tools/virtiofsd/passthrough_ll.c

   1 /*
   2  * FUSE: Filesystem in Userspace
   3  * Copyright (C) 2001-2007  Miklos Szeredi <miklos@szeredi.hu>
   4  *
   5  * This program can be distributed under the terms of the GNU GPLv2.
   6  * See the file COPYING.
   7  */
   8
   9 /*
  10  *
  11  * This file system mirrors the existing file system hierarchy of the
  12  * system, starting at the root file system. This is implemented by
  13  * just "passing through" all requests to the corresponding user-space
  14  * libc functions. In contrast to passthrough.c and passthrough_fh.c,
  15  * this implementation uses the low-level API. Its performance should
  16  * be the least bad among the three, but many operations are not
  17  * implemented. In particular, it is not possible to remove files (or
  18  * directories) because the code necessary to defer actual removal
  19  * until the file is not opened anymore would make the example much
  20  * more complicated.
  21  *
  22  * When writeback caching is enabled (-o writeback mount option), it
  23  * is only possible to write to files for which the mounting user has
  24  * read permissions. This is because the writeback cache requires the
  25  * kernel to be able to issue read requests for all files (which the
  26  * passthrough filesystem cannot satisfy if it can't read the file in
  27  * the underlying filesystem).
  28  *
  29  * Compile with:
  30  *
  31  *     gcc -Wall passthrough_ll.c `pkg-config fuse3 --cflags --libs` -o
  32  * passthrough_ll
  33  *
  34  * ## Source code ##
  35  * \include passthrough_ll.c
  36  */
  37
  38 #include "qemu/osdep.h"
  39 #include "qemu/timer.h"
  40 #include "fuse_virtio.h"
  41 #include "fuse_log.h"
  42 #include "fuse_lowlevel.h"
  43 #include <assert.h>
  44 #include <cap-ng.h>
  45 #include <dirent.h>
  46 #include <errno.h>
  47 #include <glib.h>
  48 #include <inttypes.h>
  49 #include <limits.h>
  50 #include <pthread.h>
  51 #include <stdbool.h>
  52 #include <stddef.h>
  53 #include <stdio.h>
  54 #include <stdlib.h>
  55 #include <string.h>
  56 #include <sys/file.h>
  57 #include <sys/mount.h>
  58 #include <sys/prctl.h>
  59 #include <sys/resource.h>
  60 #include <sys/syscall.h>
  61 #include <sys/types.h>
  62 #include <sys/wait.h>
  63 #include <sys/xattr.h>
  64 #include <syslog.h>
  65 #include <unistd.h>
  66
  67 #include "passthrough_helpers.h"
  68 #include "seccomp.h"
  69
  70 /* Keep track of inode posix locks for each owner. */
  71 struct lo_inode_plock {
  72     uint64_t lock_owner;
  73     int fd; /* fd for OFD locks */
  74 };
  75
  76 struct lo_map_elem {
  77     union {
  78         struct lo_inode *inode;
  79         struct lo_dirp *dirp;
  80         int fd;
  81         ssize_t freelist;
  82     };
  83     bool in_use;
  84 };
  85
  86 /* Maps FUSE fh or ino values to internal objects */
  87 struct lo_map {
  88     struct lo_map_elem *elems;
  89     size_t nelems;
  90     ssize_t freelist;
  91 };
  92
  93 struct lo_key {
  94     ino_t ino;
  95     dev_t dev;
  96 };
  97
  98 struct lo_inode {
  99     int fd;
 100
 101     /*
 102      * Atomic reference count for this object.  The nlookup field holds a
 103      * reference and release it when nlookup reaches 0.
 104      */
 105     gint refcount;
 106
 107     struct lo_key key;
 108
 109     /*
 110      * This counter keeps the inode alive during the FUSE session.
 111      * Incremented when the FUSE inode number is sent in a reply
 112      * (FUSE_LOOKUP, FUSE_READDIRPLUS, etc).  Decremented when an inode is
 113      * released by requests like FUSE_FORGET, FUSE_RMDIR, FUSE_RENAME, etc.
 114      *
 115      * Note that this value is untrusted because the client can manipulate
 116      * it arbitrarily using FUSE_FORGET requests.
 117      *
 118      * Protected by lo->mutex.
 119      */
 120     uint64_t nlookup;
 121
 122     fuse_ino_t fuse_ino;
 123     pthread_mutex_t plock_mutex;
 124     GHashTable *posix_locks; /* protected by lo_inode->plock_mutex */
 125
 126     bool is_symlink;
 127 };
 128
 129 struct lo_cred {
 130     uid_t euid;
 131     gid_t egid;
 132 };
 133
 134 enum {
 135     CACHE_NONE,
 136     CACHE_AUTO,
 137     CACHE_ALWAYS,
 138 };
 139
 140 struct lo_data {
 141     pthread_mutex_t mutex;
 142     int debug;
 143     int norace;
 144     int writeback;
 145     int flock;
 146     int posix_lock;
 147     int xattr;
 148     char *source;
 149     double timeout;
 150     int cache;
 151     int timeout_set;
 152     int readdirplus_set;
 153     int readdirplus_clear;
 154     struct lo_inode root;
 155     GHashTable *inodes; /* protected by lo->mutex */
 156     struct lo_map ino_map; /* protected by lo->mutex */
 157     struct lo_map dirp_map; /* protected by lo->mutex */
 158     struct lo_map fd_map; /* protected by lo->mutex */
 159
 160     /* An O_PATH file descriptor to /proc/self/fd/ */
 161     int proc_self_fd;
 162 };
 163
 164 static const struct fuse_opt lo_opts[] = {
 165     { "writeback", offsetof(struct lo_data, writeback), 1 },
 166     { "no_writeback", offsetof(struct lo_data, writeback), 0 },
 167     { "source=%s", offsetof(struct lo_data, source), 0 },
 168     { "flock", offsetof(struct lo_data, flock), 1 },
 169     { "no_flock", offsetof(struct lo_data, flock), 0 },
 170     { "posix_lock", offsetof(struct lo_data, posix_lock), 1 },
 171     { "no_posix_lock", offsetof(struct lo_data, posix_lock), 0 },
 172     { "xattr", offsetof(struct lo_data, xattr), 1 },
 173     { "no_xattr", offsetof(struct lo_data, xattr), 0 },
 174     { "timeout=%lf", offsetof(struct lo_data, timeout), 0 },
 175     { "timeout=", offsetof(struct lo_data, timeout_set), 1 },
 176     { "cache=none", offsetof(struct lo_data, cache), CACHE_NONE },
 177     { "cache=auto", offsetof(struct lo_data, cache), CACHE_AUTO },
 178     { "cache=always", offsetof(struct lo_data, cache), CACHE_ALWAYS },
 179     { "norace", offsetof(struct lo_data, norace), 1 },
 180     { "readdirplus", offsetof(struct lo_data, readdirplus_set), 1 },
 181     { "no_readdirplus", offsetof(struct lo_data, readdirplus_clear), 1 },
 182     FUSE_OPT_END
 183 };
 184 static bool use_syslog = false;
 185 static int current_log_level;
 186 static void unref_inode_lolocked(struct lo_data *lo, struct lo_inode *inode,
 187                                  uint64_t n);
 188
 189 static struct {
 190     pthread_mutex_t mutex;
 191     void *saved;
 192 } cap;
 193 /* That we loaded cap-ng in the current thread from the saved */
 194 static __thread bool cap_loaded = 0;
 195
 196 static struct lo_inode *lo_find(struct lo_data *lo, struct stat *st);
 197
 198 static int is_dot_or_dotdot(const char *name)
 199 {
 200     return name[0] == '.' &&
 201            (name[1] == '\0' || (name[1] == '.' && name[2] == '\0'));
 202 }
 203
 204 /* Is `path` a single path component that is not "." or ".."? */
 205 static int is_safe_path_component(const char *path)
 206 {
 207     if (strchr(path, '/')) {
 208         return 0;
 209     }
 210
 211     return !is_dot_or_dotdot(path);
 212 }
 213
 214 static struct lo_data *lo_data(fuse_req_t req)
 215 {
 216     return (struct lo_data *)fuse_req_userdata(req);
 217 }
 218
 219 /*
 220  * Load capng's state from our saved state if the current thread
 221  * hadn't previously been loaded.
 222  * returns 0 on success
 223  */
 224 static int load_capng(void)
 225 {
 226     if (!cap_loaded) {
 227         pthread_mutex_lock(&cap.mutex);
 228         capng_restore_state(&cap.saved);
 229         /*
 230          * restore_state free's the saved copy
 231          * so make another.
 232          */
 233         cap.saved = capng_save_state();
 234         if (!cap.saved) {
 235             fuse_log(FUSE_LOG_ERR, "capng_save_state (thread)\n");
 236             return -EINVAL;
 237         }
 238         pthread_mutex_unlock(&cap.mutex);
 239
 240         /*
 241          * We want to use the loaded state for our pid,
 242          * not the original
 243          */
 244         capng_setpid(syscall(SYS_gettid));
 245         cap_loaded = true;
 246     }
 247     return 0;
 248 }
 249
 250 /*
 251  * Helpers for dropping and regaining effective capabilities. Returns 0
 252  * on success, error otherwise
 253  */
 254 static int drop_effective_cap(const char *cap_name, bool *cap_dropped)
 255 {
 256     int cap, ret;
 257
 258     cap = capng_name_to_capability(cap_name);
 259     if (cap < 0) {
 260         ret = errno;
 261         fuse_log(FUSE_LOG_ERR, "capng_name_to_capability(%s) failed:%s\n",
 262                  cap_name, strerror(errno));
 263         goto out;
 264     }
 265
 266     if (load_capng()) {
 267         ret = errno;
 268         fuse_log(FUSE_LOG_ERR, "load_capng() failed\n");
 269         goto out;
 270     }
 271
 272     /* We dont have this capability in effective set already. */
 273     if (!capng_have_capability(CAPNG_EFFECTIVE, cap)) {
 274         ret = 0;
 275         goto out;
 276     }
 277
 278     if (capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, cap)) {
 279         ret = errno;
 280         fuse_log(FUSE_LOG_ERR, "capng_update(DROP,) failed\n");
 281         goto out;
 282     }
 283
 284     if (capng_apply(CAPNG_SELECT_CAPS)) {
 285         ret = errno;
 286         fuse_log(FUSE_LOG_ERR, "drop:capng_apply() failed\n");
 287         goto out;
 288     }
 289
 290     ret = 0;
 291     if (cap_dropped) {
 292         *cap_dropped = true;
 293     }
 294
 295 out:
 296     return ret;
 297 }
 298
 299 static int gain_effective_cap(const char *cap_name)
 300 {
 301     int cap;
 302     int ret = 0;
 303
 304     cap = capng_name_to_capability(cap_name);
 305     if (cap < 0) {
 306         ret = errno;
 307         fuse_log(FUSE_LOG_ERR, "capng_name_to_capability(%s) failed:%s\n",
 308                  cap_name, strerror(errno));
 309         goto out;
 310     }
 311
 312     if (load_capng()) {
 313         ret = errno;
 314         fuse_log(FUSE_LOG_ERR, "load_capng() failed\n");
 315         goto out;
 316     }
 317
