lo_mknod,
2068     .symlink = lo_symlink,
2069     .link = lo_link,
2070     .unlink = lo_unlink,
2071     .rmdir = lo_rmdir,
2072     .rename = lo_rename,
2073     .forget = lo_forget,
2074     .forget_multi = lo_forget_multi,
2075     .getattr = lo_getattr,
2076     .setattr = lo_setattr,
2077     .readlink = lo_readlink,
2078     .opendir = lo_opendir,
2079     .readdir = lo_readdir,
2080     .readdirplus = lo_readdirplus,
2081     .releasedir = lo_releasedir,
2082     .fsyncdir = lo_fsyncdir,
2083     .create = lo_create,
2084     .open = lo_open,
2085     .release = lo_release,
2086     .flush = lo_flush,
2087     .fsync = lo_fsync,
2088     .read = lo_read,
2089     .write_buf = lo_write_buf,
2090     .statfs = lo_statfs,
2091     .fallocate = lo_fallocate,
2092     .flock = lo_flock,
2093     .getxattr = lo_getxattr,
2094     .listxattr = lo_listxattr,
2095     .setxattr = lo_setxattr,
2096     .removexattr = lo_removexattr,
2097 #ifdef HAVE_COPY_FILE_RANGE
2098     .copy_file_range = lo_copy_file_range,
2099 #endif
2100     .lseek = lo_lseek,
2101     .destroy = lo_destroy,
2102 };
2103
2104 /* Print vhost-user.json backend program capabilities */
2105 static void print_capabilities(void)
2106 {
2107     printf("{\n");
2108     printf("  \"type\": \"fs\"\n");
2109     printf("}\n");
2110 }
2111
2112 /*
2113  * Move to a new mount, net, and pid namespaces to isolate this process.
2114  */
2115 static void setup_namespaces(struct lo_data *lo, struct fuse_session *se)
2116 {
2117     pid_t child;
2118
2119     /*
2120      * Create a new pid namespace for *child* processes.  We'll have to
2121      * fork in order to enter the new pid namespace.  A new mount namespace
2122      * is also needed so that we can remount /proc for the new pid
2123      * namespace.
2124      *
2125      * Our UNIX domain sockets have been created.  Now we can move to
2126      * an empty network namespace to prevent TCP/IP and other network
2127      * activity in case this process is compromised.
2128      */
2129     if (unshare(CLONE_NEWPID | CLONE_NEWNS | CLONE_NEWNET) != 0) {
2130         fuse_log(FUSE_LOG_ERR, "unshare(CLONE_NEWPID | CLONE_NEWNS): %m\n");
2131         exit(1);
2132     }
2133
2134     child = fork();
2135     if (child < 0) {
2136         fuse_log(FUSE_LOG_ERR, "fork() failed: %m\n");
2137         exit(1);
2138     }
2139     if (child > 0) {
2140         pid_t waited;
2141         int wstatus;
2142
2143         /* The parent waits for the child */
2144         do {
2145             waited = waitpid(child, &wstatus, 0);
2146         } while (waited < 0 && errno == EINTR && !se->exited);
2147
2148         /* We were terminated by a signal, see fuse_signals.c */
2149         if (se->exited) {
2150             exit(0);
2151         }
2152
2153         if (WIFEXITED(wstatus)) {
2154             exit(WEXITSTATUS(wstatus));
2155         }
2156
2157         exit(1);
2158     }
2159
2160     /* Send us SIGTERM when the parent thread terminates, see prctl(2) */
2161     prctl(PR_SET_PDEATHSIG, SIGTERM);
2162
2163     /*
2164      * If the mounts have shared propagation then we want to opt out so our
2165      * mount changes don't affect the parent mount namespace.
2166      */
2167     if (mount(NULL, "/", NULL, MS_REC | MS_SLAVE, NULL) < 0) {
2168         fuse_log(FUSE_LOG_ERR, "mount(/, MS_REC|MS_SLAVE): %m\n");
2169         exit(1);
2170     }
2171
2172     /* The child must remount /proc to use the new pid namespace */
2173     if (mount("proc", "/proc", "proc",
2174               MS_NODEV | MS_NOEXEC | MS_NOSUID | MS_RELATIME, NULL) < 0) {
2175         fuse_log(FUSE_LOG_ERR, "mount(/proc): %m\n");
2176         exit(1);
2177     }
2178
2179     /* Now we can get our /proc/self/fd directory file descriptor */
2180     lo->proc_self_fd = open("/proc/self/fd", O_PATH);
2181     if (lo->proc_self_fd == -1) {
2182         fuse_log(FUSE_LOG_ERR, "open(/proc/self/fd, O_PATH): %m\n");
2183         exit(1);
2184     }
2185 }
2186
2187 /*
2188  * Capture the capability state, we'll need to restore this for individual
2189  * threads later; see load_capng.
