tools/virtiofsd/passthrough_ll.c

   1 /*
   2  * FUSE: Filesystem in Userspace
   3  * Copyright (C) 2001-2007  Miklos Szeredi <miklos@szeredi.hu>
   4  *
   5  * This program can be distributed under the terms of the GNU GPLv2.
   6  * See the file COPYING.
   7  */
   8
   9 /*
  10  *
  11  * This file system mirrors the existing file system hierarchy of the
  12  * system, starting at the root file system. This is implemented by
  13  * just "passing through" all requests to the corresponding user-space
  14  * libc functions. In contrast to passthrough.c and passthrough_fh.c,
  15  * this implementation uses the low-level API. Its performance should
  16  * be the least bad among the three, but many operations are not
  17  * implemented. In particular, it is not possible to remove files (or
  18  * directories) because the code necessary to defer actual removal
  19  * until the file is not opened anymore would make the example much
  20  * more complicated.
  21  *
  22  * When writeback caching is enabled (-o writeback mount option), it
  23  * is only possible to write to files for which the mounting user has
  24  * read permissions. This is because the writeback cache requires the
  25  * kernel to be able to issue read requests for all files (which the
  26  * passthrough filesystem cannot satisfy if it can't read the file in
  27  * the underlying filesystem).
  28  *
  29  * Compile with:
  30  *
  31  *     gcc -Wall passthrough_ll.c `pkg-config fuse3 --cflags --libs` -o
  32  * passthrough_ll
  33  *
  34  * ## Source code ##
  35  * \include passthrough_ll.c
  36  */
  37
  38 #include "qemu/osdep.h"
  39 #include "qemu/timer.h"
  40 #include "fuse_virtio.h"
  41 #include "fuse_log.h"
  42 #include "fuse_lowlevel.h"
  43 #include <assert.h>
  44 #include <cap-ng.h>
  45 #include <dirent.h>
  46 #include <errno.h>
  47 #include <glib.h>
  48 #include <inttypes.h>
  49 #include <limits.h>
  50 #include <pthread.h>
  51 #include <stdbool.h>
  52 #include <stddef.h>
  53 #include <stdio.h>
  54 #include <stdlib.h>
  55 #include <string.h>
  56 #include <sys/file.h>
  57 #include <sys/mount.h>
  58 #include <sys/prctl.h>
  59 #include <sys/resource.h>
  60 #include <sys/syscall.h>
  61 #include <sys/types.h>
  62 #include <sys/wait.h>
  63 #include <sys/xattr.h>
  64 #include <syslog.h>
  65 #include <unistd.h>
  66
  67 #include "passthrough_helpers.h"
  68 #include "seccomp.h"
  69
  70 /* Keep track of inode posix locks for each owner. */
  71 struct lo_inode_plock {
  72     uint64_t lock_owner;
  73     int fd; /* fd for OFD locks */
  74 };
  75
  76 struct lo_map_elem {
  77     union {
  78         struct lo_inode *inode;
  79         struct lo_dirp *dirp;
  80         int fd;
  81         ssize_t freelist;
  82     };
  83     bool in_use;
  84 };
  85
  86 /* Maps FUSE fh or ino values to internal objects */
  87 struct lo_map {
  88     struct lo_map_elem *elems;
  89     size_t nelems;
  90     ssize_t freelist;
  91 };
  92
  93 struct lo_key {
  94     ino_t ino;
  95     dev_t dev;
  96 };
  97
  98 struct lo_inode {
  99     int fd;
 100
 101     /*
 102      * Atomic reference count for this object.  The nlookup field holds a
 103      * reference and release it when nlookup reaches 0.
 104      */
 105     gint refcount;
 106
 107     struct lo_key key;
 108
 109     /*
 110      * This counter keeps the inode alive during the FUSE session.
 111      * Incremented when the FUSE inode number is sent in a reply
 112      * (FUSE_LOOKUP, FUSE_READDIRPLUS, etc).  Decremented when an inode is
 113      * released by requests like FUSE_FORGET, FUSE_RMDIR, FUSE_RENAME, etc.
 114      *
 115      * Note that this value is untrusted because the client can manipulate
 116      * it arbitrarily using FUSE_FORGET requests.
 117      *
 118      * Protected by lo->mutex.
 119      */
 120     uint64_t nlookup;
 121
 122     fuse_ino_t fuse_ino;
 123     pthread_mutex_t plock_mutex;
 124     GHashTable *posix_locks; /* protected by lo_inode->plock_mutex */
 125
 126     bool is_symlink;
 127 };
 128
 129 struct lo_cred {
 130     uid_t euid;
 131     gid_t egid;
 132 };
 133
 134 enum {
 135     CACHE_NONE,
 136     CACHE_AUTO,
 137     CACHE_ALWAYS,
 138 };
 139
 140 struct lo_data {
 141     pthread_mutex_t mutex;
 142     int debug;
 143     int norace;
 144     int writeback;
 145     int flock;
 146     int posix_lock;
 147     int xattr;
 148     char *source;
 149     double timeout;
 150     int cache;
 151     int timeout_set;
 152     int readdirplus_set;
 153     int readdirplus_clear;
 154     struct lo_inode root;
 155     GHashTable *inodes; /* protected by lo->mutex */
 156     struct lo_map ino_map; /* protected by lo->mutex */
 157     struct lo_map dirp_map; /* protected by lo->mutex */
 158     struct lo_map fd_map; /* protected by lo->mutex */
 159
 160     /* An O_PATH file descriptor to /proc/self/fd/ */
 161     int proc_self_fd;
 162 };
 163
 164 static const struct fuse_opt lo_opts[] = {
 165     { "writeback", offsetof(struct lo_data, writeback), 1 },
 166     { "no_writeback", offsetof(struct lo_data, writeback), 0 },
 167     { "source=%s", offsetof(struct lo_data, source), 0 },
 168     { "flock", offsetof(struct lo_data, flock), 1 },
 169     { "no_flock", offsetof(struct lo_data, flock), 0 },
 170     { "posix_lock", offsetof(struct lo_data, posix_lock), 1 },
 171     { "no_posix_lock", offsetof(struct lo_data, posix_lock), 0 },
 172     { "xattr", offsetof(struct lo_data, xattr), 1 },
 173     { "no_xattr", offsetof(struct lo_data, xattr), 0 },
 174     { "timeout=%lf", offsetof(struct lo_data, timeout), 0 },
 175     { "timeout=", offsetof(struct lo_data, timeout_set), 1 },
 176     { "cache=none", offsetof(struct lo_data, cache), CACHE_NONE },
 177     { "cache=auto", offsetof(struct lo_data, cache), CACHE_AUTO },
 178     { "cache=always", offsetof(struct lo_data, cache), CACHE_ALWAYS },
 179     { "norace", offsetof(struct lo_data, norace), 1 },
 180     { "readdirplus", offsetof(struct lo_data, readdirplus_set), 1 },
 181     { "no_readdirplus", offsetof(struct lo_data, readdirplus_clear), 1 },
 182     FUSE_OPT_END
 183 };
 184 static bool use_syslog = false;
 185 static int current_log_level;
 186 static void unref_inode_lolocked(struct lo_data *lo, struct lo_inode *inode,
 187                                  uint64_t n);
 188
 189 static struct {
 190     pthread_mutex_t mutex;
 191     void *saved;
 192 } cap;
 193 /* That we loaded cap-ng in the current thread from the saved */
 194 static __thread bool cap_loaded = 0;
 195
 196 static struct lo_inode *lo_find(struct lo_data *lo, struct stat *st);
 197
 198 static int is_dot_or_dotdot(const char *name)
 199 {
 200     return name[0] == '.' &&
 201            (name[1] == '\0' || (name[1] == '.' && name[2] == '\0'));
 202 }
 203
 204 /* Is `path` a single path component that is not "." or ".."? */
 205 static int is_safe_path_component(const char *path)
 206 {
 207     if (strchr(path, '/')) {
 208         return 0;
 209     }
 210
 211     return !is_dot_or_dotdot(path);
 212 }
 213
 214 static struct lo_data *lo_data(fuse_req_t req)
 215 {
 216     return (struct lo_data *)fuse_req_userdata(req);
 217 }
 218
 219 /*
 220  * Load capng's state from our saved state if the current thread
 221  * hadn't previously been loaded.