 318     if (capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, cap)) {
 319         ret = errno;
 320         fuse_log(FUSE_LOG_ERR, "capng_update(ADD,) failed\n");
 321         goto out;
 322     }
 323
 324     if (capng_apply(CAPNG_SELECT_CAPS)) {
 325         ret = errno;
 326         fuse_log(FUSE_LOG_ERR, "gain:capng_apply() failed\n");
 327         goto out;
 328     }
 329     ret = 0;
 330
 331 out:
 332     return ret;
 333 }
 334
 335 static void lo_map_init(struct lo_map *map)
 336 {
 337     map->elems = NULL;
 338     map->nelems = 0;
 339     map->freelist = -1;
 340 }
 341
 342 static void lo_map_destroy(struct lo_map *map)
 343 {
 344     free(map->elems);
 345 }
 346
 347 static int lo_map_grow(struct lo_map *map, size_t new_nelems)
 348 {
 349     struct lo_map_elem *new_elems;
 350     size_t i;
 351
 352     if (new_nelems <= map->nelems) {
 353         return 1;
 354     }
 355
 356     new_elems = realloc(map->elems, sizeof(map->elems[0]) * new_nelems);
 357     if (!new_elems) {
 358         return 0;
 359     }
 360
 361     for (i = map->nelems; i < new_nelems; i++) {
 362         new_elems[i].freelist = i + 1;
 363         new_elems[i].in_use = false;
 364     }
 365     new_elems[new_nelems - 1].freelist = -1;
 366
 367     map->elems = new_elems;
 368     map->freelist = map->nelems;
 369     map->nelems = new_nelems;
 370     return 1;
 371 }
 372
 373 static struct lo_map_elem *lo_map_alloc_elem(struct lo_map *map)
 374 {
 375     struct lo_map_elem *elem;
 376
 377     if (map->freelist == -1 && !lo_map_grow(map, map->nelems + 256)) {
 378         return NULL;
 379     }
 380
 381     elem = &map->elems[map->freelist];
 382     map->freelist = elem->freelist;
 383
 384     elem->in_use = true;
 385
 386     return elem;
 387 }
 388
 389 static struct lo_map_elem *lo_map_reserve(struct lo_map *map, size_t key)
 390 {
 391     ssize_t *prev;
 392
 393     if (!lo_map_grow(map, key + 1)) {
 394         return NULL;
 395     }
 396
 397     for (prev = &map->freelist; *prev != -1;
 398          prev = &map->elems[*prev].freelist) {
 399         if (*prev == key) {
 400             struct lo_map_elem *elem = &map->elems[key];
 401
 402             *prev = elem->freelist;
 403             elem->in_use = true;
 404             return elem;
 405         }
 406     }
 407     return NULL;
 408 }
 409
 410 static struct lo_map_elem *lo_map_get(struct lo_map *map, size_t key)
 411 {
 412     if (key >= map->nelems) {
 413         return NULL;
 414     }
 415     if (!map->elems[key].in_use) {
 416         return NULL;
 417     }
 418     return &map->elems[key];
 419 }
 420
 421 static void lo_map_remove(struct lo_map *map, size_t key)
 422 {
 423     struct lo_map_elem *elem;
 424
 425     if (key >= map->nelems) {
 426         return;
 427     }
 428
 429     elem = &map->elems[key];
 430     if (!elem->in_use) {
 431         return;
 432     }
 433
 434     elem->in_use = false;
 435
 436     elem->freelist = map->freelist;
 437     map->freelist = key;
 438 }
 439
 440 /* Assumes lo->mutex is held */
 441 static ssize_t lo_add_fd_mapping(fuse_req_t req, int fd)
 442 {
 443     struct lo_map_elem *elem;
 444
 445     elem = lo_map_alloc_elem(&lo_data(req)->fd_map);
 446     if (!elem) {
 447         return -1;
 448     }
 449
 450     elem->fd = fd;
 451     return elem - lo_data(req)->fd_map.elems;
 452 }
 453
 454 /* Assumes lo->mutex is held */
 455 static ssize_t lo_add_dirp_mapping(fuse_req_t req, struct lo_dirp *dirp)
 456 {
 457     struct lo_map_elem *elem;
 458
 459     elem = lo_map_alloc_elem(&lo_data(req)->dirp_map);
 460     if (!elem) {
 461         return -1;
 462     }
 463
 464     elem->dirp = dirp;
 465     return elem - lo_data(req)->dirp_map.elems;
 466 }
 467
 468 /* Assumes lo->mutex is held */
 469 static ssize_t lo_add_inode_mapping(fuse_req_t req, struct lo_inode *inode)
 470 {
 471     struct lo_map_elem *elem;
 472
 473     elem = lo_map_alloc_elem(&lo_data(req)->ino_map);
 474     if (!elem) {
 475         return -1;
 476     }
 477
 478     elem->inode = inode;
 479     return elem - lo_data(req)->ino_map.elems;
 480 }
 481
 482 static void lo_inode_put(struct lo_data *lo, struct lo_inode **inodep)
 483 {
 484     struct lo_inode *inode = *inodep;
 485
 486     if (!inode) {
 487         return;
 488     }
 489
 490     *inodep = NULL;
 491
 492     if (g_atomic_int_dec_and_test(&inode->refcount)) {
 493         close(inode->fd);
 494         free(inode);
 495     }
 496 }
 497
 498 /* Caller must release refcount using lo_inode_put() */
 499 static struct lo_inode *lo_inode(fuse_req_t req, fuse_ino_t ino)
 500 {
 501     struct lo_data *lo = lo_data(req);
 502     struct lo_map_elem *elem;
 503
 504     pthread_mutex_lock(&lo->mutex);
 505     elem = lo_map_get(&lo->ino_map, ino);
 506     if (elem) {
 507         g_atomic_int_inc(&elem->inode->refcount);
 508     }
 509     pthread_mutex_unlock(&lo->mutex);
 510
 511     if (!elem) {
 512         return NULL;
 513     }
 514
 515     return elem->inode;
 516 }
 517
 518 /*
 519  * TODO Remove this helper and force callers to hold an inode refcount until
 520  * they are done with the fd.  This will be done in a later patch to make
 521  * review easier.
 522  */
 523 static int lo_fd(fuse_req_t req, fuse_ino_t ino)
 524 {
 525     struct lo_inode *inode = lo_inode(req, ino);
 526     int fd;
 527
 528     if (!inode) {
 529         return -1;
 530     }
 531
 532     fd = inode->fd;
 533     lo_inode_put(lo_data(req), &inode);
 534     return fd;
 535 }
 536
 537 static void lo_init(void *userdata, struct fuse_conn_info *conn)
 538 {
 539     struct lo_data *lo = (struct lo_data *)userdata;
 540
 541     if (conn->capable & FUSE_CAP_EXPORT_SUPPORT) {
 542         conn->want |= FUSE_CAP_EXPORT_SUPPORT;
 543     }
 544
 545     if (lo->writeback && conn->capable & FUSE_CAP_WRITEBACK_CACHE) {
 546         fuse_log(FUSE_LOG_DEBUG, "lo_init: activating writeback\n");
 547         conn->want |= FUSE_CAP_WRITEBACK_CACHE;
 548     }
 549     if (lo->flock && conn->capable & FUSE_CAP_FLOCK_LOCKS) {
 550         fuse_log(FUSE_LOG_DEBUG, "lo_init: activating flock locks\n");
 551         conn->want |= FUSE_CAP_FLOCK_LOCKS;
 552     }
 553
 554     if (conn->capable & FUSE_CAP_POSIX_LOCKS) {
 555         if (lo->posix_lock) {
 556             fuse_log(FUSE_LOG_DEBUG, "lo_init: activating posix locks\n");
 557             conn->want |= FUSE_CAP_POSIX_LOCKS;
 558         } else {
 559             fuse_log(FUSE_LOG_DEBUG, "lo_init: disabling posix locks\n");
 560             conn->want &= ~FUSE_CAP_POSIX_LOCKS;
 561         }
 562     }
 563
 564     if ((lo->cache == CACHE_NONE && !lo->readdirplus_set) ||
 565         lo->readdirplus_clear) {
 566         fuse_log(FUSE_LOG_DEBUG, "lo_init: disabling readdirplus\n");
 567         conn->want &= ~FUSE_CAP_READDIRPLUS;
 568     }
 569 }
 570
 571 static void lo_getattr(fuse_req_t req, fuse_ino_t ino,
 572                        struct fuse_file_info *fi)
 573 {
 574     int res;
 575     struct stat buf;
 576     struct lo_data *lo = lo_data(req);
 577
 578     (void)fi;
 579
 580     res =
 581         fstatat(lo_fd(req, ino), "", &buf, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
 582     if (res == -1) {
 583         return (void)fuse_reply_err(req, errno);
 584     }
 585
 586     fuse_reply_attr(req, &buf, lo->timeout);
 587 }
 588
 589 /*
 590  * Increments parent->nlookup and caller must release refcount using
 591  * lo_inode_put(&parent).
 592  */
 593 static int lo_parent_and_name(struct lo_data *lo, struct lo_inode *inode,
 594                               char path[PATH_MAX], struct lo_inode **parent)
 595 {
 596     char procname[64];
 597     char *last;
 598     struct stat stat;
 599     struct lo_inode *p;
 600     int retries = 2;
 601     int res;
 602
 603 retry:
 604     sprintf(procname, "%i", inode->fd);
 605
 606     res = readlinkat(lo->proc_self_fd, procname, path, PATH_MAX);
 607     if (res < 0) {
 608         fuse_log(FUSE_LOG_WARNING, "%s: readlink failed: %m\n", __func__);
 609         goto fail_noretry;
 610     }
 611
 612     if (res >= PATH_MAX) {
 613         fuse_log(FUSE_LOG_WARNING, "%s: readlink overflowed\n", __func__);
 614         goto fail_noretry;
 615     }
 616     path[res] = '\0';
 617
 618     last = strrchr(path, '/');
 619     if (last == NULL) {
 620         /* Shouldn't happen */
 621         fuse_log(
 622             FUSE_LOG_WARNING,
 623             "%s: INTERNAL ERROR: bad path read from proc\n", __func__);
 624         goto fail_noretry;
 625     }
 626     if (last == path) {
 627         p = &lo->root;
 628         pthread_mutex_lock(&lo->mutex);
 629         p->nlookup++;
 630         g_atomic_int_inc(&p->refcount);
 631         pthread_mutex_unlock(&lo->mutex);
 632     } else {
 633         *last = '\0';
 634         res = fstatat(AT_FDCWD, last == path ? "/" : path, &stat, 0);
 635         if (res == -1) {
 636             if (!retries) {
 637                 fuse_log(FUSE_LOG_WARNING,
 638                          "%s: failed to stat parent: %m\n", __func__);
 639             }
 640             goto fail;
 641         }
 642         p = lo_find(lo, &stat);
 643         if (p == NULL) {
 644             if (!retries) {
 645                 fuse_log(FUSE_LOG_WARNING,
 646                          "%s: failed to find parent\n", __func__);
 647             }
 648             goto fail;
 649         }
 650     }
 651     last++;
 652     res = fstatat(p->fd, last, &stat, AT_SYMLINK_NOFOLLOW);
 653     if (res == -1) {
 654         if (!retries) {
 655             fuse_log(FUSE_LOG_WARNING,
 656                      "%s: failed to stat last\n", __func__);
 657         }
 658         goto fail_unref;
 659     }
 660     if (stat.st_dev != inode->key.dev || stat.st_ino != inode->key.ino) {
 661         if (!retries) {
 662             fuse_log(FUSE_LOG_WARNING,
 663                      "%s: failed to match last\n", __func__);
 664         }
 665         goto fail_unref;
 666     }
 667     *parent = p;
 668     memmove(path, last, strlen(last) + 1);