2190  */
2191 static void setup_capng(void)
2192 {
2193     /* Note this accesses /proc so has to happen before the sandbox */
2194     if (capng_get_caps_process()) {
2195         fuse_log(FUSE_LOG_ERR, "capng_get_caps_process\n");
2196         exit(1);
2197     }
2198     pthread_mutex_init(&cap.mutex, NULL);
2199     pthread_mutex_lock(&cap.mutex);
2200     cap.saved = capng_save_state();
2201     if (!cap.saved) {
2202         fuse_log(FUSE_LOG_ERR, "capng_save_state\n");
2203         exit(1);
2204     }
2205     pthread_mutex_unlock(&cap.mutex);
2206 }
2207
2208 static void cleanup_capng(void)
2209 {
2210     free(cap.saved);
2211     cap.saved = NULL;
2212     pthread_mutex_destroy(&cap.mutex);
2213 }
2214
2215
2216 /*
2217  * Make the source directory our root so symlinks cannot escape and no other
2218  * files are accessible.  Assumes unshare(CLONE_NEWNS) was already called.
2219  */
2220 static void setup_mounts(const char *source)
2221 {
2222     int oldroot;
2223     int newroot;
2224
2225     if (mount(source, source, NULL, MS_BIND, NULL) < 0) {
2226         fuse_log(FUSE_LOG_ERR, "mount(%s, %s, MS_BIND): %m\n", source, source);
2227         exit(1);
2228     }
2229
2230     /* This magic is based on lxc's lxc_pivot_root() */
2231     oldroot = open("/", O_DIRECTORY | O_RDONLY | O_CLOEXEC);
2232     if (oldroot < 0) {
2233         fuse_log(FUSE_LOG_ERR, "open(/): %m\n");
2234         exit(1);
2235     }
2236
2237     newroot = open(source, O_DIRECTORY | O_RDONLY | O_CLOEXEC);
2238     if (newroot < 0) {
2239         fuse_log(FUSE_LOG_ERR, "open(%s): %m\n", source);
2240         exit(1);
2241     }
2242
2243     if (fchdir(newroot) < 0) {
2244         fuse_log(FUSE_LOG_ERR, "fchdir(newroot): %m\n");
2245         exit(1);
2246     }
2247
2248     if (syscall(__NR_pivot_root, ".", ".") < 0) {
2249         fuse_log(FUSE_LOG_ERR, "pivot_root(., .): %m\n");
2250         exit(1);
2251     }
2252
2253     if (fchdir(oldroot) < 0) {
2254         fuse_log(FUSE_LOG_ERR, "fchdir(oldroot): %m\n");
2255         exit(1);
2256     }
2257
2258     if (mount("", ".", "", MS_SLAVE | MS_REC, NULL) < 0) {
2259         fuse_log(FUSE_LOG_ERR, "mount(., MS_SLAVE | MS_REC): %m\n");
2260         exit(1);
2261     }
2262
2263     if (umount2(".", MNT_DETACH) < 0) {
2264         fuse_log(FUSE_LOG_ERR, "umount2(., MNT_DETACH): %m\n");
2265         exit(1);
2266     }
2267
2268     if (fchdir(newroot) < 0) {
2269         fuse_log(FUSE_LOG_ERR, "fchdir(newroot): %m\n");
2270         exit(1);
2271     }
2272
2273     close(newroot);
2274     close(oldroot);
2275 }
2276
2277 /*
2278  * Lock down this process to prevent access to other processes or files outside
2279  * source directory.  This reduces the impact of arbitrary code execution bugs.