 222  * returns 0 on success
 223  */
 224 static int load_capng(void)
 225 {
 226     if (!cap_loaded) {
 227         pthread_mutex_lock(&cap.mutex);
 228         capng_restore_state(&cap.saved);
 229         /*
 230          * restore_state free's the saved copy
 231          * so make another.
 232          */
 233         cap.saved = capng_save_state();
 234         if (!cap.saved) {
 235             fuse_log(FUSE_LOG_ERR, "capng_save_state (thread)\n");
 236             return -EINVAL;
 237         }
 238         pthread_mutex_unlock(&cap.mutex);
 239
 240         /*
 241          * We want to use the loaded state for our pid,
 242          * not the original
 243          */
 244         capng_setpid(syscall(SYS_gettid));
 245         cap_loaded = true;
 246     }
 247     return 0;
 248 }
 249
 250 /*
 251  * Helpers for dropping and regaining effective capabilities. Returns 0
 252  * on success, error otherwise
 253  */
 254 static int drop_effective_cap(const char *cap_name, bool *cap_dropped)
 255 {
 256     int cap, ret;
 257
 258     cap = capng_name_to_capability(cap_name);
 259     if (cap < 0) {
 260         ret = errno;
 261         fuse_log(FUSE_LOG_ERR, "capng_name_to_capability(%s) failed:%s\n",
 262                  cap_name, strerror(errno));
 263         goto out;
 264     }
 265
 266     if (load_capng()) {
 267         ret = errno;
 268         fuse_log(FUSE_LOG_ERR, "load_capng() failed\n");
 269         goto out;
 270     }
 271
 272     /* We dont have this capability in effective set already. */
 273     if (!capng_have_capability(CAPNG_EFFECTIVE, cap)) {
 274         ret = 0;
 275         goto out;
 276     }
 277
 278     if (capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, cap)) {
 279         ret = errno;
 280         fuse_log(FUSE_LOG_ERR, "capng_update(DROP,) failed\n");
 281         goto out;
 282     }
 283
 284     if (capng_apply(CAPNG_SELECT_CAPS)) {
 285         ret = errno;
 286         fuse_log(FUSE_LOG_ERR, "drop:capng_apply() failed\n");
 287         goto out;
 288     }
 289
 290     ret = 0;
 291     if (cap_dropped) {
 292         *cap_dropped = true;
 293     }
 294
 295 out:
 296     return ret;
 297 }
 298
 299 static int gain_effective_cap(const char *cap_name)
 300 {
 301     int cap;
 302     int ret = 0;
 303
 304     cap = capng_name_to_capability(cap_name);
 305     if (cap < 0) {
 306         ret = errno;
 307         fuse_log(FUSE_LOG_ERR, "capng_name_to_capability(%s) failed:%s\n",
 308                  cap_name, strerror(errno));
 309         goto out;
 310     }
 311
 312     if (load_capng()) {
 313         ret = errno;
 314         fuse_log(FUSE_LOG_ERR, "load_capng() failed\n");
 315         goto out;
 316     }
 317
 318     if (capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, cap)) {
 319         ret = errno;
 320         fuse_log(FUSE_LOG_ERR, "capng_update(ADD,) failed\n");
 321         goto out;
 322     }
 323
 324     if (capng_apply(CAPNG_SELECT_CAPS)) {
 325         ret = errno;
 326         fuse_log(FUSE_LOG_ERR, "gain:capng_apply() failed\n");
 327         goto out;
 328     }
 329     ret = 0;
 330
 331 out:
 332     return ret;
 333 }
 334
 335 static void lo_map_init(struct lo_map *map)
 336 {
 337     map->elems = NULL;
 338     map->nelems = 0;
 339     map->freelist = -1;
 340 }
 341
 342 static void lo_map_destroy(struct lo_map *map)
 343 {
 344     free(map->elems);
 345 }
 346
 347 static int lo_map_grow(struct lo_map *map, size_t new_nelems)
 348 {
 349     struct lo_map_elem *new_elems;
 350     size_t i;
 351
 352     if (new_nelems <= map->nelems) {
 353         return 1;
 354     }
 355
 356     new_elems = realloc(map->elems, sizeof(map->elems[0]) * new_nelems);
 357     if (!new_elems) {
 358         return 0;
 359     }
 360
 361     for (i = map->nelems; i < new_nelems; i++) {
 362         new_elems[i].freelist = i + 1;
 363         new_elems[i].in_use = false;
 364     }
 365     new_elems[new_nelems - 1].freelist = -1;
 366
 367     map->elems = new_elems;
 368     map->freelist = map->nelems;
 369     map->nelems = new_nelems;
 370     return 1;
 371 }
 372
 373 static struct lo_map_elem *lo_map_alloc_elem(struct lo_map *map)
 374 {
 375     struct lo_map_elem *elem;
 376
 377     if (map->freelist == -1 && !lo_map_grow(map, map->nelems + 256)) {
 378         return NULL;
 379     }
 380
 381     elem = &map->elems[map->freelist];
 382     map->freelist = elem->freelist;
 383
 384     elem->in_use = true;
 385
 386     return elem;
 387 }
 388
 389 static struct lo_map_elem *lo_map_reserve(struct lo_map *map, size_t key)
 390 {
 391     ssize_t *prev;
 392
 393     if (!lo_map_grow(map, key + 1)) {
 394         return NULL;
 395     }
 396
 397     for (prev = &map->freelist; *prev != -1;
 398          prev = &map->elems[*prev].freelist) {
 399         if (*prev == key) {
 400             struct lo_map_elem *elem = &map->elems[key];
 401
 402             *prev = elem->freelist;
 403             elem->in_use = true;
 404             return elem;
 405         }
 406     }
 407     return NULL;
 408 }
 409
 410 static struct lo_map_elem *lo_map_get(struct lo_map *map, size_t key)
 411 {
 412     if (key >= map->nelems) {
 413         return NULL;
 414     }
 415     if (!map->elems[key].in_use) {
 416         return NULL;
 417     }
 418     return &map->elems[key];
 419 }
 420
 421 static void lo_map_remove(struct lo_map *map, size_t key)
 422 {
 423     struct lo_map_elem *elem;
 424
 425     if (key >= map->nelems) {
 426         return;
 427     }
 428
 429     elem = &map->elems[key];
 430     if (!elem->in_use) {
 431         return;
 432     }
 433
 434     elem->in_use = false;
 435
 436     elem->freelist = map->freelist;
 437     map->freelist = key;
 438 }
 439
 440 /* Assumes lo->mutex is held */
 441 static ssize_t lo_add_fd_mapping(fuse_req_t req, int fd)
 442 {
 443     struct lo_map_elem *elem;
 444
 445     elem = lo_map_alloc_elem(&lo_data(req)->fd_map);
 446     if (!elem) {
 447         return -1;
 448     }
 449
 450     elem->fd = fd;
 451     return elem - lo_data(req)->fd_map.elems;
 452 }
 453
 454 /* Assumes lo->mutex is held */
 455 static ssize_t lo_add_dirp_mapping(fuse_req_t req, struct lo_dirp *dirp)
 456 {
 457     struct lo_map_elem *elem;
 458
 459     elem = lo_map_alloc_elem(&lo_data(req)->dirp_map);
 460     if (!elem) {
 461         return -1;
 462     }
 463
 464     elem->dirp = dirp;
 465     return elem - lo_data(req)->dirp_map.elems;
 466 }
 467
 468 /* Assumes lo->mutex is held */
 469 static ssize_t lo_add_inode_mapping(fuse_req_t req, struct lo_inode *inode)
 470 {
 471     struct lo_map_elem *elem;
 472
 473     elem = lo_map_alloc_elem(&lo_data(req)->ino_map);
 474     if (!elem) {
 475         return -1;
 476     }
 477
 478     elem->inode = inode;
 479     return elem - lo_data(req)->ino_map.elems;
 480 }
 481
 482 static void lo_inode_put(struct lo_data *lo, struct lo_inode **inodep)
 483 {
 484     struct lo_inode *inode = *inodep;
 485
 486     if (!inode) {
 487         return;
 488     }
 489
 490     *inodep = NULL;
 491
 492     if (g_atomic_int_dec_and_test(&inode->refcount)) {
 493         close(inode->fd);
 494         free(inode);
 495     }
 496 }
 497
 498 /* Caller must release refcount using lo_inode_put() */
 499 static struct lo_inode *lo_inode(fuse_req_t req, fuse_ino_t ino)
 500 {
 501     struct lo_data *lo = lo_data(req);
 502     struct lo_map_elem *elem;
 503
 504     pthread_mutex_lock(&lo->mutex);
 505     elem = lo_map_get(&lo->ino_map, ino);
 506     if (elem) {
 507         g_atomic_int_inc(&elem->inode->refcount);
 508     }
 509     pthread_mutex_unlock(&lo->mutex);
 510
 511     if (!elem) {
 512         return NULL;
 513     }
 514
 515     return elem->inode;
 516 }
 517
 518 /*
 519  * TODO Remove this helper and force callers to hold an inode refcount until
 520  * they are done with the fd.  This will be done in a later patch to make
 521  * review easier.