 669
 670     return 0;
 671
 672 fail_unref:
 673     unref_inode_lolocked(lo, p, 1);
 674     lo_inode_put(lo, &p);
 675 fail:
 676     if (retries) {
 677         retries--;
 678         goto retry;
 679     }
 680 fail_noretry:
 681     errno = EIO;
 682     return -1;
 683 }
 684
 685 static int utimensat_empty(struct lo_data *lo, struct lo_inode *inode,
 686                            const struct timespec *tv)
 687 {
 688     int res;
 689     struct lo_inode *parent;
 690     char path[PATH_MAX];
 691
 692     if (inode->is_symlink) {
 693         res = utimensat(inode->fd, "", tv, AT_EMPTY_PATH);
 694         if (res == -1 && errno == EINVAL) {
 695             /* Sorry, no race free way to set times on symlink. */
 696             if (lo->norace) {
 697                 errno = EPERM;
 698             } else {
 699                 goto fallback;
 700             }
 701         }
 702         return res;
 703     }
 704     sprintf(path, "%i", inode->fd);
 705
 706     return utimensat(lo->proc_self_fd, path, tv, 0);
 707
 708 fallback:
 709     res = lo_parent_and_name(lo, inode, path, &parent);
 710     if (res != -1) {
 711         res = utimensat(parent->fd, path, tv, AT_SYMLINK_NOFOLLOW);
 712         unref_inode_lolocked(lo, parent, 1);
 713         lo_inode_put(lo, &parent);
 714     }
 715
 716     return res;
 717 }
 718
 719 static int lo_fi_fd(fuse_req_t req, struct fuse_file_info *fi)
 720 {
 721     struct lo_data *lo = lo_data(req);
 722     struct lo_map_elem *elem;
 723
 724     pthread_mutex_lock(&lo->mutex);
 725     elem = lo_map_get(&lo->fd_map, fi->fh);
 726     pthread_mutex_unlock(&lo->mutex);
 727
 728     if (!elem) {
 729         return -1;
 730     }
 731
 732     return elem->fd;
 733 }
 734
 735 static void lo_setattr(fuse_req_t req, fuse_ino_t ino, struct stat *attr,
 736                        int valid, struct fuse_file_info *fi)
 737 {
 738     int saverr;
 739     char procname[64];
 740     struct lo_data *lo = lo_data(req);
 741     struct lo_inode *inode;
 742     int ifd;
 743     int res;
 744     int fd;
 745
 746     inode = lo_inode(req, ino);
 747     if (!inode) {
 748         fuse_reply_err(req, EBADF);
 749         return;
 750     }
 751
 752     ifd = inode->fd;
 753
 754     /* If fi->fh is invalid we'll report EBADF later */
 755     if (fi) {
 756         fd = lo_fi_fd(req, fi);
 757     }
 758
 759     if (valid & FUSE_SET_ATTR_MODE) {
 760         if (fi) {
 761             res = fchmod(fd, attr->st_mode);
 762         } else {
 763             sprintf(procname, "%i", ifd);
 764             res = fchmodat(lo->proc_self_fd, procname, attr->st_mode, 0);
 765         }
 766         if (res == -1) {
 767             goto out_err;
 768         }
 769     }
 770     if (valid & (FUSE_SET_ATTR_UID | FUSE_SET_ATTR_GID)) {
 771         uid_t uid = (valid & FUSE_SET_ATTR_UID) ? attr->st_uid : (uid_t)-1;
 772         gid_t gid = (valid & FUSE_SET_ATTR_GID) ? attr->st_gid : (gid_t)-1;
 773
 774         res = fchownat(ifd, "", uid, gid, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
 775         if (res == -1) {
 776             goto out_err;
 777         }
 778     }
 779     if (valid & FUSE_SET_ATTR_SIZE) {
 780         int truncfd;
 781
 782         if (fi) {
 783             truncfd = fd;
 784         } else {
 785             sprintf(procname, "%i", ifd);
 786             truncfd = openat(lo->proc_self_fd, procname, O_RDWR);
 787             if (truncfd < 0) {
 788                 goto out_err;
 789             }
 790         }
 791
 792         res = ftruncate(truncfd, attr->st_size);
 793         if (!fi) {
 794             saverr = errno;
 795             close(truncfd);
 796             errno = saverr;
 797         }
 798         if (res == -1) {
 799             goto out_err;
 800         }
 801     }
 802     if (valid & (FUSE_SET_ATTR_ATIME | FUSE_SET_ATTR_MTIME)) {
 803         struct timespec tv[2];
 804
 805         tv[0].tv_sec = 0;
 806         tv[1].tv_sec = 0;
 807         tv[0].tv_nsec = UTIME_OMIT;
 808         tv[1].tv_nsec = UTIME_OMIT;
 809
 810         if (valid & FUSE_SET_ATTR_ATIME_NOW) {
 811             tv[0].tv_nsec = UTIME_NOW;
 812         } else if (valid & FUSE_SET_ATTR_ATIME) {
 813             tv[0] = attr->st_atim;
 814         }
 815
 816         if (valid & FUSE_SET_ATTR_MTIME_NOW) {
 817             tv[1].tv_nsec = UTIME_NOW;
 818         } else if (valid & FUSE_SET_ATTR_MTIME) {
 819             tv[1] = attr->st_mtim;
 820         }
 821
 822         if (fi) {
 823             res = futimens(fd, tv);
 824         } else {
 825             res = utimensat_empty(lo, inode, tv);
 826         }
 827         if (res == -1) {
 828             goto out_err;
 829         }
 830     }
 831     lo_inode_put(lo, &inode);
 832
 833     return lo_getattr(req, ino, fi);
 834
 835 out_err:
 836     saverr = errno;
 837     lo_inode_put(lo, &inode);
 838     fuse_reply_err(req, saverr);
 839 }
 840
 841 static struct lo_inode *lo_find(struct lo_data *lo, struct stat *st)
 842 {
 843     struct lo_inode *p;
 844     struct lo_key key = {
 845         .ino = st->st_ino,
 846         .dev = st->st_dev,
 847     };
 848
 849     pthread_mutex_lock(&lo->mutex);
 850     p = g_hash_table_lookup(lo->inodes, &key);
 851     if (p) {
 852         assert(p->nlookup > 0);
 853         p->nlookup++;
 854         g_atomic_int_inc(&p->refcount);
 855     }
 856     pthread_mutex_unlock(&lo->mutex);
 857
 858     return p;
 859 }
 860
 861 /* value_destroy_func for posix_locks GHashTable */
 862 static void posix_locks_value_destroy(gpointer data)
 863 {
 864     struct lo_inode_plock *plock = data;
 865
 866     /*
 867      * We had used open() for locks and had only one fd. So
 868      * closing this fd should release all OFD locks.
 869      */
 870     close(plock->fd);
 871     free(plock);
 872 }
 873
 874 /*
 875  * Increments nlookup and caller must release refcount using
 876  * lo_inode_put(&parent).
 877  */
 878 static int lo_do_lookup(fuse_req_t req, fuse_ino_t parent, const char *name,
 879                         struct fuse_entry_param *e)
 880 {
 881     int newfd;
 882     int res;
 883     int saverr;
 884     struct lo_data *lo = lo_data(req);
 885     struct lo_inode *inode = NULL;
 886     struct lo_inode *dir = lo_inode(req, parent);
 887
 888     /*
 889      * name_to_handle_at() and open_by_handle_at() can reach here with fuse
 890      * mount point in guest, but we don't have its inode info in the
 891      * ino_map.
 892      */
 893     if (!dir) {
 894         return ENOENT;
 895     }
 896
 897     memset(e, 0, sizeof(*e));
 898     e->attr_timeout = lo->timeout;
 899     e->entry_timeout = lo->timeout;
 900
 901     /* Do not allow escaping root directory */
 902     if (dir == &lo->root && strcmp(name, "..") == 0) {
 903         name = ".";
 904     }
 905
 906     newfd = openat(dir->fd, name, O_PATH | O_NOFOLLOW);
 907     if (newfd == -1) {
 908         goto out_err;
 909     }
 910
 911     res = fstatat(newfd, "", &e->attr, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
 912     if (res == -1) {
 913         goto out_err;
 914     }
 915
 916     inode = lo_find(lo, &e->attr);
 917     if (inode) {
 918         close(newfd);
 919         newfd = -1;
 920     } else {
 921         inode = calloc(1, sizeof(struct lo_inode));
 922         if (!inode) {
 923             goto out_err;
 924         }
 925
 926         inode->is_symlink = S_ISLNK(e->attr.st_mode);
 927
 928         /*
 929          * One for the caller and one for nlookup (released in
 930          * unref_inode_lolocked())
 931          */
 932         g_atomic_int_set(&inode->refcount, 2);
 933
 934         inode->nlookup = 1;
 935         inode->fd = newfd;
 936         newfd = -1;
 937         inode->key.ino = e->attr.st_ino;
 938         inode->key.dev = e->attr.st_dev;
 939         pthread_mutex_init(&inode->plock_mutex, NULL);
 940         inode->posix_locks = g_hash_table_new_full(
 941             g_direct_hash, g_direct_equal, NULL, posix_locks_value_destroy);
 942
 943         pthread_mutex_lock(&lo->mutex);
 944         inode->fuse_ino = lo_add_inode_mapping(req, inode);
 945         g_hash_table_insert(lo->inodes, &inode->key, inode);
 946         pthread_mutex_unlock(&lo->mutex);
 947     }
 948     e->ino = inode->fuse_ino;
 949     lo_inode_put(lo, &inode);
 950     lo_inode_put(lo, &dir);
 951
 952     fuse_log(FUSE_LOG_DEBUG, "  %lli/%s -> %lli\n", (unsigned long long)parent,
 953              name, (unsigned long long)e->ino);
 954
 955     return 0;
 956
 957 out_err:
 958     saverr = errno;
 959     if (newfd != -1) {
 960         close(newfd);
 961     }
 962     lo_inode_put(lo, &inode);
 963     lo_inode_put(lo, &dir);
 964     return saverr;
 965 }
 966
 967 static void lo_lookup(fuse_req_t req, fuse_ino_t parent, const char *name)
 968 {
 969     struct fuse_entry_param e;
 970     int err;
 971
 972     fuse_log(FUSE_LOG_DEBUG, "lo_lookup(parent=%" PRIu64 ", name=%s)\n", parent,
 973              name);
 974
 975     /*
 976      * Don't use is_safe_path_component(), allow "." and ".." for NFS export
 977      * support.
 978      */
 979     if (strchr(name, '/')) {
 980         fuse_reply_err(req, EINVAL);
 981         return;
 982     }
 983
 984     err = lo_do_lookup(req, parent, name, &e);
 985     if (err) {
 986         fuse_reply_err(req, err);
 987     } else {
 988         fuse_reply_entry(req, &e);
 989     }
 990 }
 991
 992 /*
 993  * On some archs, setres*id is limited to 2^16 but they
 994  * provide setres*id32 variants that allow 2^32.
 995  * Others just let setres*id do 2^32 anyway.
 996  */
 997 #ifdef SYS_setresgid32
 998 #define OURSYS_setresgid SYS_setresgid32
 999 #else
1000 #define OURSYS_setresgid SYS_setresgid
1001 #endif
1002
1003 #ifdef SYS_setresuid32
1004 #define OURSYS_setresuid SYS_setresuid32
1005 #else
1006 #define OURSYS_setresuid SYS_setresuid
1007 #endif
1008
1009 /*
1010  * Change to uid/gid of caller so that file is created with
1011  * ownership of caller.
1012  * TODO: What about selinux context?