2280  */
2281 static void setup_sandbox(struct lo_data *lo, struct fuse_session *se,
2282                           bool enable_syslog)
2283 {
2284     setup_namespaces(lo, se);
2285     setup_mounts(lo->source);
2286     setup_seccomp(enable_syslog);
2287 }
2288
2289 /* Raise the maximum number of open file descriptors */
2290 static void setup_nofile_rlimit(void)
2291 {
2292     const rlim_t max_fds = 1000000;
2293     struct rlimit rlim;
2294
2295     if (getrlimit(RLIMIT_NOFILE, &rlim) < 0) {
2296         fuse_log(FUSE_LOG_ERR, "getrlimit(RLIMIT_NOFILE): %m\n");
2297         exit(1);
2298     }
2299
2300     if (rlim.rlim_cur >= max_fds) {
2301         return; /* nothing to do */
2302     }
2303
2304     rlim.rlim_cur = max_fds;
2305     rlim.rlim_max = max_fds;
2306
2307     if (setrlimit(RLIMIT_NOFILE, &rlim) < 0) {
2308         /* Ignore SELinux denials */
2309         if (errno == EPERM) {
2310             return;
2311         }
2312
2313         fuse_log(FUSE_LOG_ERR, "setrlimit(RLIMIT_NOFILE): %m\n");
2314         exit(1);
2315     }
2316 }
2317
2318 static void log_func(enum fuse_log_level level, const char *fmt, va_list ap)
2319 {
2320     g_autofree char *localfmt = NULL;
2321
2322     if (current_log_level < level) {
2323         return;
2324     }
2325
2326     if (current_log_level == FUSE_LOG_DEBUG) {
2327         if (!use_syslog) {
2328             localfmt = g_strdup_printf("[%" PRId64 "] [ID: %08ld] %s",
2329                                        get_clock(), syscall(__NR_gettid), fmt);
2330         } else {
2331             localfmt = g_strdup_printf("[ID: %08ld] %s", syscall(__NR_gettid),
2332                                        fmt);
2333         }
2334         fmt = localfmt;
2335     }
2336
2337     if (use_syslog) {
2338         int priority = LOG_ERR;
2339         switch (level) {
2340         case FUSE_LOG_EMERG:
2341             priority = LOG_EMERG;
2342             break;
2343         case FUSE_LOG_ALERT:
2344             priority = LOG_ALERT;
2345             break;
2346         case FUSE_LOG_CRIT:
2347             priority = LOG_CRIT;
2348             break;
2349         case FUSE_LOG_ERR:
2350             priority = LOG_ERR;
2351             break;
2352         case FUSE_LOG_WARNING:
2353             priority = LOG_WARNING;
2354             break;
2355         case FUSE_LOG_NOTICE:
2356             priority = LOG_NOTICE;
2357             break;
2358         case FUSE_LOG_INFO:
2359             priority = LOG_INFO;
2360             break;
2361         case FUSE_LOG_DEBUG:
2362             priority = LOG_DEBUG;
2363             break;
2364         }
2365         vsyslog(priority, fmt, ap);
2366     } else {
2367         vfprintf(stderr, fmt, ap);
2368     }
2369 }
2370
2371 static void setup_root(struct lo_data *lo, struct lo_inode *root)
2372 {
2373     int fd, res;
2374     struct stat stat;
2375
2376     fd = open("/", O_PATH);
2377     if (fd == -1) {
2378         fuse_log(FUSE_LOG_ERR, "open(%s, O_PATH): %m\n", lo->source);
2379         exit(1);
2380     }
2381
2382     res = fstatat(fd, "", &stat, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
2383     if (res == -1) {
2384         fuse_log(FUSE_LOG_ERR, "fstatat(%s): %m\n", lo->source);
2385         exit(1);
2386     }
2387
2388     root->is_symlink = false;
2389     root->fd = fd;
2390     root->key.ino = stat.st_ino;
2391     root->key.dev = stat.st_dev;
2392     root->refcount = 2;
2393 }
2394
2395 static guint lo_key_hash(gconstpointer key)
2396 {
2397     const struct lo_key *lkey = key;
2398
2399     return (guint)lkey->ino + (guint)lkey->dev;
2400 }
2401
2402 static gboolean lo_key_equal(gconstpointer a, gconstpointer b)
2403 {
2404     const struct lo_key *la = a;
2405     const struct lo_key *lb = b;
2406
2407     return la->ino == lb->ino && la->dev == lb->dev;
2408 }
2409
2410 int main(int argc, char *argv[])
2411 {
2412     struct fuse_args args = FUSE_ARGS_INIT(argc, argv);
2413     struct fuse_session *se;
2414     struct fuse_cmdline_opts opts;
2415     struct lo_data lo = {
2416         .debug = 0,
2417         .writeback = 0,
2418         .proc_self_fd = -1,
2419     };
2420     struct lo_map_elem *root_elem;
2421     int ret = -1;
2422
2423     /* Don't mask creation mode, kernel already did that */