 522  */
 523 static int lo_fd(fuse_req_t req, fuse_ino_t ino)
 524 {
 525     struct lo_inode *inode = lo_inode(req, ino);
 526     int fd;
 527
 528     if (!inode) {
 529         return -1;
 530     }
 531
 532     fd = inode->fd;
 533     lo_inode_put(lo_data(req), &inode);
 534     return fd;
 535 }
 536
 537 static void lo_init(void *userdata, struct fuse_conn_info *conn)
 538 {
 539     struct lo_data *lo = (struct lo_data *)userdata;
 540
 541     if (conn->capable & FUSE_CAP_EXPORT_SUPPORT) {
 542         conn->want |= FUSE_CAP_EXPORT_SUPPORT;
 543     }
 544
 545     if (lo->writeback && conn->capable & FUSE_CAP_WRITEBACK_CACHE) {
 546         fuse_log(FUSE_LOG_DEBUG, "lo_init: activating writeback\n");
 547         conn->want |= FUSE_CAP_WRITEBACK_CACHE;
 548     }
 549     if (conn->capable & FUSE_CAP_FLOCK_LOCKS) {
 550         if (lo->flock) {
 551             fuse_log(FUSE_LOG_DEBUG, "lo_init: activating flock locks\n");
 552             conn->want |= FUSE_CAP_FLOCK_LOCKS;
 553         } else {
 554             fuse_log(FUSE_LOG_DEBUG, "lo_init: disabling flock locks\n");
 555             conn->want &= ~FUSE_CAP_FLOCK_LOCKS;
 556         }
 557     }
 558
 559     if (conn->capable & FUSE_CAP_POSIX_LOCKS) {
 560         if (lo->posix_lock) {
 561             fuse_log(FUSE_LOG_DEBUG, "lo_init: activating posix locks\n");
 562             conn->want |= FUSE_CAP_POSIX_LOCKS;
 563         } else {
 564             fuse_log(FUSE_LOG_DEBUG, "lo_init: disabling posix locks\n");
 565             conn->want &= ~FUSE_CAP_POSIX_LOCKS;
 566         }
 567     }
 568
 569     if ((lo->cache == CACHE_NONE && !lo->readdirplus_set) ||
 570         lo->readdirplus_clear) {
 571         fuse_log(FUSE_LOG_DEBUG, "lo_init: disabling readdirplus\n");
 572         conn->want &= ~FUSE_CAP_READDIRPLUS;
 573     }
 574 }
 575
 576 static void lo_getattr(fuse_req_t req, fuse_ino_t ino,
 577                        struct fuse_file_info *fi)
 578 {
 579     int res;
 580     struct stat buf;
 581     struct lo_data *lo = lo_data(req);
 582
 583     (void)fi;
 584
 585     res =
 586         fstatat(lo_fd(req, ino), "", &buf, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
 587     if (res == -1) {
 588         return (void)fuse_reply_err(req, errno);
 589     }
 590
 591     fuse_reply_attr(req, &buf, lo->timeout);
 592 }
 593
 594 /*
 595  * Increments parent->nlookup and caller must release refcount using
 596  * lo_inode_put(&parent).
 597  */
 598 static int lo_parent_and_name(struct lo_data *lo, struct lo_inode *inode,
 599                               char path[PATH_MAX], struct lo_inode **parent)
 600 {
 601     char procname[64];
 602     char *last;
 603     struct stat stat;
 604     struct lo_inode *p;
 605     int retries = 2;
 606     int res;
 607
 608 retry:
 609     sprintf(procname, "%i", inode->fd);
 610
 611     res = readlinkat(lo->proc_self_fd, procname, path, PATH_MAX);
 612     if (res < 0) {
 613         fuse_log(FUSE_LOG_WARNING, "%s: readlink failed: %m\n", __func__);
 614         goto fail_noretry;
 615     }
 616
 617     if (res >= PATH_MAX) {
 618         fuse_log(FUSE_LOG_WARNING, "%s: readlink overflowed\n", __func__);
 619         goto fail_noretry;
 620     }
 621     path[res] = '\0';
 622
 623     last = strrchr(path, '/');
 624     if (last == NULL) {
 625         /* Shouldn't happen */
 626         fuse_log(
 627             FUSE_LOG_WARNING,
 628             "%s: INTERNAL ERROR: bad path read from proc\n", __func__);
 629         goto fail_noretry;
 630     }
 631     if (last == path) {
 632         p = &lo->root;
 633         pthread_mutex_lock(&lo->mutex);
 634         p->nlookup++;
 635         g_atomic_int_inc(&p->refcount);
 636         pthread_mutex_unlock(&lo->mutex);
 637     } else {
 638         *last = '\0';
 639         res = fstatat(AT_FDCWD, last == path ? "/" : path, &stat, 0);
 640         if (res == -1) {
 641             if (!retries) {
 642                 fuse_log(FUSE_LOG_WARNING,
 643                          "%s: failed to stat parent: %m\n", __func__);
 644             }
 645             goto fail;
 646         }
 647         p = lo_find(lo, &stat);
 648         if (p == NULL) {
 649             if (!retries) {
 650                 fuse_log(FUSE_LOG_WARNING,
 651                          "%s: failed to find parent\n", __func__);
 652             }
 653             goto fail;
 654         }
 655     }
 656     last++;
 657     res = fstatat(p->fd, last, &stat, AT_SYMLINK_NOFOLLOW);
 658     if (res == -1) {
 659         if (!retries) {
 660             fuse_log(FUSE_LOG_WARNING,
 661                      "%s: failed to stat last\n", __func__);
 662         }
 663         goto fail_unref;
 664     }
 665     if (stat.st_dev != inode->key.dev || stat.st_ino != inode->key.ino) {
 666         if (!retries) {
 667             fuse_log(FUSE_LOG_WARNING,
 668                      "%s: failed to match last\n", __func__);
 669         }
 670         goto fail_unref;
 671     }
 672     *parent = p;
 673     memmove(path, last, strlen(last) + 1);
 674
 675     return 0;
 676
 677 fail_unref:
 678     unref_inode_lolocked(lo, p, 1);
 679     lo_inode_put(lo, &p);
 680 fail:
 681     if (retries) {
 682         retries--;
 683         goto retry;
 684     }
 685 fail_noretry:
 686     errno = EIO;
 687     return -1;
 688 }
 689
 690 static int utimensat_empty(struct lo_data *lo, struct lo_inode *inode,
 691                            const struct timespec *tv)
 692 {
 693     int res;
 694     struct lo_inode *parent;
 695     char path[PATH_MAX];
 696
 697     if (inode->is_symlink) {
 698         res = utimensat(inode->fd, "", tv, AT_EMPTY_PATH);
 699         if (res == -1 && errno == EINVAL) {
 700             /* Sorry, no race free way to set times on symlink. */
 701             if (lo->norace) {
 702                 errno = EPERM;
 703             } else {
 704                 goto fallback;
 705             }
 706         }
 707         return res;
 708     }
 709     sprintf(path, "%i", inode->fd);
 710
 711     return utimensat(lo->proc_self_fd, path, tv, 0);
 712
 713 fallback:
 714     res = lo_parent_and_name(lo, inode, path, &parent);
 715     if (res != -1) {
 716         res = utimensat(parent->fd, path, tv, AT_SYMLINK_NOFOLLOW);
 717         unref_inode_lolocked(lo, parent, 1);
 718         lo_inode_put(lo, &parent);
 719     }
 720
 721     return res;
 722 }
 723
 724 static int lo_fi_fd(fuse_req_t req, struct fuse_file_info *fi)
 725 {
 726     struct lo_data *lo = lo_data(req);
 727     struct lo_map_elem *elem;
 728
 729     pthread_mutex_lock(&lo->mutex);
 730     elem = lo_map_get(&lo->fd_map, fi->fh);
 731     pthread_mutex_unlock(&lo->mutex);
 732
 733     if (!elem) {
 734         return -1;
 735     }
 736
 737     return elem->fd;
 738 }
 739
 740 static void lo_setattr(fuse_req_t req, fuse_ino_t ino, struct stat *attr,
 741                        int valid, struct fuse_file_info *fi)
 742 {
 743     int saverr;
 744     char procname[64];
 745     struct lo_data *lo = lo_data(req);
 746     struct lo_inode *inode;
 747     int ifd;