1013  */
1014 static int lo_change_cred(fuse_req_t req, struct lo_cred *old)
1015 {
1016     int res;
1017
1018     old->euid = geteuid();
1019     old->egid = getegid();
1020
1021     res = syscall(OURSYS_setresgid, -1, fuse_req_ctx(req)->gid, -1);
1022     if (res == -1) {
1023         return errno;
1024     }
1025
1026     res = syscall(OURSYS_setresuid, -1, fuse_req_ctx(req)->uid, -1);
1027     if (res == -1) {
1028         int errno_save = errno;
1029
1030         syscall(OURSYS_setresgid, -1, old->egid, -1);
1031         return errno_save;
1032     }
1033
1034     return 0;
1035 }
1036
1037 /* Regain Privileges */
1038 static void lo_restore_cred(struct lo_cred *old)
1039 {
1040     int res;
1041
1042     res = syscall(OURSYS_setresuid, -1, old->euid, -1);
1043     if (res == -1) {
1044         fuse_log(FUSE_LOG_ERR, "seteuid(%u): %m\n", old->euid);
1045         exit(1);
1046     }
1047
1048     res = syscall(OURSYS_setresgid, -1, old->egid, -1);
1049     if (res == -1) {
1050         fuse_log(FUSE_LOG_ERR, "setegid(%u): %m\n", old->egid);
1051         exit(1);
1052     }
1053 }
1054
1055 static void lo_mknod_symlink(fuse_req_t req, fuse_ino_t parent,
1056                              const char *name, mode_t mode, dev_t rdev,
1057                              const char *link)
1058 {
1059     int res;
1060     int saverr;
1061     struct lo_data *lo = lo_data(req);
1062     struct lo_inode *dir;
1063     struct fuse_entry_param e;
1064     struct lo_cred old = {};
1065
1066     if (!is_safe_path_component(name)) {
1067         fuse_reply_err(req, EINVAL);
1068         return;
1069     }
1070
1071     dir = lo_inode(req, parent);
1072     if (!dir) {
1073         fuse_reply_err(req, EBADF);
1074         return;
1075     }
1076
1077     saverr = ENOMEM;
1078
1079     saverr = lo_change_cred(req, &old);
1080     if (saverr) {
1081         goto out;
1082     }
1083
1084     res = mknod_wrapper(dir->fd, name, link, mode, rdev);
1085
1086     saverr = errno;
1087
1088     lo_restore_cred(&old);
1089
1090     if (res == -1) {
1091         goto out;
1092     }
1093
1094     saverr = lo_do_lookup(req, parent, name, &e);
1095     if (saverr) {
1096         goto out;
1097     }
1098
1099     fuse_log(FUSE_LOG_DEBUG, "  %lli/%s -> %lli\n", (unsigned long long)parent,
1100              name, (unsigned long long)e.ino);
1101
1102     fuse_reply_entry(req, &e);
1103     lo_inode_put(lo, &dir);
1104     return;
1105
1106 out:
1107     lo_inode_put(lo, &dir);
1108     fuse_reply_err(req, saverr);
1109 }
1110
1111 static void lo_mknod(fuse_req_t req, fuse_ino_t parent, const char *name,
1112                      mode_t mode, dev_t rdev)
1113 {
1114     lo_mknod_symlink(req, parent, name, mode, rdev, NULL);
1115 }
1116
1117 static void lo_mkdir(fuse_req_t req, fuse_ino_t parent, const char *name,
1118                      mode_t mode)
1119 {
1120     lo_mknod_symlink(req, parent, name, S_IFDIR | mode, 0, NULL);
1121 }
1122
1123 static void lo_symlink(fuse_req_t req, const char *link, fuse_ino_t parent,
1124                        const char *name)
1125 {
1126     lo_mknod_symlink(req, parent, name, S_IFLNK, 0, link);
1127 }
1128
1129 static int linkat_empty_nofollow(struct lo_data *lo, struct lo_inode *inode,
1130                                  int dfd, const char *name)
1131 {
1132     int res;
1133     struct lo_inode *parent;
1134     char path[PATH_MAX];
1135
1136     if (inode->is_symlink) {
1137         res = linkat(inode->fd, "", dfd, name, AT_EMPTY_PATH);
1138         if (res == -1 && (errno == ENOENT || errno == EINVAL)) {
1139             /* Sorry, no race free way to hard-link a symlink. */
1140             if (lo->norace) {
1141                 errno = EPERM;
1142             } else {
1143                 goto fallback;
1144             }
1145         }
1146         return res;
1147     }
1148
1149     sprintf(path, "%i", inode->fd);
1150
1151     return linkat(lo->proc_self_fd, path, dfd, name, AT_SYMLINK_FOLLOW);
1152
1153 fallback:
1154     res = lo_parent_and_name(lo, inode, path, &parent);
1155     if (res != -1) {
1156         res = linkat(parent->fd, path, dfd, name, 0);
1157         unref_inode_lolocked(lo, parent, 1);
1158         lo_inode_put(lo, &parent);
1159     }
1160
1161     return res;
1162 }
1163
1164 static void lo_link(fuse_req_t req, fuse_ino_t ino, fuse_ino_t parent,
1165                     const char *name)
1166 {
1167     int res;
1168     struct lo_data *lo = lo_data(req);
1169     struct lo_inode *parent_inode;
1170     struct lo_inode *inode;
1171     struct fuse_entry_param e;
1172     int saverr;
1173
1174     if (!is_safe_path_component(name)) {
1175         fuse_reply_err(req, EINVAL);
1176         return;
1177     }
1178
1179     parent_inode = lo_inode(req, parent);
1180     inode = lo_inode(req, ino);
1181     if (!parent_inode || !inode) {
1182         errno = EBADF;
1183         goto out_err;
1184     }
1185
1186     memset(&e, 0, sizeof(struct fuse_entry_param));
1187     e.attr_timeout = lo->timeout;
1188     e.entry_timeout = lo->timeout;
1189
1190     res = linkat_empty_nofollow(lo, inode, parent_inode->fd, name);
1191     if (res == -1) {
1192         goto out_err;
1193     }
1194
1195     res = fstatat(inode->fd, "", &e.attr, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
1196     if (res == -1) {
1197         goto out_err;
1198     }
1199
1200     pthread_mutex_lock(&lo->mutex);
1201     inode->nlookup++;
1202     pthread_mutex_unlock(&lo->mutex);
1203     e.ino = inode->fuse_ino;
1204
1205     fuse_log(FUSE_LOG_DEBUG, "  %lli/%s -> %lli\n", (unsigned long long)parent,
1206              name, (unsigned long long)e.ino);
1207
1208     fuse_reply_entry(req, &e);
1209     lo_inode_put(lo, &parent_inode);
1210     lo_inode_put(lo, &inode);
1211     return;
1212
1213 out_err:
1214     saverr = errno;
1215     lo_inode_put(lo, &parent_inode);
1216     lo_inode_put(lo, &inode);
1217     fuse_reply_err(req, saverr);
1218 }
1219
1220 /* Increments nlookup and caller must release refcount using lo_inode_put() */
1221 static struct lo_inode *lookup_name(fuse_req_t req, fuse_ino_t parent,
1222                                     const char *name)
1223 {
1224     int res;
1225     struct stat attr;
1226
1227     res = fstatat(lo_fd(req, parent), name, &attr,
1228                   AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
1229     if (res == -1) {
1230         return NULL;
1231     }
1232
1233     return lo_find(lo_data(req), &attr);
1234 }
1235
1236 static void lo_rmdir(fuse_req_t req, fuse_ino_t parent, const char *name)
1237 {
1238     int res;
1239     struct lo_inode *inode;
1240     struct lo_data *lo = lo_data(req);
1241
1242     if (!is_safe_path_component(name)) {
1243         fuse_reply_err(req, EINVAL);
1244         return;
1245     }
1246
1247     inode = lookup_name(req, parent, name);
1248     if (!inode) {
1249         fuse_reply_err(req, EIO);
1250         return;
1251     }
1252
1253     res = unlinkat(lo_fd(req, parent), name, AT_REMOVEDIR);
1254
1255     fuse_reply_err(req, res == -1 ? errno : 0);
1256     unref_inode_lolocked(lo, inode, 1);
1257     lo_inode_put(lo, &inode);
1258 }
1259
1260 static void lo_rename(fuse_req_t req, fuse_ino_t parent, const char *name,
1261                       fuse_ino_t newparent, const char *newname,
1262                       unsigned int flags)
1263 {
1264     int res;
1265     struct lo_inode *parent_inode;
1266     struct lo_inode *newparent_inode;
1267     struct lo_inode *oldinode = NULL;
1268     struct lo_inode *newinode = NULL;
1269     struct lo_data *lo = lo_data(req);
1270
1271     if (!is_safe_path_component(name) || !is_safe_path_component(newname)) {
1272         fuse_reply_err(req, EINVAL);
1273         return;
1274     }
1275
1276     parent_inode = lo_inode(req, parent);
1277     newparent_inode = lo_inode(req, newparent);
1278     if (!parent_inode || !newparent_inode) {
1279         fuse_reply_err(req, EBADF);
1280         goto out;
1281     }
1282
1283     oldinode = lookup_name(req, parent, name);
1284     newinode = lookup_name(req, newparent, newname);
1285
1286     if (!oldinode) {
1287         fuse_reply_err(req, EIO);
1288         goto out;
1289     }
1290
1291     if (flags) {
1292 #ifndef SYS_renameat2
1293         fuse_reply_err(req, EINVAL);
1294 #else
1295         res = syscall(SYS_renameat2, parent_inode->fd, name,
1296                         newparent_inode->fd, newname, flags);
1297         if (res == -1 && errno == ENOSYS) {
1298             fuse_reply_err(req, EINVAL);
1299         } else {
1300             fuse_reply_err(req, res == -1 ? errno : 0);
1301         }
1302 #endif
1303         goto out;
1304     }
1305
1306     res = renameat(parent_inode->fd, name, newparent_inode->fd, newname);
1307
1308     fuse_reply_err(req, res == -1 ? errno : 0);
1309 out:
1310     unref_inode_lolocked(lo, oldinode, 1);
1311     unref_inode_lolocked(lo, newinode, 1);
1312     lo_inode_put(lo, &oldinode);
1313     lo_inode_put(lo, &newinode);
1314     lo_inode_put(lo, &parent_inode);
1315     lo_inode_put(lo, &newparent_inode);
1316 }
1317
1318 static void lo_unlink(fuse_req_t req, fuse_ino_t parent, const char *name)
1319 {
1320     int res;
1321     struct lo_inode *inode;
1322     struct lo_data *lo = lo_data(req);
1323
1324     if (!is_safe_path_component(name)) {
1325         fuse_reply_err(req, EINVAL);
1326         return;
1327     }
1328
1329     inode = lookup_name(req, parent, name);
1330     if (!inode) {
1331         fuse_reply_err(req, EIO);
1332         return;
1333     }
1334
1335     res = unlinkat(lo_fd(req, parent), name, 0);
1336
1337     fuse_reply_err(req, res == -1 ? errno : 0);
1338     unref_inode_lolocked(lo, inode, 1);
1339     lo_inode_put(lo, &inode);
1340 }
1341
1342 static void unref_inode_lolocked(struct lo_data *lo, struct lo_inode *inode,
1343                                  uint64_t n)
1344 {
1345     if (!inode) {
1346         return;
1347     }
1348
1349     pthread_mutex_lock(&lo->mutex);
1350     assert(inode->nlookup >= n);
1351     inode->nlookup -= n;
1352     if (!inode->nlookup) {
1353         lo_map_remove(&lo->ino_map, inode->fuse_ino);
1354         g_hash_table_remove(lo->inodes, &inode->key);
1355         if (g_hash_table_size(inode->posix_locks)) {
1356             fuse_log(FUSE_LOG_WARNING, "Hash table is not empty\n");
1357         }
1358         g_hash_table_destroy(inode->posix_locks);
1359         pthread_mutex_destroy(&inode->plock_mutex);
1360         pthread_mutex_unlock(&lo->mutex);
1361
1362         /* Drop our refcount from lo_do_lookup() */
1363         lo_inode_put(lo, &inode);
1364     } else {
1365         pthread_mutex_unlock(&lo->mutex);
1366     }
1367 }
1368
1369 static int unref_all_inodes_cb(gpointer key, gpointer value, gpointer user_data)
1370 {
1371     struct lo_inode *inode = value;
1372     struct lo_data *lo = user_data;
1373
1374     inode->nlookup = 0;
1375     lo_map_remove(&lo->ino_map, inode->fuse_ino);
1376     close(inode->fd);
1377     lo_inode_put(lo, &inode); /* Drop our refcount from lo_do_lookup() */
1378
1379     return TRUE;
1380 }
1381
1382 static void unref_all_inodes(struct lo_data *lo)
1383 {
1384     pthread_mutex_lock(&lo->mutex);
1385     g_hash_table_foreach_remove(lo->inodes, unref_all_inodes_cb, lo);
1386     pthread_mutex_unlock(&lo->mutex);
1387 }
1388
1389 static void lo_forget_one(fuse_req_t req, fuse_ino_t ino, uint64_t nlookup)
1390 {
1391     struct lo_data *lo = lo_data(req);
1392     struct lo_inode *inode;
1393
1394     inode = lo_inode(req, ino);
1395     if (!inode) {
1396         return;
1397     }
1398
1399     fuse_log(FUSE_LOG_DEBUG, "  forget %lli %lli -%lli\n",
1400              (unsigned long long)ino, (unsigned long long)inode->nlookup,
1401              (unsigned long long)nlookup);
1402
1403     unref_inode_lolocked(lo, inode, nlookup);
1404     lo_inode_put(lo, &inode);
1405 }
1406
1407 static void lo_forget(fuse_req_t req, fuse_ino_t ino, uint64_t nlookup)
1408 {
1409     lo_forget_one(req, ino, nlookup);
1410     fuse_reply_none(req);
1411 }
1412
1413 static void lo_forget_multi(fuse_req_t req, size_t count,
1414                             struct fuse_forget_data *forgets)
1415 {
1416     int i;
1417
1418     for (i = 0; i < count; i++) {
1419         lo_forget_one(req, forgets[i].ino, forgets[i].nlookup);
1420     }
1421     fuse_reply_none(req);
1422 }
1423
1424 static void lo_readlink(fuse_req_t req, fuse_ino_t ino)
1425 {
1426     char buf[PATH_MAX + 1];
1427     int res;
1428
1429     res = readlinkat(lo_fd(req, ino), "", buf, sizeof(buf));
1430     if (res == -1) {
1431         return (void)fuse_reply_err(req, errno);
1432     }
1433
1434     if (res == sizeof(buf)) {
1435         return (void)fuse_reply_err(req, ENAMETOOLONG);
1436     }
1437
1438     buf[res] = '\0';
1439
1440     fuse_reply_readlink(req, buf);
1441 }
1442
1443 struct lo_dirp {
1444     gint refcount;
1445     DIR *dp;
1446     struct dirent *entry;
1447     off_t offset;
1448 };
1449
1450 static void lo_dirp_put(struct lo_dirp **dp)
1451 {
1452     struct lo_dirp *d = *dp;
1453
1454     if (!d) {
1455         return;
1456     }
1457     *dp = NULL;
1458
1459     if (g_atomic_int_dec_and_test(&d->refcount)) {
1460         closedir(d->dp);
1461         free(d);
1462     }
1463 }
1464
1465 /* Call lo_dirp_put() on the return value when no longer needed */
1466 static struct lo_dirp *lo_dirp(fuse_req_t req, struct fuse_file_info *fi)
1467 {
1468     struct lo_data *lo = lo_data(req);