2424     umask(0);
2425
2426     pthread_mutex_init(&lo.mutex, NULL);
2427     lo.inodes = g_hash_table_new(lo_key_hash, lo_key_equal);
2428     lo.root.fd = -1;
2429     lo.root.fuse_ino = FUSE_ROOT_ID;
2430     lo.cache = CACHE_AUTO;
2431
2432     /*
2433      * Set up the ino map like this:
2434      * [0] Reserved (will not be used)
2435      * [1] Root inode
2436      */
2437     lo_map_init(&lo.ino_map);
2438     lo_map_reserve(&lo.ino_map, 0)->in_use = false;
2439     root_elem = lo_map_reserve(&lo.ino_map, lo.root.fuse_ino);
2440     root_elem->inode = &lo.root;
2441
2442     lo_map_init(&lo.dirp_map);
2443     lo_map_init(&lo.fd_map);
2444
2445     if (fuse_parse_cmdline(&args, &opts) != 0) {
2446         return 1;
2447     }
2448     fuse_set_log_func(log_func);
2449     use_syslog = opts.syslog;
2450     if (use_syslog) {
2451         openlog("virtiofsd", LOG_PID, LOG_DAEMON);
2452     }
2453     if (opts.show_help) {
2454         printf("usage: %s [options]\n\n", argv[0]);
2455         fuse_cmdline_help();
2456         printf("    -o source=PATH             shared directory tree\n");
2457         fuse_lowlevel_help();
2458         ret = 0;
2459         goto err_out1;
2460     } else if (opts.show_version) {
2461         fuse_lowlevel_version();
2462         ret = 0;
2463         goto err_out1;
2464     } else if (opts.print_capabilities) {
2465         print_capabilities();
2466         ret = 0;
2467         goto err_out1;
2468     }
2469
2470     if (fuse_opt_parse(&args, &lo, lo_opts, NULL) == -1) {
2471         return 1;
2472     }
2473
2474     /*
2475      * log_level is 0 if not configured via cmd options (0 is LOG_EMERG,
2476      * and we don't use this log level).
2477      */
2478     if (opts.log_level != 0) {
2479         current_log_level = opts.log_level;
2480     }
2481     lo.debug = opts.debug;
2482     if (lo.debug) {
2483         current_log_level = FUSE_LOG_DEBUG;
2484     }
2485     if (lo.source) {
2486         struct stat stat;
2487         int res;
2488
2489         res = lstat(lo.source, &stat);
2490         if (res == -1) {
2491             fuse_log(FUSE_LOG_ERR, "failed to stat source (\"%s\"): %m\n",
2492                      lo.source);
2493             exit(1);
2494         }
2495         if (!S_ISDIR(stat.st_mode)) {
2496             fuse_log(FUSE_LOG_ERR, "source is not a directory\n");
2497             exit(1);
2498         }
2499
2500     } else {
2501         lo.source = "/";
2502     }
2503     if (!lo.timeout_set) {
2504         switch (lo.cache) {
2505         case CACHE_NONE:
2506             lo.timeout = 0.0;
2507             break;
2508
2509         case CACHE_AUTO:
2510             lo.timeout = 1.0;
2511             break;
2512
2513         case CACHE_ALWAYS:
2514             lo.timeout = 86400.0;
2515             break;
2516         }
2517     } else if (lo.timeout < 0) {
2518         fuse_log(FUSE_LOG_ERR, "timeout is negative (%lf)\n", lo.timeout);
2519         exit(1);
2520     }
2521
2522     se = fuse_session_new(&args, &lo_oper, sizeof(lo_oper), &lo);
2523     if (se == NULL) {
2524         goto err_out1;
2525     }
2526
2527     if (fuse_set_signal_handlers(se) != 0) {
2528         goto err_out2;
2529     }
2530
2531     if (fuse_session_mount(se) != 0) {
2532         goto err_out3;
2533     }
2534
2535     fuse_daemonize(opts.foreground);
2536
2537     setup_nofile_rlimit();
2538
2539     /* Must be before sandbox since it wants /proc */
2540     setup_capng();
2541
2542     setup_sandbox(&lo, se, opts.syslog);
2543
2544     setup_root(&lo, &lo.root);
2545     /* Block until ctrl+c or fusermount -u */
2546     ret = virtio_loop(se);
2547
2548     fuse_session_unmount(se);
2549     cleanup_capng();
2550 err_out3:
2551     fuse_remove_signal_handlers(se);
2552 err_out2:
2553     fuse_session_destroy(se);
2554 err_out1:
2555     fuse_opt_free_args(&args);
2556
2557     if (lo.inodes) {
2558         g_hash_table_destroy(lo.inodes);
2559     }
2560     lo_map_destroy(&lo.fd_map);
2561     lo_map_destroy(&lo.dirp_map);
2562     lo_map_destroy(&lo.ino_map);
2563
2564     if (lo.proc_self_fd >= 0) {
2565         close(lo.proc_self_fd);
2566     }
2567
2568     if (lo.root.fd >= 0) {
2569         close(lo.root.fd);
2570     }
2571
2572     return ret ? 1 : 0;
2573 }