 748     int res;
 749     int fd;
 750
 751     inode = lo_inode(req, ino);
 752     if (!inode) {
 753         fuse_reply_err(req, EBADF);
 754         return;
 755     }
 756
 757     ifd = inode->fd;
 758
 759     /* If fi->fh is invalid we'll report EBADF later */
 760     if (fi) {
 761         fd = lo_fi_fd(req, fi);
 762     }
 763
 764     if (valid & FUSE_SET_ATTR_MODE) {
 765         if (fi) {
 766             res = fchmod(fd, attr->st_mode);
 767         } else {
 768             sprintf(procname, "%i", ifd);
 769             res = fchmodat(lo->proc_self_fd, procname, attr->st_mode, 0);
 770         }
 771         if (res == -1) {
 772             goto out_err;
 773         }
 774     }
 775     if (valid & (FUSE_SET_ATTR_UID | FUSE_SET_ATTR_GID)) {
 776         uid_t uid = (valid & FUSE_SET_ATTR_UID) ? attr->st_uid : (uid_t)-1;
 777         gid_t gid = (valid & FUSE_SET_ATTR_GID) ? attr->st_gid : (gid_t)-1;
 778
 779         res = fchownat(ifd, "", uid, gid, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
 780         if (res == -1) {
 781             goto out_err;
 782         }
 783     }
 784     if (valid & FUSE_SET_ATTR_SIZE) {
 785         int truncfd;
 786
 787         if (fi) {
 788             truncfd = fd;
 789         } else {
 790             sprintf(procname, "%i", ifd);
 791             truncfd = openat(lo->proc_self_fd, procname, O_RDWR);
 792             if (truncfd < 0) {
 793                 goto out_err;
 794             }
 795         }
 796
 797         res = ftruncate(truncfd, attr->st_size);
 798         if (!fi) {
 799             saverr = errno;
 800             close(truncfd);
 801             errno = saverr;
 802         }
 803         if (res == -1) {
 804             goto out_err;
 805         }
 806     }
 807     if (valid & (FUSE_SET_ATTR_ATIME | FUSE_SET_ATTR_MTIME)) {
 808         struct timespec tv[2];
 809
 810         tv[0].tv_sec = 0;
 811         tv[1].tv_sec = 0;
 812         tv[0].tv_nsec = UTIME_OMIT;
 813         tv[1].tv_nsec = UTIME_OMIT;
 814
 815         if (valid & FUSE_SET_ATTR_ATIME_NOW) {
 816             tv[0].tv_nsec = UTIME_NOW;
 817         } else if (valid & FUSE_SET_ATTR_ATIME) {
 818             tv[0] = attr->st_atim;
 819         }
 820
 821         if (valid & FUSE_SET_ATTR_MTIME_NOW) {
 822             tv[1].tv_nsec = UTIME_NOW;
 823         } else if (valid & FUSE_SET_ATTR_MTIME) {
 824             tv[1] = attr->st_mtim;
 825         }
 826
 827         if (fi) {
 828             res = futimens(fd, tv);
 829         } else {
 830             res = utimensat_empty(lo, inode, tv);
 831         }
 832         if (res == -1) {
 833             goto out_err;
 834         }
 835     }
 836     lo_inode_put(lo, &inode);
 837
 838     return lo_getattr(req, ino, fi);
 839
 840 out_err:
 841     saverr = errno;
 842     lo_inode_put(lo, &inode);
 843     fuse_reply_err(req, saverr);
 844 }
 845
 846 static struct lo_inode *lo_find(struct lo_data *lo, struct stat *st)
 847 {
 848     struct lo_inode *p;
 849     struct lo_key key = {
 850         .ino = st->st_ino,
 851         .dev = st->st_dev,
 852     };
 853
 854     pthread_mutex_lock(&lo->mutex);
 855     p = g_hash_table_lookup(lo->inodes, &key);
 856     if (p) {
 857         assert(p->nlookup > 0);
 858         p->nlookup++;
 859         g_atomic_int_inc(&p->refcount);
 860     }
 861     pthread_mutex_unlock(&lo->mutex);
 862
 863     return p;
 864 }
 865
 866 /* value_destroy_func for posix_locks GHashTable */
 867 static void posix_locks_value_destroy(gpointer data)
 868 {
 869     struct lo_inode_plock *plock = data;
 870
 871     /*
 872      * We had used open() for locks and had only one fd. So
 873      * closing this fd should release all OFD locks.
 874      */
 875     close(plock->fd);
 876     free(plock);
 877 }
 878
 879 /*
 880  * Increments nlookup and caller must release refcount using
 881  * lo_inode_put(&parent).
 882  */
 883 static int lo_do_lookup(fuse_req_t req, fuse_ino_t parent, const char *name,
 884                         struct fuse_entry_param *e)
 885 {
 886     int newfd;
 887     int res;
 888     int saverr;
 889     struct lo_data *lo = lo_data(req);
 890     struct lo_inode *inode = NULL;
 891     struct lo_inode *dir = lo_inode(req, parent);
 892
 893     /*
 894      * name_to_handle_at() and open_by_handle_at() can reach here with fuse
 895      * mount point in guest, but we don't have its inode info in the
 896      * ino_map.
 897      */
 898     if (!dir) {
 899         return ENOENT;
 900     }
 901
 902     memset(e, 0, sizeof(*e));
 903     e->attr_timeout = lo->timeout;
 904     e->entry_timeout = lo->timeout;
 905
 906     /* Do not allow escaping root directory */
 907     if (dir == &lo->root && strcmp(name, "..") == 0) {
 908         name = ".";
 909     }
 910
 911     newfd = openat(dir->fd, name, O_PATH | O_NOFOLLOW);
 912     if (newfd == -1) {
 913         goto out_err;
 914     }
 915
 916     res = fstatat(newfd, "", &e->attr, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
 917     if (res == -1) {
 918         goto out_err;
 919     }
 920
 921     inode = lo_find(lo, &e->attr);
 922     if (inode) {
 923         close(newfd);
 924         newfd = -1;
 925     } else {
 926         inode = calloc(1, sizeof(struct lo_inode));
 927         if (!inode) {
 928             goto out_err;
 929         }
 930
 931         inode->is_symlink = S_ISLNK(e->attr.st_mode);
 932
 933         /*
 934          * One for the caller and one for nlookup (released in
 935          * unref_inode_lolocked())
 936          */
 937         g_atomic_int_set(&inode->refcount, 2);
 938
 939         inode->nlookup = 1;
 940         inode->fd = newfd;
 941         newfd = -1;
 942         inode->key.ino = e->attr.st_ino;
 943         inode->key.dev = e->attr.st_dev;
 944         pthread_mutex_init(&inode->plock_mutex, NULL);
 945         inode->posix_locks = g_hash_table_new_full(
 946             g_direct_hash, g_direct_equal, NULL, posix_locks_value_destroy);
 947
 948         pthread_mutex_lock(&lo->mutex);
 949         inode->fuse_ino = lo_add_inode_mapping(req, inode);
 950         g_hash_table_insert(lo->inodes, &inode->key, inode);
 951         pthread_mutex_unlock(&lo->mutex);
 952     }
 953     e->ino = inode->fuse_ino;
 954     lo_inode_put(lo, &inode);
 955     lo_inode_put(lo, &dir);
 956
 957     fuse_log(FUSE_LOG_DEBUG, "  %lli/%s -> %lli\n", (unsigned long long)parent,
 958              name, (unsigned long long)e->ino);
 959
 960     return 0;
 961
 962 out_err:
 963     saverr = errno;
 964     if (newfd != -1) {
 965         close(newfd);
 966     }
 967     lo_inode_put(lo, &inode);
 968     lo_inode_put(lo, &dir);
 969     return saverr;
 970 }
 971
 972 static void lo_lookup(fuse_req_t req, fuse_ino_t parent, const char *name)
 973 {
 974     struct fuse_entry_param e;
 975     int err;
 976
 977     fuse_log(FUSE_LOG_DEBUG, "lo_lookup(parent=%" PRIu64 ", name=%s)\n", parent,
 978              name);
 979
 980     /*
 981      * Don't use is_safe_path_component(), allow "." and ".." for NFS export
 982      * support.