1469     struct lo_map_elem *elem;
1470
1471     pthread_mutex_lock(&lo->mutex);
1472     elem = lo_map_get(&lo->dirp_map, fi->fh);
1473     if (elem) {
1474         g_atomic_int_inc(&elem->dirp->refcount);
1475     }
1476     pthread_mutex_unlock(&lo->mutex);
1477     if (!elem) {
1478         return NULL;
1479     }
1480
1481     return elem->dirp;
1482 }
1483
1484 static void lo_opendir(fuse_req_t req, fuse_ino_t ino,
1485                        struct fuse_file_info *fi)
1486 {
1487     int error = ENOMEM;
1488     struct lo_data *lo = lo_data(req);
1489     struct lo_dirp *d;
1490     int fd;
1491     ssize_t fh;
1492
1493     d = calloc(1, sizeof(struct lo_dirp));
1494     if (d == NULL) {
1495         goto out_err;
1496     }
1497
1498     fd = openat(lo_fd(req, ino), ".", O_RDONLY);
1499     if (fd == -1) {
1500         goto out_errno;
1501     }
1502
1503     d->dp = fdopendir(fd);
1504     if (d->dp == NULL) {
1505         goto out_errno;
1506     }
1507
1508     d->offset = 0;
1509     d->entry = NULL;
1510
1511     g_atomic_int_set(&d->refcount, 1); /* paired with lo_releasedir() */
1512     pthread_mutex_lock(&lo->mutex);
1513     fh = lo_add_dirp_mapping(req, d);
1514     pthread_mutex_unlock(&lo->mutex);
1515     if (fh == -1) {
1516         goto out_err;
1517     }
1518
1519     fi->fh = fh;
1520     if (lo->cache == CACHE_ALWAYS) {
1521         fi->keep_cache = 1;
1522     }
1523     fuse_reply_open(req, fi);
1524     return;
1525
1526 out_errno:
1527     error = errno;
1528 out_err:
1529     if (d) {
1530         if (d->dp) {
1531             closedir(d->dp);
1532         }
1533         if (fd != -1) {
1534             close(fd);
1535         }
1536         free(d);
1537     }
1538     fuse_reply_err(req, error);
1539 }
1540
1541 static void lo_do_readdir(fuse_req_t req, fuse_ino_t ino, size_t size,
1542                           off_t offset, struct fuse_file_info *fi, int plus)
1543 {
1544     struct lo_data *lo = lo_data(req);
1545     struct lo_dirp *d = NULL;
1546     struct lo_inode *dinode;
1547     char *buf = NULL;
1548     char *p;
1549     size_t rem = size;
1550     int err = EBADF;
1551
1552     dinode = lo_inode(req, ino);
1553     if (!dinode) {
1554         goto error;
1555     }
1556
1557     d = lo_dirp(req, fi);
1558     if (!d) {
1559         goto error;
1560     }
1561
1562     err = ENOMEM;
1563     buf = calloc(1, size);
1564     if (!buf) {
1565         goto error;
1566     }
1567     p = buf;
1568
1569     if (offset != d->offset) {
1570         seekdir(d->dp, offset);
1571         d->entry = NULL;
1572         d->offset = offset;
1573     }
1574     while (1) {
1575         size_t entsize;
1576         off_t nextoff;
1577         const char *name;
1578
1579         if (!d->entry) {
1580             errno = 0;
1581             d->entry = readdir(d->dp);
1582             if (!d->entry) {
1583                 if (errno) { /* Error */
1584                     err = errno;
1585                     goto error;
1586                 } else { /* End of stream */
1587                     break;
1588                 }
1589             }
1590         }
1591         nextoff = d->entry->d_off;
1592         name = d->entry->d_name;
1593
1594         fuse_ino_t entry_ino = 0;
1595         struct fuse_entry_param e = (struct fuse_entry_param){
1596             .attr.st_ino = d->entry->d_ino,
1597             .attr.st_mode = d->entry->d_type << 12,
1598         };
1599
1600         /* Hide root's parent directory */
1601         if (dinode == &lo->root && strcmp(name, "..") == 0) {
1602             e.attr.st_ino = lo->root.key.ino;
1603             e.attr.st_mode = DT_DIR << 12;
1604         }
1605
1606         if (plus) {
1607             if (!is_dot_or_dotdot(name)) {
1608                 err = lo_do_lookup(req, ino, name, &e);
1609                 if (err) {
1610                     goto error;
1611                 }
1612                 entry_ino = e.ino;
1613             }
1614
1615             entsize = fuse_add_direntry_plus(req, p, rem, name, &e, nextoff);
1616         } else {
1617             entsize = fuse_add_direntry(req, p, rem, name, &e.attr, nextoff);
1618         }
1619         if (entsize > rem) {
1620             if (entry_ino != 0) {
1621                 lo_forget_one(req, entry_ino, 1);
1622             }
1623             break;
1624         }
1625
1626         p += entsize;
1627         rem -= entsize;
1628
1629         d->entry = NULL;
1630         d->offset = nextoff;
1631     }
1632
1633     err = 0;
1634 error:
1635     lo_dirp_put(&d);
1636     lo_inode_put(lo, &dinode);
1637
1638     /*
1639      * If there's an error, we can only signal it if we haven't stored
1640      * any entries yet - otherwise we'd end up with wrong lookup
1641      * counts for the entries that are already in the buffer. So we
1642      * return what we've collected until that point.
1643      */
1644     if (err && rem == size) {
1645         fuse_reply_err(req, err);
1646     } else {
1647         fuse_reply_buf(req, buf, size - rem);
1648     }
1649     free(buf);
1650 }
1651
1652 static void lo_readdir(fuse_req_t req, fuse_ino_t ino, size_t size,
1653                        off_t offset, struct fuse_file_info *fi)
1654 {
1655     lo_do_readdir(req, ino, size, offset, fi, 0);
1656 }
1657
1658 static void lo_readdirplus(fuse_req_t req, fuse_ino_t ino, size_t size,
1659                            off_t offset, struct fuse_file_info *fi)
1660 {
1661     lo_do_readdir(req, ino, size, offset, fi, 1);
1662 }
1663
1664 static void lo_releasedir(fuse_req_t req, fuse_ino_t ino,
1665                           struct fuse_file_info *fi)
1666 {
1667     struct lo_data *lo = lo_data(req);
1668     struct lo_map_elem *elem;
1669     struct lo_dirp *d;
1670
1671     (void)ino;
1672
1673     pthread_mutex_lock(&lo->mutex);
1674     elem = lo_map_get(&lo->dirp_map, fi->fh);
1675     if (!elem) {
1676         pthread_mutex_unlock(&lo->mutex);
1677         fuse_reply_err(req, EBADF);
1678         return;
1679     }
1680
1681     d = elem->dirp;
1682     lo_map_remove(&lo->dirp_map, fi->fh);
1683     pthread_mutex_unlock(&lo->mutex);
1684
1685     lo_dirp_put(&d); /* paired with lo_opendir() */
1686
1687     fuse_reply_err(req, 0);
1688 }
1689
1690 static void lo_create(fuse_req_t req, fuse_ino_t parent, const char *name,
1691                       mode_t mode, struct fuse_file_info *fi)
1692 {
1693     int fd;
1694     struct lo_data *lo = lo_data(req);
1695     struct lo_inode *parent_inode;
1696     struct fuse_entry_param e;
1697     int err;
1698     struct lo_cred old = {};
1699
1700     fuse_log(FUSE_LOG_DEBUG, "lo_create(parent=%" PRIu64 ", name=%s)\n", parent,
1701              name);
1702
1703     if (!is_safe_path_component(name)) {
1704         fuse_reply_err(req, EINVAL);
1705         return;
1706     }
1707
1708     parent_inode = lo_inode(req, parent);
1709     if (!parent_inode) {
1710         fuse_reply_err(req, EBADF);
1711         return;
1712     }
1713
1714     err = lo_change_cred(req, &old);
1715     if (err) {
1716         goto out;
1717     }
1718
1719     fd = openat(parent_inode->fd, name, (fi->flags | O_CREAT) & ~O_NOFOLLOW,
1720                 mode);
1721     err = fd == -1 ? errno : 0;
1722     lo_restore_cred(&old);
1723
1724     if (!err) {
1725         ssize_t fh;
1726
1727         pthread_mutex_lock(&lo->mutex);
1728         fh = lo_add_fd_mapping(req, fd);
1729         pthread_mutex_unlock(&lo->mutex);
1730         if (fh == -1) {
1731             close(fd);
1732             err = ENOMEM;
1733             goto out;
1734         }
1735
1736         fi->fh = fh;
1737         err = lo_do_lookup(req, parent, name, &e);
1738     }
1739     if (lo->cache == CACHE_NONE) {
1740         fi->direct_io = 1;
1741     } else if (lo->cache == CACHE_ALWAYS) {
1742         fi->keep_cache = 1;
1743     }
1744
1745 out:
1746     lo_inode_put(lo, &parent_inode);
1747
1748     if (err) {
1749         fuse_reply_err(req, err);
1750     } else {
1751         fuse_reply_create(req, &e, fi);
1752     }
1753 }
1754
1755 /* Should be called with inode->plock_mutex held */
1756 static struct lo_inode_plock *lookup_create_plock_ctx(struct lo_data *lo,
1757                                                       struct lo_inode *inode,
1758                                                       uint64_t lock_owner,
1759                                                       pid_t pid, int *err)
1760 {
1761     struct lo_inode_plock *plock;
1762     char procname[64];
1763     int fd;
1764
1765     plock =
1766         g_hash_table_lookup(inode->posix_locks, GUINT_TO_POINTER(lock_owner));
1767
1768     if (plock) {
1769         return plock;
1770     }
1771
1772     plock = malloc(sizeof(struct lo_inode_plock));
1773     if (!plock) {
1774         *err = ENOMEM;
1775         return NULL;
1776     }
1777
1778     /* Open another instance of file which can be used for ofd locks. */
1779     sprintf(procname, "%i", inode->fd);
1780
1781     /* TODO: What if file is not writable? */
1782     fd = openat(lo->proc_self_fd, procname, O_RDWR);
1783     if (fd == -1) {
1784         *err = errno;
1785         free(plock);
1786         return NULL;
1787     }
1788
1789     plock->lock_owner = lock_owner;
1790     plock->fd = fd;
1791     g_hash_table_insert(inode->posix_locks, GUINT_TO_POINTER(plock->lock_owner),
1792                         plock);
1793     return plock;
1794 }
1795
1796 static void lo_getlk(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi,
1797                      struct flock *lock)
1798 {
1799     struct lo_data *lo = lo_data(req);
1800     struct lo_inode *inode;
1801     struct lo_inode_plock *plock;
1802     int ret, saverr = 0;
1803
1804     fuse_log(FUSE_LOG_DEBUG,
1805              "lo_getlk(ino=%" PRIu64 ", flags=%d)"
1806              " owner=0x%lx, l_type=%d l_start=0x%lx"
1807              " l_len=0x%lx\n",
1808              ino, fi->flags, fi->lock_owner, lock->l_type, lock->l_start,
1809              lock->l_len);
1810
1811     inode = lo_inode(req, ino);
1812     if (!inode) {
1813         fuse_reply_err(req, EBADF);
1814         return;
1815     }
1816
1817     pthread_mutex_lock(&inode->plock_mutex);
1818     plock =
1819         lookup_create_plock_ctx(lo, inode, fi->lock_owner, lock->l_pid, &ret);
1820     if (!plock) {
1821         saverr = ret;
1822         goto out;
1823     }
1824
1825     ret = fcntl(plock->fd, F_OFD_GETLK, lock);
1826     if (ret == -1) {
1827         saverr = errno;
1828     }
1829
1830 out:
1831     pthread_mutex_unlock(&inode->plock_mutex);
1832     lo_inode_put(lo, &inode);
1833
1834     if (saverr) {
1835         fuse_reply_err(req, saverr);
1836     } else {
1837         fuse_reply_lock(req, lock);
1838     }
1839 }
1840
1841 static void lo_setlk(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi,
1842                      struct flock *lock, int sleep)
1843 {
1844     struct lo_data *lo = lo_data(req);
1845     struct lo_inode *inode;
1846     struct lo_inode_plock *plock;
1847     int ret, saverr = 0;
1848
1849     fuse_log(FUSE_LOG_DEBUG,
1850              "lo_setlk(ino=%" PRIu64 ", flags=%d)"
1851              " cmd=%d pid=%d owner=0x%lx sleep=%d l_whence=%d"
1852              " l_start=0x%lx l_len=0x%lx\n",
1853              ino, fi->flags, lock->l_type, lock->l_pid, fi->lock_owner, sleep,
1854              lock->l_whence, lock->l_start, lock->l_len);
1855
1856     if (sleep) {
1857         fuse_reply_err(req, EOPNOTSUPP);
1858         return;
1859     }
1860
1861     inode = lo_inode(req, ino);
1862     if (!inode) {
1863         fuse_reply_err(req, EBADF);
1864         return;
1865     }
1866
1867     pthread_mutex_lock(&inode->plock_mutex);
1868     plock =
1869         lookup_create_plock_ctx(lo, inode, fi->lock_owner, lock->l_pid, &ret);
1870
1871     if (!plock) {
1872         saverr = ret;
1873         goto out;
1874     }
1875
1876     /* TODO: Is it alright to modify flock? */
1877     lock->l_pid = 0;
1878     ret = fcntl(plock->fd, F_OFD_SETLK, lock);
1879     if (ret == -1) {
1880         saverr = errno;
1881     }
1882
1883 out:
1884     pthread_mutex_unlock(&inode->plock_mutex);
1885     lo_inode_put(lo, &inode);
1886
1887     fuse_reply_err(req, saverr);
1888 }
1889
1890 static void lo_fsyncdir(fuse_req_t req, fuse_ino_t ino, int datasync,
1891                         struct fuse_file_info *fi)
1892 {
1893     int res;
1894     struct lo_dirp *d;
1895     int fd;
1896
1897     (void)ino;
1898
1899     d = lo_dirp(req, fi);
1900     if (!d) {
1901         fuse_reply_err(req, EBADF);
1902         return;
1903     }
1904
1905     fd = dirfd(d->dp);
1906     if (datasync) {
1907         res = fdatasync(fd);
1908     } else {
1909         res = fsync(fd);
1910     }
1911
1912     lo_dirp_put(&d);
1913
1914     fuse_reply_err(req, res == -1 ? errno : 0);
1915 }
1916
1917 static void lo_open(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi)
1918 {
1919     int fd;
1920     ssize_t fh;
1921     char buf[64];
1922     struct lo_data *lo = lo_data(req);
1923
1924     fuse_log(FUSE_LOG_DEBUG, "lo_open(ino=%" PRIu64 ", flags=%d)\n", ino,
1925              fi->flags);
1926
1927     /*
1928      * With writeback cache, kernel may send read requests even
1929      * when userspace opened write-only
1930      */
1931     if (lo->writeback && (fi->flags & O_ACCMODE) == O_WRONLY) {
1932         fi->flags &= ~O_ACCMODE;
1933         fi->flags |= O_RDWR;
1934     }
1935
1936     /*
1937      * With writeback cache, O_APPEND is handled by the kernel.