 983      */
 984     if (strchr(name, '/')) {
 985         fuse_reply_err(req, EINVAL);
 986         return;
 987     }
 988
 989     err = lo_do_lookup(req, parent, name, &e);
 990     if (err) {
 991         fuse_reply_err(req, err);
 992     } else {
 993         fuse_reply_entry(req, &e);
 994     }
 995 }
 996
 997 /*
 998  * On some archs, setres*id is limited to 2^16 but they
 999  * provide setres*id32 variants that allow 2^32.
1000  * Others just let setres*id do 2^32 anyway.
1001  */
1002 #ifdef SYS_setresgid32
1003 #define OURSYS_setresgid SYS_setresgid32
1004 #else
1005 #define OURSYS_setresgid SYS_setresgid
1006 #endif
1007
1008 #ifdef SYS_setresuid32
1009 #define OURSYS_setresuid SYS_setresuid32
1010 #else
1011 #define OURSYS_setresuid SYS_setresuid
1012 #endif
1013
1014 /*
1015  * Change to uid/gid of caller so that file is created with
1016  * ownership of caller.
1017  * TODO: What about selinux context?
1018  */
1019 static int lo_change_cred(fuse_req_t req, struct lo_cred *old)
1020 {
1021     int res;
1022
1023     old->euid = geteuid();
1024     old->egid = getegid();
1025
1026     res = syscall(OURSYS_setresgid, -1, fuse_req_ctx(req)->gid, -1);
1027     if (res == -1) {
1028         return errno;
1029     }
1030
1031     res = syscall(OURSYS_setresuid, -1, fuse_req_ctx(req)->uid, -1);
1032     if (res == -1) {
1033         int errno_save = errno;
1034
1035         syscall(OURSYS_setresgid, -1, old->egid, -1);
1036         return errno_save;
1037     }
1038
1039     return 0;
1040 }
1041
1042 /* Regain Privileges */
1043 static void lo_restore_cred(struct lo_cred *old)
1044 {
1045     int res;
1046
1047     res = syscall(OURSYS_setresuid, -1, old->euid, -1);
1048     if (res == -1) {
1049         fuse_log(FUSE_LOG_ERR, "seteuid(%u): %m\n", old->euid);
1050         exit(1);
1051     }
1052
1053     res = syscall(OURSYS_setresgid, -1, old->egid, -1);
1054     if (res == -1) {
1055         fuse_log(FUSE_LOG_ERR, "setegid(%u): %m\n", old->egid);
1056         exit(1);
1057     }
1058 }
1059
1060 static void lo_mknod_symlink(fuse_req_t req, fuse_ino_t parent,
1061                              const char *name, mode_t mode, dev_t rdev,
1062                              const char *link)
1063 {
1064     int res;
1065     int saverr;
1066     struct lo_data *lo = lo_data(req);
1067     struct lo_inode *dir;
1068     struct fuse_entry_param e;
1069     struct lo_cred old = {};
1070
1071     if (!is_safe_path_component(name)) {
1072         fuse_reply_err(req, EINVAL);
1073         return;
1074     }
1075
1076     dir = lo_inode(req, parent);
1077     if (!dir) {
1078         fuse_reply_err(req, EBADF);
1079         return;
1080     }
1081
1082     saverr = ENOMEM;
1083
1084     saverr = lo_change_cred(req, &old);
1085     if (saverr) {
1086         goto out;
1087     }
1088
1089     res = mknod_wrapper(dir->fd, name, link, mode, rdev);
1090
1091     saverr = errno;
1092
1093     lo_restore_cred(&old);
1094
1095     if (res == -1) {
1096         goto out;
1097     }
1098
1099     saverr = lo_do_lookup(req, parent, name, &e);
1100     if (saverr) {
1101         goto out;
1102     }
1103
1104     fuse_log(FUSE_LOG_DEBUG, "  %lli/%s -> %lli\n", (unsigned long long)parent,
1105              name, (unsigned long long)e.ino);
1106
1107     fuse_reply_entry(req, &e);
1108     lo_inode_put(lo, &dir);
1109     return;
1110
1111 out:
1112     lo_inode_put(lo, &dir);
1113     fuse_reply_err(req, saverr);
1114 }
1115
1116 static void lo_mknod(fuse_req_t req, fuse_ino_t parent, const char *name,
1117                      mode_t mode, dev_t rdev)
1118 {
1119     lo_mknod_symlink(req, parent, name, mode, rdev, NULL);
1120 }
1121
1122 static void lo_mkdir(fuse_req_t req, fuse_ino_t parent, const char *name,
1123                      mode_t mode)
1124 {
1125     lo_mknod_symlink(req, parent, name, S_IFDIR | mode, 0, NULL);
1126 }
1127
1128 static void lo_symlink(fuse_req_t req, const char *link, fuse_ino_t parent,
1129                        const char *name)
1130 {
1131     lo_mknod_symlink(req, parent, name, S_IFLNK, 0, link);
1132 }
1133
1134 static int linkat_empty_nofollow(struct lo_data *lo, struct lo_inode *inode,
1135                                  int dfd, const char *name)
1136 {
1137     int res;
1138     struct lo_inode *parent;
1139     char path[PATH_MAX];
1140
1141     if (inode->is_symlink) {
1142         res = linkat(inode->fd, "", dfd, name, AT_EMPTY_PATH);
1143         if (res == -1 && (errno == ENOENT || errno == EINVAL)) {
1144             /* Sorry, no race free way to hard-link a symlink. */
1145             if (lo->norace) {
1146                 errno = EPERM;
1147             } else {
1148                 goto fallback;
1149             }
1150         }
1151         return res;
1152     }
1153
1154     sprintf(path, "%i", inode->fd);
1155
1156     return linkat(lo->proc_self_fd, path, dfd, name, AT_SYMLINK_FOLLOW);
1157
1158 fallback:
1159     res = lo_parent_and_name(lo, inode, path, &parent);
1160     if (res != -1) {
1161         res = linkat(parent->fd, path, dfd, name, 0);
1162         unref_inode_lolocked(lo, parent, 1);
1163         lo_inode_put(lo, &parent);
1164     }
1165
1166     return res;
1167 }
1168
1169 static void lo_link(fuse_req_t req, fuse_ino_t ino, fuse_ino_t parent,
1170                     const char *name)
1171 {
1172     int res;
1173     struct lo_data *lo = lo_data(req);
1174     struct lo_inode *parent_inode;
1175     struct lo_inode *inode;
1176     struct fuse_entry_param e;
1177     int saverr;
1178
1179     if (!is_safe_path_component(name)) {
1180         fuse_reply_err(req, EINVAL);
1181         return;
1182     }
1183
1184     parent_inode = lo_inode(req, parent);
1185     inode = lo_inode(req, ino);
1186     if (!parent_inode || !inode) {
1187         errno = EBADF;
1188         goto out_err;
1189     }
1190
1191     memset(&e, 0, sizeof(struct fuse_entry_param));
1192     e.attr_timeout = lo->timeout;
1193     e.entry_timeout = lo->timeout;
1194
1195     res = linkat_empty_nofollow(lo, inode, parent_inode->fd, name);
1196     if (res == -1) {
1197         goto out_err;
1198     }
1199
1200     res = fstatat(inode->fd, "", &e.attr, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
1201     if (res == -1) {
1202         goto out_err;
1203     }
1204
1205     pthread_mutex_lock(&lo->mutex);
1206     inode->nlookup++;
1207     pthread_mutex_unlock(&lo->mutex);
1208     e.ino = inode->fuse_ino;
1209
1210     fuse_log(FUSE_LOG_DEBUG, "  %lli/%s -> %lli\n", (unsigned long long)parent,
1211              name, (unsigned long long)e.ino);
1212
1213     fuse_reply_entry(req, &e);
1214     lo_inode_put(lo, &parent_inode);
1215     lo_inode_put(lo, &inode);
1216     return;
1217
1218 out_err:
1219     saverr = errno;
1220     lo_inode_put(lo, &parent_inode);
1221     lo_inode_put(lo, &inode);
1222     fuse_reply_err(req, saverr);
1223 }
1224
1225 /* Increments nlookup and caller must release refcount using lo_inode_put() */
1226 static struct lo_inode *lookup_name(fuse_req_t req, fuse_ino_t parent,
1227                                     const char *name)
1228 {
1229     int res;
1230     struct stat attr;
1231
1232     res = fstatat(lo_fd(req, parent), name, &attr,
1233                   AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
1234     if (res == -1) {
1235         return NULL;
1236     }
1237
1238     return lo_find(lo_data(req), &attr);
1239 }
1240
1241 static void lo_rmdir(fuse_req_t req, fuse_ino_t parent, const char *name)
1242 {
1243     int res;
1244     struct lo_inode *inode;
1245     struct lo_data *lo = lo_data(req);
1246
1247     if (!is_safe_path_component(name)) {
1248         fuse_reply_err(req, EINVAL);
1249         return;
1250     }
1251
1252     inode = lookup_name(req, parent, name);
1253     if (!inode) {
1254         fuse_reply_err(req, EIO);
1255         return;
1256     }
1257
1258     res = unlinkat(lo_fd(req, parent), name, AT_REMOVEDIR);
1259
1260     fuse_reply_err(req, res == -1 ? errno : 0);
1261     unref_inode_lolocked(lo, inode, 1);
1262     lo_inode_put(lo, &inode);
1263 }
1264
1265 static void lo_rename(fuse_req_t req, fuse_ino_t parent, const char *name,
1266                       fuse_ino_t newparent, const char *newname,
1267                       unsigned int flags)
1268 {
1269     int res;
1270     struct lo_inode *parent_inode;
1271     struct lo_inode *newparent_inode;
1272     struct lo_inode *oldinode = NULL;
1273     struct lo_inode *newinode = NULL;
1274     struct lo_data *lo = lo_data(req);
1275
1276     if (!is_safe_path_component(name) || !is_safe_path_component(newname)) {
1277         fuse_reply_err(req, EINVAL);
1278         return;
1279     }
1280
1281     parent_inode = lo_inode(req, parent);
1282     newparent_inode = lo_inode(req, newparent);
1283     if (!parent_inode || !newparent_inode) {
1284         fuse_reply_err(req, EBADF);
1285         goto out;
1286     }
1287
1288     oldinode = lookup_name(req, parent, name);
1289     newinode = lookup_name(req, newparent, newname);
1290
1291     if (!oldinode) {
1292         fuse_reply_err(req, EIO);
1293         goto out;
1294     }
1295
1296     if (flags) {
1297 #ifndef SYS_renameat2
1298         fuse_reply_err(req, EINVAL);
1299 #else
1300         res = syscall(SYS_renameat2, parent_inode->fd, name,
1301                         newparent_inode->fd, newname, flags);
1302         if (res == -1 && errno == ENOSYS) {
1303             fuse_reply_err(req, EINVAL);
1304         } else {
1305             fuse_reply_err(req, res == -1 ? errno : 0);
1306         }
1307 #endif
1308         goto out;
1309     }
1310
1311     res = renameat(parent_inode->fd, name, newparent_inode->fd, newname);
1312
1313     fuse_reply_err(req, res == -1 ? errno : 0);
1314 out:
1315     unref_inode_lolocked(lo, oldinode, 1);
1316     unref_inode_lolocked(lo, newinode, 1);
1317     lo_inode_put(lo, &oldinode);
1318     lo_inode_put(lo, &newinode);
1319     lo_inode_put(lo, &parent_inode);
1320     lo_inode_put(lo, &newparent_inode);
1321 }
1322
1323 static void lo_unlink(fuse_req_t req, fuse_ino_t parent, const char *name)
1324 {
1325     int res;
1326     struct lo_inode *inode;
1327     struct lo_data *lo = lo_data(req);
1328
1329     if (!is_safe_path_component(name)) {
1330         fuse_reply_err(req, EINVAL);
1331         return;
1332     }
1333
1334     inode = lookup_name(req, parent, name);
1335     if (!inode) {
1336         fuse_reply_err(req, EIO);
1337         return;
1338     }
1339
1340     res = unlinkat(lo_fd(req, parent), name, 0);
1341
1342     fuse_reply_err(req, res == -1 ? errno : 0);
1343     unref_inode_lolocked(lo, inode, 1);
1344     lo_inode_put(lo, &inode);
1345 }
1346
1347 /* To be called with lo->mutex held */
1348 static void unref_inode(struct lo_data *lo, struct lo_inode *inode, uint64_t n)
1349 {
1350     if (!inode) {
1351         return;
1352     }
1353
1354     assert(inode->nlookup >= n);
1355     inode->nlookup -= n;
1356     if (!inode->nlookup) {
1357         lo_map_remove(&lo->ino_map, inode->fuse_ino);
1358         g_hash_table_remove(lo->inodes, &inode->key);
1359         if (g_hash_table_size(inode->posix_locks)) {
1360             fuse_log(FUSE_LOG_WARNING, "Hash table is not empty\n");
1361         }
1362         g_hash_table_destroy(inode->posix_locks);
1363         pthread_mutex_destroy(&inode->plock_mutex);
1364
1365         /* Drop our refcount from lo_do_lookup() */
1366         lo_inode_put(lo, &inode);
1367     }
1368 }
1369
1370 static void unref_inode_lolocked(struct lo_data *lo, struct lo_inode *inode,
1371                                  uint64_t n)
1372 {
1373     if (!inode) {
1374         return;
1375     }
1376
1377     pthread_mutex_lock(&lo->mutex);
1378     unref_inode(lo, inode, n);
1379     pthread_mutex_unlock(&lo->mutex);
1380 }
1381
1382 static void lo_forget_one(fuse_req_t req, fuse_ino_t ino, uint64_t nlookup)
1383 {
1384     struct lo_data *lo = lo_data(req);
1385     struct lo_inode *inode;
1386
1387     inode = lo_inode(req, ino);
1388     if (!inode) {
1389         return;
1390     }
1391
1392     fuse_log(FUSE_LOG_DEBUG, "  forget %lli %lli -%lli\n",
1393              (unsigned long long)ino, (unsigned long long)inode->nlookup,
1394              (unsigned long long)nlookup);
1395
1396     unref_inode_lolocked(lo, inode, nlookup);
1397     lo_inode_put(lo, &inode);
1398 }
1399
1400 static void lo_forget(fuse_req_t req, fuse_ino_t ino, uint64_t nlookup)
1401 {
1402     lo_forget_one(req, ino, nlookup);
1403     fuse_reply_none(req);
1404 }
1405
1406 static void lo_forget_multi(fuse_req_t req, size_t count,
1407                             struct fuse_forget_data *forgets)
1408 {
1409     int i;
1410
1411     for (i = 0; i < count; i++) {
1412         lo_forget_one(req, forgets[i].ino, forgets[i].nlookup);
1413     }
1414     fuse_reply_none(req);
1415 }
1416
1417 static void lo_readlink(fuse_req_t req, fuse_ino_t ino)
1418 {
1419     char buf[PATH_MAX + 1];
1420     int res;
1421
1422     res = readlinkat(lo_fd(req, ino), "", buf, sizeof(buf));
1423     if (res == -1) {
1424         return (void)fuse_reply_err(req, errno);
1425     }
1426
1427     if (res == sizeof(buf)) {
1428         return (void)fuse_reply_err(req, ENAMETOOLONG);
1429     }
1430
1431     buf[res] = '\0';
1432
1433     fuse_reply_readlink(req, buf);
1434 }
1435
1436 struct lo_dirp {
1437     gint refcount;
1438     DIR *dp;
1439     struct dirent *entry;
1440     off_t offset;
1441 };
1442
1443 static void lo_dirp_put(struct lo_dirp **dp)
1444 {
1445     struct lo_dirp *d = *dp;
1446
1447     if (!d) {
1448         return;
1449     }
1450     *dp = NULL;
1451
1452     if (g_atomic_int_dec_and_test(&d->refcount)) {
1453         closedir(d->dp);
1454         free(d);
1455     }
1456 }
1457
1458 /* Call lo_dirp_put() on the return value when no longer needed */
1459 static struct lo_dirp *lo_dirp(fuse_req_t req, struct fuse_file_info *fi)
1460 {
1461     struct lo_data *lo = lo_data(req);
1462     struct lo_map_elem *elem;
1463
1464     pthread_mutex_lock(&lo->mutex);
1465     elem = lo_map_get(&lo->dirp_map, fi->fh);
1466     if (elem) {
1467         g_atomic_int_inc(&elem->dirp->refcount);
1468     }
1469     pthread_mutex_unlock(&lo->mutex);