1938      * This breaks atomicity (since the file may change in the
1939      * underlying filesystem, so that the kernel's idea of the
1940      * end of the file isn't accurate anymore). In this example,
1941      * we just accept that. A more rigorous filesystem may want
1942      * to return an error here
1943      */
1944     if (lo->writeback && (fi->flags & O_APPEND)) {
1945         fi->flags &= ~O_APPEND;
1946     }
1947
1948     sprintf(buf, "%i", lo_fd(req, ino));
1949     fd = openat(lo->proc_self_fd, buf, fi->flags & ~O_NOFOLLOW);
1950     if (fd == -1) {
1951         return (void)fuse_reply_err(req, errno);
1952     }
1953
1954     pthread_mutex_lock(&lo->mutex);
1955     fh = lo_add_fd_mapping(req, fd);
1956     pthread_mutex_unlock(&lo->mutex);
1957     if (fh == -1) {
1958         close(fd);
1959         fuse_reply_err(req, ENOMEM);
1960         return;
1961     }
1962
1963     fi->fh = fh;
1964     if (lo->cache == CACHE_NONE) {
1965         fi->direct_io = 1;
1966     } else if (lo->cache == CACHE_ALWAYS) {
1967         fi->keep_cache = 1;
1968     }
1969     fuse_reply_open(req, fi);
1970 }
1971
1972 static void lo_release(fuse_req_t req, fuse_ino_t ino,
1973                        struct fuse_file_info *fi)
1974 {
1975     struct lo_data *lo = lo_data(req);
1976     struct lo_map_elem *elem;
1977     int fd = -1;
1978
1979     (void)ino;
1980
1981     pthread_mutex_lock(&lo->mutex);
1982     elem = lo_map_get(&lo->fd_map, fi->fh);
1983     if (elem) {
1984         fd = elem->fd;
1985         elem = NULL;
1986         lo_map_remove(&lo->fd_map, fi->fh);
1987     }
1988     pthread_mutex_unlock(&lo->mutex);
1989
1990     close(fd);
1991     fuse_reply_err(req, 0);
1992 }
1993
1994 static void lo_flush(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi)
1995 {
1996     int res;
1997     (void)ino;
1998     struct lo_inode *inode;
1999
2000     inode = lo_inode(req, ino);
2001     if (!inode) {
2002         fuse_reply_err(req, EBADF);
2003         return;
2004     }
2005
2006     /* An fd is going away. Cleanup associated posix locks */
2007     pthread_mutex_lock(&inode->plock_mutex);
2008     g_hash_table_remove(inode->posix_locks, GUINT_TO_POINTER(fi->lock_owner));
2009     pthread_mutex_unlock(&inode->plock_mutex);
2010
2011     res = close(dup(lo_fi_fd(req, fi)));
2012     lo_inode_put(lo_data(req), &inode);
2013     fuse_reply_err(req, res == -1 ? errno : 0);
2014 }
2015
2016 static void lo_fsync(fuse_req_t req, fuse_ino_t ino, int datasync,
2017                      struct fuse_file_info *fi)
2018 {
2019     int res;
2020     int fd;
2021     char *buf;
2022
2023     fuse_log(FUSE_LOG_DEBUG, "lo_fsync(ino=%" PRIu64 ", fi=0x%p)\n", ino,
2024              (void *)fi);
2025
2026     if (!fi) {
2027         struct lo_data *lo = lo_data(req);
2028
2029         res = asprintf(&buf, "%i", lo_fd(req, ino));
2030         if (res == -1) {
2031             return (void)fuse_reply_err(req, errno);
2032         }
2033
2034         fd = openat(lo->proc_self_fd, buf, O_RDWR);
2035         free(buf);
2036         if (fd == -1) {
2037             return (void)fuse_reply_err(req, errno);
2038         }
2039     } else {
2040         fd = lo_fi_fd(req, fi);
2041     }
2042
2043     if (datasync) {
2044         res = fdatasync(fd);
2045     } else {
2046         res = fsync(fd);
2047     }
2048     if (!fi) {
2049         close(fd);
2050     }
2051     fuse_reply_err(req, res == -1 ? errno : 0);
2052 }
2053
2054 static void lo_read(fuse_req_t req, fuse_ino_t ino, size_t size, off_t offset,
2055                     struct fuse_file_info *fi)
2056 {
2057     struct fuse_bufvec buf = FUSE_BUFVEC_INIT(size);
2058
2059     fuse_log(FUSE_LOG_DEBUG,
2060              "lo_read(ino=%" PRIu64 ", size=%zd, "
2061              "off=%lu)\n",
2062              ino, size, (unsigned long)offset);
2063
2064     buf.buf[0].flags = FUSE_BUF_IS_FD | FUSE_BUF_FD_SEEK;
2065     buf.buf[0].fd = lo_fi_fd(req, fi);
2066     buf.buf[0].pos = offset;
2067
2068     fuse_reply_data(req, &buf);
2069 }
2070
2071 static void lo_write_buf(fuse_req_t req, fuse_ino_t ino,
2072                          struct fuse_bufvec *in_buf, off_t off,
2073                          struct fuse_file_info *fi)
2074 {
2075     (void)ino;
2076     ssize_t res;
2077     struct fuse_bufvec out_buf = FUSE_BUFVEC_INIT(fuse_buf_size(in_buf));
2078     bool cap_fsetid_dropped = false;
2079
2080     out_buf.buf[0].flags = FUSE_BUF_IS_FD | FUSE_BUF_FD_SEEK;
2081     out_buf.buf[0].fd = lo_fi_fd(req, fi);
2082     out_buf.buf[0].pos = off;
2083
2084     fuse_log(FUSE_LOG_DEBUG,
2085              "lo_write_buf(ino=%" PRIu64 ", size=%zd, off=%lu)\n", ino,
2086              out_buf.buf[0].size, (unsigned long)off);
2087
2088     /*
2089      * If kill_priv is set, drop CAP_FSETID which should lead to kernel
2090      * clearing setuid/setgid on file.
2091      */
2092     if (fi->kill_priv) {
2093         res = drop_effective_cap("FSETID", &cap_fsetid_dropped);
2094         if (res != 0) {
2095             fuse_reply_err(req, res);
2096             return;
2097         }
2098     }
2099
2100     res = fuse_buf_copy(&out_buf, in_buf);
2101     if (res < 0) {
2102         fuse_reply_err(req, -res);
2103     } else {
2104         fuse_reply_write(req, (size_t)res);
2105     }
2106
2107     if (cap_fsetid_dropped) {
2108         res = gain_effective_cap("FSETID");
2109         if (res) {
2110             fuse_log(FUSE_LOG_ERR, "Failed to gain CAP_FSETID\n");
2111         }
2112     }
2113 }
2114
2115 static void lo_statfs(fuse_req_t req, fuse_ino_t ino)
2116 {
2117     int res;
2118     struct statvfs stbuf;
2119
2120     res = fstatvfs(lo_fd(req, ino), &stbuf);
2121     if (res == -1) {
2122         fuse_reply_err(req, errno);
2123     } else {
2124         fuse_reply_statfs(req, &stbuf);
2125     }
2126 }
2127
2128 static void lo_fallocate(fuse_req_t req, fuse_ino_t ino, int mode, off_t offset,
2129                          off_t length, struct fuse_file_info *fi)
2130 {
2131     int err = EOPNOTSUPP;
2132     (void)ino;
2133
2134 #ifdef CONFIG_FALLOCATE
2135     err = fallocate(lo_fi_fd(req, fi), mode, offset, length);
2136     if (err < 0) {
2137         err = errno;
2138     }
2139
2140 #elif defined(CONFIG_POSIX_FALLOCATE)
2141     if (mode) {
2142         fuse_reply_err(req, EOPNOTSUPP);
2143         return;
2144     }
2145
2146     err = posix_fallocate(lo_fi_fd(req, fi), offset, length);
2147 #endif
2148
2149     fuse_reply_err(req, err);
2150 }
2151
2152 static void lo_flock(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi,
2153                      int op)
2154 {
2155     int res;
2156     (void)ino;
2157
2158     res = flock(lo_fi_fd(req, fi), op);
2159
2160     fuse_reply_err(req, res == -1 ? errno : 0);
2161 }
2162
2163 static void lo_getxattr(fuse_req_t req, fuse_ino_t ino, const char *name,
2164                         size_t size)
2165 {
2166     struct lo_data *lo = lo_data(req);
2167     char *value = NULL;
2168     char procname[64];
2169     struct lo_inode *inode;
2170     ssize_t ret;
2171     int saverr;
2172     int fd = -1;
2173
2174     inode = lo_inode(req, ino);
2175     if (!inode) {
2176         fuse_reply_err(req, EBADF);
2177         return;
2178     }
2179
2180     saverr = ENOSYS;
2181     if (!lo_data(req)->xattr) {
2182         goto out;
2183     }
2184
2185     fuse_log(FUSE_LOG_DEBUG, "lo_getxattr(ino=%" PRIu64 ", name=%s size=%zd)\n",
2186              ino, name, size);
2187
2188     if (inode->is_symlink) {
2189         /* Sorry, no race free way to getxattr on symlink. */
2190         saverr = EPERM;
2191         goto out;
2192     }
2193
2194     sprintf(procname, "%i", inode->fd);
2195     fd = openat(lo->proc_self_fd, procname, O_RDONLY);
2196     if (fd < 0) {
2197         goto out_err;
2198     }
2199
2200     if (size) {
2201         value = malloc(size);
2202         if (!value) {
2203             goto out_err;
2204         }
2205
2206         ret = fgetxattr(fd, name, value, size);
2207         if (ret == -1) {
2208             goto out_err;
2209         }
2210         saverr = 0;
2211         if (ret == 0) {
2212             goto out;
2213         }
2214
2215         fuse_reply_buf(req, value, ret);
2216     } else {
2217         ret = fgetxattr(fd, name, NULL, 0);
2218         if (ret == -1) {
2219             goto out_err;
2220         }
2221
2222         fuse_reply_xattr(req, ret);
2223     }
2224 out_free:
2225     free(value);
2226
2227     if (fd >= 0) {
2228         close(fd);
2229     }
2230
2231     lo_inode_put(lo, &inode);
2232     return;
2233
2234 out_err:
2235     saverr = errno;
2236 out:
2237     lo_inode_put(lo, &inode);
2238     fuse_reply_err(req, saverr);
2239     goto out_free;
2240 }
2241
2242 static void lo_listxattr(fuse_req_t req, fuse_ino_t ino, size_t size)
2243 {
2244     struct lo_data *lo = lo_data(req);
2245     char *value = NULL;
2246     char procname[64];
2247     struct lo_inode *inode;
2248     ssize_t ret;
2249     int saverr;
2250     int fd = -1;
2251
2252     inode = lo_inode(req, ino);
2253     if (!inode) {
2254         fuse_reply_err(req, EBADF);
2255         return;
2256     }
2257
2258     saverr = ENOSYS;
2259     if (!lo_data(req)->xattr) {
2260         goto out;
2261     }
2262
2263     fuse_log(FUSE_LOG_DEBUG, "lo_listxattr(ino=%" PRIu64 ", size=%zd)\n", ino,
2264              size);
2265
2266     if (inode->is_symlink) {
2267         /* Sorry, no race free way to listxattr on symlink. */
2268         saverr = EPERM;
2269         goto out;
2270     }
2271
2272     sprintf(procname, "%i", inode->fd);
2273     fd = openat(lo->proc_self_fd, procname, O_RDONLY);
2274     if (fd < 0) {
2275         goto out_err;
2276     }
2277
2278     if (size) {
2279         value = malloc(size);
2280         if (!value) {
2281             goto out_err;
2282         }
2283
2284         ret = flistxattr(fd, value, size);
2285         if (ret == -1) {
2286             goto out_err;
2287         }