1470     if (!elem) {
1471         return NULL;
1472     }
1473
1474     return elem->dirp;
1475 }
1476
1477 static void lo_opendir(fuse_req_t req, fuse_ino_t ino,
1478                        struct fuse_file_info *fi)
1479 {
1480     int error = ENOMEM;
1481     struct lo_data *lo = lo_data(req);
1482     struct lo_dirp *d;
1483     int fd;
1484     ssize_t fh;
1485
1486     d = calloc(1, sizeof(struct lo_dirp));
1487     if (d == NULL) {
1488         goto out_err;
1489     }
1490
1491     fd = openat(lo_fd(req, ino), ".", O_RDONLY);
1492     if (fd == -1) {
1493         goto out_errno;
1494     }
1495
1496     d->dp = fdopendir(fd);
1497     if (d->dp == NULL) {
1498         goto out_errno;
1499     }
1500
1501     d->offset = 0;
1502     d->entry = NULL;
1503
1504     g_atomic_int_set(&d->refcount, 1); /* paired with lo_releasedir() */
1505     pthread_mutex_lock(&lo->mutex);
1506     fh = lo_add_dirp_mapping(req, d);
1507     pthread_mutex_unlock(&lo->mutex);
1508     if (fh == -1) {
1509         goto out_err;
1510     }
1511
1512     fi->fh = fh;
1513     if (lo->cache == CACHE_ALWAYS) {
1514         fi->cache_readdir = 1;
1515     }
1516     fuse_reply_open(req, fi);
1517     return;
1518
1519 out_errno:
1520     error = errno;
1521 out_err:
1522     if (d) {
1523         if (d->dp) {
1524             closedir(d->dp);
1525         }
1526         if (fd != -1) {
1527             close(fd);
1528         }
1529         free(d);
1530     }
1531     fuse_reply_err(req, error);
1532 }
1533
1534 static void lo_do_readdir(fuse_req_t req, fuse_ino_t ino, size_t size,
1535                           off_t offset, struct fuse_file_info *fi, int plus)
1536 {
1537     struct lo_data *lo = lo_data(req);
1538     struct lo_dirp *d = NULL;
1539     struct lo_inode *dinode;
1540     char *buf = NULL;
1541     char *p;
1542     size_t rem = size;
1543     int err = EBADF;
1544
1545     dinode = lo_inode(req, ino);
1546     if (!dinode) {
1547         goto error;
1548     }
1549
1550     d = lo_dirp(req, fi);
1551     if (!d) {
1552         goto error;
1553     }
1554
1555     err = ENOMEM;
1556     buf = calloc(1, size);
1557     if (!buf) {
1558         goto error;
1559     }
1560     p = buf;
1561
1562     if (offset != d->offset) {
1563         seekdir(d->dp, offset);
1564         d->entry = NULL;
1565         d->offset = offset;
1566     }
1567     while (1) {
1568         size_t entsize;
1569         off_t nextoff;
1570         const char *name;
1571
1572         if (!d->entry) {
1573             errno = 0;
1574             d->entry = readdir(d->dp);
1575             if (!d->entry) {
1576                 if (errno) { /* Error */
1577                     err = errno;
1578                     goto error;
1579                 } else { /* End of stream */
1580                     break;
1581                 }
1582             }
1583         }
1584         nextoff = d->entry->d_off;
1585         name = d->entry->d_name;
1586
1587         fuse_ino_t entry_ino = 0;
1588         struct fuse_entry_param e = (struct fuse_entry_param){
1589             .attr.st_ino = d->entry->d_ino,
1590             .attr.st_mode = d->entry->d_type << 12,
1591         };
1592
1593         /* Hide root's parent directory */
1594         if (dinode == &lo->root && strcmp(name, "..") == 0) {
1595             e.attr.st_ino = lo->root.key.ino;
1596             e.attr.st_mode = DT_DIR << 12;
1597         }
1598
1599         if (plus) {
1600             if (!is_dot_or_dotdot(name)) {
1601                 err = lo_do_lookup(req, ino, name, &e);
1602                 if (err) {
1603                     goto error;
1604                 }
1605                 entry_ino = e.ino;
1606             }
1607
1608             entsize = fuse_add_direntry_plus(req, p, rem, name, &e, nextoff);
1609         } else {
1610             entsize = fuse_add_direntry(req, p, rem, name, &e.attr, nextoff);
1611         }
1612         if (entsize > rem) {
1613             if (entry_ino != 0) {
1614                 lo_forget_one(req, entry_ino, 1);
1615             }
1616             break;
1617         }
1618
1619         p += entsize;
1620         rem -= entsize;
1621
1622         d->entry = NULL;
1623         d->offset = nextoff;
1624     }
1625
1626     err = 0;
1627 error:
1628     lo_dirp_put(&d);
1629     lo_inode_put(lo, &dinode);
1630
1631     /*
1632      * If there's an error, we can only signal it if we haven't stored
1633      * any entries yet - otherwise we'd end up with wrong lookup
1634      * counts for the entries that are already in the buffer. So we
1635      * return what we've collected until that point.
1636      */
1637     if (err && rem == size) {
1638         fuse_reply_err(req, err);
1639     } else {
1640         fuse_reply_buf(req, buf, size - rem);
1641     }
1642     free(buf);
1643 }
1644
1645 static void lo_readdir(fuse_req_t req, fuse_ino_t ino, size_t size,
1646                        off_t offset, struct fuse_file_info *fi)
1647 {
1648     lo_do_readdir(req, ino, size, offset, fi, 0);
1649 }
1650
1651 static void lo_readdirplus(fuse_req_t req, fuse_ino_t ino, size_t size,
1652                            off_t offset, struct fuse_file_info *fi)
1653 {
1654     lo_do_readdir(req, ino, size, offset, fi, 1);
1655 }
1656
1657 static void lo_releasedir(fuse_req_t req, fuse_ino_t ino,
1658                           struct fuse_file_info *fi)
1659 {
1660     struct lo_data *lo = lo_data(req);
1661     struct lo_map_elem *elem;
1662     struct lo_dirp *d;
1663
1664     (void)ino;
1665
1666     pthread_mutex_lock(&lo->mutex);
1667     elem = lo_map_get(&lo->dirp_map, fi->fh);
1668     if (!elem) {
1669         pthread_mutex_unlock(&lo->mutex);
1670         fuse_reply_err(req, EBADF);
1671         return;
1672     }
1673
1674     d = elem->dirp;
1675     lo_map_remove(&lo->dirp_map, fi->fh);
1676     pthread_mutex_unlock(&lo->mutex);
1677
1678     lo_dirp_put(&d); /* paired with lo_opendir() */
1679
1680     fuse_reply_err(req, 0);
1681 }
1682
1683 static void update_open_flags(int writeback, struct fuse_file_info *fi)
1684 {
1685     /*
1686      * With writeback cache, kernel may send read requests even
1687      * when userspace opened write-only
1688      */
1689     if (writeback && (fi->flags & O_ACCMODE) == O_WRONLY) {
1690         fi->flags &= ~O_ACCMODE;
1691         fi->flags |= O_RDWR;
1692     }
1693
1694     /*
1695      * With writeback cache, O_APPEND is handled by the kernel.
1696      * This breaks atomicity (since the file may change in the
1697      * underlying filesystem, so that the kernel's idea of the
1698      * end of the file isn't accurate anymore). In this example,
1699      * we just accept that. A more rigorous filesystem may want
1700      * to return an error here
1701      */
1702     if (writeback && (fi->flags & O_APPEND)) {
1703         fi->flags &= ~O_APPEND;
1704     }
1705
1706     /*
1707      * O_DIRECT in guest should not necessarily mean bypassing page
1708      * cache on host as well. If somebody needs that behavior, it
1709      * probably should be a configuration knob in daemon.