2288         saverr = 0;
2289         if (ret == 0) {
2290             goto out;
2291         }
2292
2293         fuse_reply_buf(req, value, ret);
2294     } else {
2295         ret = flistxattr(fd, NULL, 0);
2296         if (ret == -1) {
2297             goto out_err;
2298         }
2299
2300         fuse_reply_xattr(req, ret);
2301     }
2302 out_free:
2303     free(value);
2304
2305     if (fd >= 0) {
2306         close(fd);
2307     }
2308
2309     lo_inode_put(lo, &inode);
2310     return;
2311
2312 out_err:
2313     saverr = errno;
2314 out:
2315     lo_inode_put(lo, &inode);
2316     fuse_reply_err(req, saverr);
2317     goto out_free;
2318 }
2319
2320 static void lo_setxattr(fuse_req_t req, fuse_ino_t ino, const char *name,
2321                         const char *value, size_t size, int flags)
2322 {
2323     char procname[64];
2324     struct lo_data *lo = lo_data(req);
2325     struct lo_inode *inode;
2326     ssize_t ret;
2327     int saverr;
2328     int fd = -1;
2329
2330     inode = lo_inode(req, ino);
2331     if (!inode) {
2332         fuse_reply_err(req, EBADF);
2333         return;
2334     }
2335
2336     saverr = ENOSYS;
2337     if (!lo_data(req)->xattr) {
2338         goto out;
2339     }
2340
2341     fuse_log(FUSE_LOG_DEBUG, "lo_setxattr(ino=%" PRIu64
2342              ", name=%s value=%s size=%zd)\n", ino, name, value, size);
2343
2344     if (inode->is_symlink) {
2345         /* Sorry, no race free way to setxattr on symlink. */
2346         saverr = EPERM;
2347         goto out;
2348     }
2349
2350     sprintf(procname, "%i", inode->fd);
2351     fd = openat(lo->proc_self_fd, procname, O_RDWR);
2352     if (fd < 0) {
2353         saverr = errno;
2354         goto out;
2355     }
2356
2357     ret = fsetxattr(fd, name, value, size, flags);
2358     saverr = ret == -1 ? errno : 0;
2359
2360 out:
2361     if (fd >= 0) {
2362         close(fd);
2363     }
2364
2365     lo_inode_put(lo, &inode);
2366     fuse_reply_err(req, saverr);
2367 }
2368
2369 static void lo_removexattr(fuse_req_t req, fuse_ino_t ino, const char *name)
2370 {
2371     char procname[64];
2372     struct lo_data *lo = lo_data(req);
2373     struct lo_inode *inode;
2374     ssize_t ret;
2375     int saverr;
2376     int fd = -1;
2377
2378     inode = lo_inode(req, ino);
2379     if (!inode) {
2380         fuse_reply_err(req, EBADF);
2381         return;
2382     }
2383
2384     saverr = ENOSYS;
2385     if (!lo_data(req)->xattr) {
2386         goto out;
2387     }
2388
2389     fuse_log(FUSE_LOG_DEBUG, "lo_removexattr(ino=%" PRIu64 ", name=%s)\n", ino,
2390              name);
2391
2392     if (inode->is_symlink) {
2393         /* Sorry, no race free way to setxattr on symlink. */
2394         saverr = EPERM;
2395         goto out;
2396     }
2397
2398     sprintf(procname, "%i", inode->fd);
2399     fd = openat(lo->proc_self_fd, procname, O_RDWR);
2400     if (fd < 0) {
2401         saverr = errno;
2402         goto out;
2403     }
2404
2405     ret = fremovexattr(fd, name);
2406     saverr = ret == -1 ? errno : 0;
2407
2408 out:
2409     if (fd >= 0) {
2410         close(fd);
2411     }
2412
2413     lo_inode_put(lo, &inode);
2414     fuse_reply_err(req, saverr);
2415 }
2416
2417 #ifdef HAVE_COPY_FILE_RANGE
2418 static void lo_copy_file_range(fuse_req_t req, fuse_ino_t ino_in, off_t off_in,
2419                                struct fuse_file_info *fi_in, fuse_ino_t ino_out,
2420                                off_t off_out, struct fuse_file_info *fi_out,
2421                                size_t len, int flags)
2422 {
2423     int in_fd, out_fd;
2424     ssize_t res;
2425
2426     in_fd = lo_fi_fd(req, fi_in);
2427     out_fd = lo_fi_fd(req, fi_out);
2428
2429     fuse_log(FUSE_LOG_DEBUG,
2430              "lo_copy_file_range(ino=%" PRIu64 "/fd=%d, "
2431              "off=%lu, ino=%" PRIu64 "/fd=%d, "
2432              "off=%lu, size=%zd, flags=0x%x)\n",
2433              ino_in, in_fd, off_in, ino_out, out_fd, off_out, len, flags);
2434
2435     res = copy_file_range(in_fd, &off_in, out_fd, &off_out, len, flags);
2436     if (res < 0) {
2437         fuse_reply_err(req, -errno);
2438     } else {
2439         fuse_reply_write(req, res);
2440     }
2441 }
2442 #endif
2443
2444 static void lo_lseek(fuse_req_t req, fuse_ino_t ino, off_t off, int whence,
2445                      struct fuse_file_info *fi)
2446 {
2447     off_t res;
2448
2449     (void)ino;
2450     res = lseek(lo_fi_fd(req, fi), off, whence);
2451     if (res != -1) {
2452         fuse_reply_lseek(req, res);
2453     } else {
2454         fuse_reply_err(req, errno);
2455     }
2456 }
2457
2458 static void lo_destroy(void *userdata)
2459 {
2460     struct lo_data *lo = (struct lo_data *)userdata;
2461     unref_all_inodes(lo);
2462 }
2463
2464 static struct fuse_lowlevel_ops lo_oper = {
2465     .init = lo_init,
2466     .lookup = lo_lookup,
2467     .mkdir = lo_mkdir,
2468     .mknod = lo_mknod,
2469     .symlink = lo_symlink,
2470     .link = lo_link,
2471     .unlink = lo_unlink,
2472     .rmdir = lo_rmdir,
2473     .rename = lo_rename,
2474     .forget = lo_forget,
2475     .forget_multi = lo_forget_multi,
2476     .getattr = lo_getattr,
2477     .setattr = lo_setattr,
2478     .readlink = lo_readlink,
2479     .opendir = lo_opendir,
2480     .readdir = lo_readdir,
2481     .readdirplus = lo_readdirplus,
2482     .releasedir = lo_releasedir,
2483     .fsyncdir = lo_fsyncdir,
2484     .create = lo_create,
2485     .getlk = lo_getlk,
2486     .setlk = lo_setlk,
2487     .open = lo_open,
2488     .release = lo_release,
2489     .flush = lo_flush,
2490     .fsync = lo_fsync,
2491     .read = lo_read,
2492     .write_buf = lo_write_buf,
2493     .statfs = lo_statfs,
2494     .fallocate = lo_fallocate,
2495     .flock = lo_flock,
2496     .getxattr = lo_getxattr,
2497     .listxattr = lo_listxattr,
2498     .setxattr = lo_setxattr,
2499     .removexattr = lo_removexattr,
2500 #ifdef HAVE_COPY_FILE_RANGE
2501     .copy_file_range = lo_copy_file_range,
2502 #endif
2503     .lseek = lo_lseek,
2504     .destroy = lo_destroy,
2505 };
2506
2507 /* Print vhost-user.json backend program capabilities */
2508 static void print_capabilities(void)
2509 {
2510     printf("{\n");
2511     printf("  \"type\": \"fs\"\n");
2512     printf("}\n");
2513 }
2514
2515 /*
2516  * Move to a new mount, net, and pid namespaces to isolate this process.
2517  */
2518 static void setup_namespaces(struct lo_data *lo, struct fuse_session *se)
2519 {
2520     pid_t child;
2521
2522     /*
2523      * Create a new pid namespace for *child* processes.  We'll have to
2524      * fork in order to enter the new pid namespace.  A new mount namespace
2525      * is also needed so that we can remount /proc for the new pid
2526      * namespace.
2527      *
2528      * Our UNIX domain sockets have been created.  Now we can move to
2529      * an empty network namespace to prevent TCP/IP and other network
2530      * activity in case this process is compromised.
2531      */
2532     if (unshare(CLONE_NEWPID | CLONE_NEWNS | CLONE_NEWNET) != 0) {
2533         fuse_log(FUSE_LOG_ERR, "unshare(CLONE_NEWPID | CLONE_NEWNS): %m\n");
2534         exit(1);
2535     }
2536
2537     child = fork();
2538     if (child < 0) {
2539         fuse_log(FUSE_LOG_ERR, "fork() failed: %m\n");
2540         exit(1);
2541     }
2542     if (child > 0) {
2543         pid_t waited;
2544         int wstatus;
2545
2546         /* The parent waits for the child */
2547         do {
2548             waited = waitpid(child, &wstatus, 0);
2549         } while (waited < 0 && errno == EINTR && !se->exited);
2550
2551         /* We were terminated by a signal, see fuse_signals.c */
2552         if (se->exited) {
2553             exit(0);
2554         }
2555
2556         if (WIFEXITED(wstatus)) {
2557             exit(WEXITSTATUS(wstatus));
2558         }
2559
2560         exit(1);
2561     }
2562
2563     /* Send us SIGTERM when the parent thread terminates, see prctl(2) */
2564     prctl(PR_SET_PDEATHSIG, SIGTERM);
2565
2566     /*
2567      * If the mounts have shared propagation then we want to opt out so our
2568      * mount changes don't affect the parent mount namespace.
2569      */
2570     if (mount(NULL, "/", NULL, MS_REC | MS_SLAVE, NULL) < 0) {
2571         fuse_log(FUSE_LOG_ERR, "mount(/, MS_REC|MS_SLAVE): %m\n");
2572         exit(1);
2573     }
2574
2575     /* The child must remount /proc to use the new pid namespace */
2576     if (mount("proc", "/proc", "proc",
2577               MS_NODEV | MS_NOEXEC | MS_NOSUID | MS_RELATIME, NULL) < 0) {
2578         fuse_log(FUSE_LOG_ERR, "mount(/proc): %m\n");
2579         exit(1);
2580     }
2581
2582     /* Now we can get our /proc/self/fd directory file descriptor */
2583     lo->proc_self_fd = open("/proc/self/fd", O_PATH);
2584     if (lo->proc_self_fd == -1) {
2585         fuse_log(FUSE_LOG_ERR, "open(/proc/self/fd, O_PATH): %m\n");
2586         exit(1);
2587     }
2588 }
2589
2590 /*
2591  * Capture the capability state, we'll need to restore this for individual
2592  * threads later; see load_capng.
2593  */
2594 static void setup_capng(void)
2595 {
2596     /* Note this accesses /proc so has to happen before the sandbox */
2597     if (capng_get_caps_process()) {
2598         fuse_log(FUSE_LOG_ERR, "capng_get_caps_process\n");
2599         exit(1);
2600     }
2601     pthread_mutex_init(&cap.mutex, NULL);
2602     pthread_mutex_lock(&cap.mutex);
2603     cap.saved = capng_save_state();
2604     if (!cap.saved) {
2605         fuse_log(FUSE_LOG_ERR, "capng_save_state\n");
2606         exit(1);
2607     }
2608     pthread_mutex_unlock(&cap.mutex);
2609 }
2610
2611 static void cleanup_capng(void)
2612 {
2613     free(cap.saved);
2614     cap.saved = NULL;
2615     pthread_mutex_destroy(&cap.mutex);
2616 }
2617
2618
2619 /*
2620  * Make the source directory our root so symlinks cannot escape and no other
2621  * files are accessible.  Assumes unshare(CLONE_NEWNS) was already called.
2622  */
2623 static void setup_mounts(const char *source)
2624 {
2625     int oldroot;
2626     int newroot;
2627
2628     if (mount(source, source, NULL, MS_BIND, NULL) < 0) {
2629         fuse_log(FUSE_LOG_ERR, "mount(%s, %s, MS_BIND): %m\n", source, source);
2630         exit(1);
2631     }
2632
2633     /* This magic is based on lxc's lxc_pivot_root() */
2634     oldroot = open("/", O_DIRECTORY | O_RDONLY | O_CLOEXEC);
2635     if (oldroot < 0) {
2636         fuse_log(FUSE_LOG_ERR, "open(/): %m\n");
2637         exit(1);
2638     }
2639
2640     newroot = open(source, O_DIRECTORY | O_RDONLY | O_CLOEXEC);
2641     if (newroot < 0) {
2642         fuse_log(FUSE_LOG_ERR, "open(%s): %m\n", source);
2643         exit(1);
2644     }
2645
2646     if (fchdir(newroot) < 0) {
2647         fuse_log(FUSE_LOG_ERR, "fchdir(newroot): %m\n");
2648         exit(1);
2649     }
2650
2651     if (syscall(__NR_pivot_root, ".", ".") < 0) {
2652         fuse_log(FUSE_LOG_ERR, "pivot_root(., .): %m\n");
2653         exit(1);
2654     }
2655
2656     if (fchdir(oldroot) < 0) {
2657         fuse_log(FUSE_LOG_ERR, "fchdir(oldroot): %m\n");
2658         exit(1);
2659     }
2660
2661     if (mount("", ".", "", MS_SLAVE | MS_REC, NULL) < 0) {
2662         fuse_log(FUSE_LOG_ERR, "mount(., MS_SLAVE | MS_REC): %m\n");
2663         exit(1);
2664     }
2665
2666     if (umount2(".", MNT_DETACH) < 0) {
2667         fuse_log(FUSE_LOG_ERR, "umount2(., MNT_DETACH): %m\n");
2668         exit(1);
2669     }
2670
2671     if (fchdir(newroot) < 0) {
2672         fuse_log(FUSE_LOG_ERR, "fchdir(newroot): %m\n");
2673         exit(1);
2674     }
2675
2676     close(newroot);
2677     close(oldroot);
2678 }
2679
2680 /*
2681  * Lock down this process to prevent access to other processes or files outside
2682  * source directory.  This reduces the impact of arbitrary code execution bugs.
2683  */
2684 static void setup_sandbox(struct lo_data *lo, struct fuse_session *se,
2685                           bool enable_syslog)
2686 {
2687     setup_namespaces(lo, se);
2688     setup_mounts(lo->source);
2689     setup_seccomp(enable_syslog);
2690 }
2691
2692 /* Raise the maximum number of open file descriptors */
2693 static void setup_nofile_rlimit(void)
2694 {
2695     const rlim_t max_fds = 1000000;
2696     struct rlimit rlim;
2697
2698     if (getrlimit(RLIMIT_NOFILE, &rlim) < 0) {
2699         fuse_log(FUSE_LOG_ERR, "getrlimit(RLIMIT_NOFILE): %m\n");
2700         exit(1);
2701     }
2702
2703     if (rlim.rlim_cur >= max_fds) {
2704         return; /* nothing to do */
2705     }
2706
2707     rlim.rlim_cur = max_fds;
2708     rlim.rlim_max = max_fds;
2709
2710     if (setrlimit(RLIMIT_NOFILE, &rlim) < 0) {
2711         /* Ignore SELinux denials */
2712         if (errno == EPERM) {
2713             return;
2714         }
2715
2716         fuse_log(FUSE_LOG_ERR, "setrlimit(RLIMIT_NOFILE): %m\n");
2717         exit(1);
2718     }
2719 }
2720
2721 static void log_func(enum fuse_log_level level, const char *fmt, va_list ap)
2722 {
2723     g_autofree char *localfmt = NULL;
2724
2725     if (current_log_level < level) {
2726         return;
2727     }
2728
2729     if (current_log_level == FUSE_LOG_DEBUG) {
2730         if (!use_syslog) {
2731             localfmt = g_strdup_printf("[%" PRId64 "] [ID: %08ld] %s",
2732                                        get_clock(), syscall(__NR_gettid), fmt);
2733         } else {
2734             localfmt = g_strdup_printf("[ID: %08ld] %s", syscall(__NR_gettid),
2735                                        fmt);
2736         }
2737         fmt = localfmt;
2738     }
2739
2740     if (use_syslog) {
2741         int priority = LOG_ERR;
2742         switch (level) {
2743         case FUSE_LOG_EMERG:
2744             priority = LOG_EMERG;
2745             break;
2746         case FUSE_LOG_ALERT:
2747             priority = LOG_ALERT;
2748             break;
2749         case FUSE_LOG_CRIT:
2750             priority = LOG_CRIT;
2751             break;
2752         case FUSE_LOG_ERR:
2753             priority = LOG_ERR;
2754             break;
2755         case FUSE_LOG_WARNING:
2756             priority = LOG_WARNING;
2757             break;
2758         case FUSE_LOG_NOTICE:
2759             priority = LOG_NOTICE;
2760             break;
2761         case FUSE_LOG_INFO:
2762             priority = LOG_INFO;
2763             break;
2764         case FUSE_LOG_DEBUG:
2765             priority = LOG_DEBUG;
2766             break;
2767         }
2768         vsyslog(priority, fmt, ap);
2769     } else {
2770         vfprintf(stderr, fmt, ap);
2771     }
2772 }
2773
2774 static void setup_root(struct lo_data *lo, struct lo_inode *root)
2775 {
2776     int fd, res;
2777     struct stat stat;
2778
2779     fd = open("/", O_PATH);
2780     if (fd == -1) {
2781         fuse_log(FUSE_LOG_ERR, "open(%s, O_PATH): %m\n", lo->source);
2782         exit(1);
2783     }
2784
2785     res = fstatat(fd, "", &stat, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
2786     if (res == -1) {
2787         fuse_log(FUSE_LOG_ERR, "fstatat(%s): %m\n", lo->source);
2788         exit(1);
2789     }
2790
2791     root->is_symlink = false;
2792     root->fd = fd;
2793     root->key.ino = stat.st_ino;
2794     root->key.dev = stat.st_dev;
2795     root->nlookup = 2;
2796     g_atomic_int_set(&root->refcount, 2);
2797 }
2798
2799 static guint lo_key_hash(gconstpointer key)
2800 {
2801     const struct lo_key *lkey = key;
2802
2803     return (guint)lkey->ino + (guint)lkey->dev;
2804 }
2805
2806 static gboolean lo_key_equal(gconstpointer a, gconstpointer b)
2807 {
2808     const struct lo_key *la = a;
2809     const struct lo_key *lb = b;
2810
2811     return la->ino == lb->ino && la->dev == lb->dev;
2812 }
2813
2814 static void fuse_lo_data_cleanup(struct lo_data *lo)
2815 {
2816     if (lo->inodes) {
2817         g_hash_table_destroy(lo->inodes);
2818     }
2819     lo_map_destroy(&lo->fd_map);
2820     lo_map_destroy(&lo->dirp_map);
2821     lo_map_destroy(&lo->ino_map);
2822
2823     if (lo->proc_self_fd >= 0) {
2824         close(lo->proc_self_fd);
2825     }
2826
2827     if (lo->root.fd >= 0) {
2828         close(lo->root.fd);
2829     }
2830
2831     free(lo->source);
2832 }
2833
2834 int main(int argc, char *argv[])
2835 {
2836     struct fuse_args args = FUSE_ARGS_INIT(argc, argv);
2837     struct fuse_session *se;
2838     struct fuse_cmdline_opts opts;
2839     struct lo_data lo = {
2840         .debug = 0,
2841         .writeback = 0,
2842         .posix_lock = 1,
2843         .proc_self_fd = -1,
2844     };
2845     struct lo_map_elem *root_elem;
2846     int ret = -1;
2847
2848     /* Don't mask creation mode, kernel already did that */
2849     umask(0);
2850
2851     pthread_mutex_init(&lo.mutex, NULL);
2852     lo.inodes = g_hash_table_new(lo_key_hash, lo_key_equal);
2853     lo.root.fd = -1;
2854     lo.root.fuse_ino = FUSE_ROOT_ID;
2855     lo.cache = CACHE_AUTO;
2856
2857     /*
2858      * Set up the ino map like this:
2859      * [0] Reserved (will not be used)
2860      * [1] Root inode
2861      */
2862     lo_map_init(&lo.ino_map);
2863     lo_map_reserve(&lo.ino_map, 0)->in_use = false;
2864     root_elem = lo_map_reserve(&lo.ino_map, lo.root.fuse_ino);
2865     root_elem->inode = &lo.root;
2866
2867     lo_map_init(&lo.dirp_map);
2868     lo_map_init(&lo.fd_map);
2869
2870     if (fuse_parse_cmdline(&args, &opts) != 0) {
2871         goto err_out1;
2872     }
2873     fuse_set_log_func(log_func);
2874     use_syslog = opts.syslog;
2875     if (use_syslog) {
2876         openlog("virtiofsd", LOG_PID, LOG_DAEMON);
2877     }
2878
2879     if (opts.show_help) {
2880         printf("usage: %s [options]\n\n", argv[0]);
2881         fuse_cmdline_help();
2882         printf("    -o source=PATH             shared directory tree\n");
2883         fuse_lowlevel_help();
2884         ret = 0;
2885         goto err_out1;
2886     } else if (opts.show_version) {
2887         fuse_lowlevel_version();
2888         ret = 0;
2889         goto err_out1;
2890     } else if (opts.print_capabilities) {
2891         print_capabilities();
2892         ret = 0;
2893         goto err_out1;
2894     }
2895
2896     if (fuse_opt_parse(&args, &lo, lo_opts, NULL) == -1) {
2897         goto err_out1;
2898     }
2899
2900     /*
2901      * log_level is 0 if not configured via cmd options (0 is LOG_EMERG,
2902      * and we don't use this log level).
2903      */
2904     if (opts.log_level != 0) {
2905         current_log_level = opts.log_level;
2906     }
2907     lo.debug = opts.debug;
2908     if (lo.debug) {
2909         current_log_level = FUSE_LOG_DEBUG;
2910     }
2911     if (lo.source) {
2912         struct stat stat;
2913         int res;
2914
2915         res = lstat(lo.source, &stat);
2916         if (res == -1) {
2917             fuse_log(FUSE_LOG_ERR, "failed to stat source (\"%s\"): %m\n",
2918                      lo.source);
2919             exit(1);
2920         }
2921         if (!S_ISDIR(stat.st_mode)) {
2922             fuse_log(FUSE_LOG_ERR, "source is not a directory\n");
2923             exit(1);
2924         }
2925     } else {
2926         lo.source = strdup("/");
2927     }
2928     if (!lo.timeout_set) {
2929         switch (lo.cache) {
2930         case CACHE_NONE:
2931             lo.timeout = 0.0;
2932             break;
2933
2934         case CACHE_AUTO:
2935             lo.timeout = 1.0;
2936             break;
2937
2938         case CACHE_ALWAYS:
2939             lo.timeout = 86400.0;
2940             break;
2941         }
2942     } else if (lo.timeout < 0) {
2943         fuse_log(FUSE_LOG_ERR, "timeout is negative (%lf)\n", lo.timeout);
2944         exit(1);
2945     }
2946
2947     se = fuse_session_new(&args, &lo_oper, sizeof(lo_oper), &lo);
2948     if (se == NULL) {
2949         goto err_out1;
2950     }
2951
2952     if (fuse_set_signal_handlers(se) != 0) {
2953         goto err_out2;
2954     }
2955
2956     if (fuse_session_mount(se) != 0) {
2957         goto err_out3;
2958     }
2959
2960     fuse_daemonize(opts.foreground);
2961
2962     setup_nofile_rlimit();
2963
2964     /* Must be before sandbox since it wants /proc */
2965     setup_capng();
2966
2967     setup_sandbox(&lo, se, opts.syslog);
2968
2969     setup_root(&lo, &lo.root);
2970     /* Block until ctrl+c or fusermount -u */
2971     ret = virtio_loop(se);
2972
2973     fuse_session_unmount(se);
2974     cleanup_capng();
2975 err_out3:
2976     fuse_remove_signal_handlers(se);
2977 err_out2:
2978     fuse_session_destroy(se);
2979 err_out1:
2980     fuse_opt_free_args(&args);
2981
2982     fuse_lo_data_cleanup(&lo);
2983
2984     return ret ? 1 : 0;
2985 }