1710      */
1711     fi->flags &= ~O_DIRECT;
1712 }
1713
1714 static void lo_create(fuse_req_t req, fuse_ino_t parent, const char *name,
1715                       mode_t mode, struct fuse_file_info *fi)
1716 {
1717     int fd;
1718     struct lo_data *lo = lo_data(req);
1719     struct lo_inode *parent_inode;
1720     struct fuse_entry_param e;
1721     int err;
1722     struct lo_cred old = {};
1723
1724     fuse_log(FUSE_LOG_DEBUG, "lo_create(parent=%" PRIu64 ", name=%s)\n", parent,
1725              name);
1726
1727     if (!is_safe_path_component(name)) {
1728         fuse_reply_err(req, EINVAL);
1729         return;
1730     }
1731
1732     parent_inode = lo_inode(req, parent);
1733     if (!parent_inode) {
1734         fuse_reply_err(req, EBADF);
1735         return;
1736     }
1737
1738     err = lo_change_cred(req, &old);
1739     if (err) {
1740         goto out;
1741     }
1742
1743     update_open_flags(lo->writeback, fi);
1744
1745     fd = openat(parent_inode->fd, name, (fi->flags | O_CREAT) & ~O_NOFOLLOW,
1746                 mode);
1747     err = fd == -1 ? errno : 0;
1748     lo_restore_cred(&old);
1749
1750     if (!err) {
1751         ssize_t fh;
1752
1753         pthread_mutex_lock(&lo->mutex);
1754         fh = lo_add_fd_mapping(req, fd);
1755         pthread_mutex_unlock(&lo->mutex);
1756         if (fh == -1) {
1757             close(fd);
1758             err = ENOMEM;
1759             goto out;
1760         }
1761
1762         fi->fh = fh;
1763         err = lo_do_lookup(req, parent, name, &e);
1764     }
1765     if (lo->cache == CACHE_NONE) {
1766         fi->direct_io = 1;
1767     } else if (lo->cache == CACHE_ALWAYS) {
1768         fi->keep_cache = 1;
1769     }
1770
1771 out:
1772     lo_inode_put(lo, &parent_inode);
1773
1774     if (err) {
1775         fuse_reply_err(req, err);
1776     } else {
1777         fuse_reply_create(req, &e, fi);
1778     }
1779 }
1780
1781 /* Should be called with inode->plock_mutex held */
1782 static struct lo_inode_plock *lookup_create_plock_ctx(struct lo_data *lo,
1783                                                       struct lo_inode *inode,
1784                                                       uint64_t lock_owner,
1785                                                       pid_t pid, int *err)
1786 {
1787     struct lo_inode_plock *plock;
1788     char procname[64];
1789     int fd;
1790
1791     plock =
1792         g_hash_table_lookup(inode->posix_locks, GUINT_TO_POINTER(lock_owner));
1793
1794     if (plock) {
1795         return plock;
1796     }
1797
1798     plock = malloc(sizeof(struct lo_inode_plock));
1799     if (!plock) {
1800         *err = ENOMEM;
1801         return NULL;
1802     }
1803
1804     /* Open another instance of file which can be used for ofd locks. */
1805     sprintf(procname, "%i", inode->fd);
1806
1807     /* TODO: What if file is not writable? */
1808     fd = openat(lo->proc_self_fd, procname, O_RDWR);
1809     if (fd == -1) {
1810         *err = errno;
1811         free(plock);
1812         return NULL;
1813     }
1814
1815     plock->lock_owner = lock_owner;
1816     plock->fd = fd;
1817     g_hash_table_insert(inode->posix_locks, GUINT_TO_POINTER(plock->lock_owner),
1818                         plock);
1819     return plock;
1820 }
1821
1822 static void lo_getlk(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi,
1823                      struct flock *lock)
1824 {
1825     struct lo_data *lo = lo_data(req);
1826     struct lo_inode *inode;
1827     struct lo_inode_plock *plock;
1828     int ret, saverr = 0;
1829
1830     fuse_log(FUSE_LOG_DEBUG,
1831              "lo_getlk(ino=%" PRIu64 ", flags=%d)"
1832              " owner=0x%lx, l_type=%d l_start=0x%lx"
1833              " l_len=0x%lx\n",
1834              ino, fi->flags, fi->lock_owner, lock->l_type, lock->l_start,
1835              lock->l_len);
1836
1837     inode = lo_inode(req, ino);
1838     if (!inode) {
1839         fuse_reply_err(req, EBADF);
1840         return;
1841     }
1842
1843     pthread_mutex_lock(&inode->plock_mutex);
1844     plock =
1845         lookup_create_plock_ctx(lo, inode, fi->lock_owner, lock->l_pid, &ret);
1846     if (!plock) {
1847         saverr = ret;
1848         goto out;
1849     }
1850
1851     ret = fcntl(plock->fd, F_OFD_GETLK, lock);
1852     if (ret == -1) {
1853         saverr = errno;
1854     }
1855
1856 out:
1857     pthread_mutex_unlock(&inode->plock_mutex);
1858     lo_inode_put(lo, &inode);
1859
1860     if (saverr) {
1861         fuse_reply_err(req, saverr);
1862     } else {
1863         fuse_reply_lock(req, lock);
1864     }
1865 }
1866
1867 static void lo_setlk(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi,
1868                      struct flock *lock, int sleep)
1869 {
1870     struct lo_data *lo = lo_data(req);
1871     struct lo_inode *inode;
1872     struct lo_inode_plock *plock;
1873     int ret, saverr = 0;
1874
1875     fuse_log(FUSE_LOG_DEBUG,
1876              "lo_setlk(ino=%" PRIu64 ", flags=%d)"
1877              " cmd=%d pid=%d owner=0x%lx sleep=%d l_whence=%d"
1878              " l_start=0x%lx l_len=0x%lx\n",
1879              ino, fi->flags, lock->l_type, lock->l_pid, fi->lock_owner, sleep,
1880              lock->l_whence, lock->l_start, lock->l_len);
1881
1882     if (sleep) {
1883         fuse_reply_err(req, EOPNOTSUPP);
1884         return;
1885     }
1886
1887     inode = lo_inode(req, ino);
1888     if (!inode) {
1889         fuse_reply_err(req, EBADF);
1890         return;
1891     }
1892
1893     pthread_mutex_lock(&inode->plock_mutex);
1894     plock =
1895         lookup_create_plock_ctx(lo, inode, fi->lock_owner, lock->l_pid, &ret);
1896
1897     if (!plock) {
1898         saverr = ret;
1899         goto out;
1900     }
1901
1902     /* TODO: Is it alright to modify flock? */
1903     lock->l_pid = 0;
1904     ret = fcntl(plock->fd, F_OFD_SETLK, lock);
1905     if (ret == -1) {
1906         saverr = errno;
1907     }
1908
1909 out:
1910     pthread_mutex_unlock(&inode->plock_mutex);
1911     lo_inode_put(lo, &inode);
1912
1913     fuse_reply_err(req, saverr);
1914 }
1915
1916 static void lo_fsyncdir(fuse_req_t req, fuse_ino_t ino, int datasync,
1917                         struct fuse_file_info *fi)
1918 {
1919     int res;
1920     struct lo_dirp *d;
1921     int fd;
1922
1923     (void)ino;
1924
1925     d = lo_dirp(req, fi);
1926     if (!d) {
1927         fuse_reply_err(req, EBADF);
1928         return;
1929     }
1930
1931     fd = dirfd(d->dp);
1932     if (datasync) {
1933         res = fdatasync(fd);
1934     } else {
1935         res = fsync(fd);
1936     }
1937
1938     lo_dirp_put(&d);
1939
1940     fuse_reply_err(req, res == -1 ? errno : 0);
1941 }
1942
1943 static void lo_open(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi)
1944 {
1945     int fd;
1946     ssize_t fh;
1947     char buf[64];
1948     struct lo_data *lo = lo_data(req);
1949
1950     fuse_log(FUSE_LOG_DEBUG, "lo_open(ino=%" PRIu64 ", flags=%d)\n", ino,
1951              fi->flags);
1952
1953     update_open_flags(lo->writeback, fi);
1954
1955     sprintf(buf, "%i", lo_fd(req, ino));
1956     fd = openat(lo->proc_self_fd, buf, fi->flags & ~O_NOFOLLOW);
1957     if (fd == -1) {
1958         return (void)fuse_reply_err(req, errno);
1959     }
1960
1961     pthread_mutex_lock(&lo->mutex);
1962     fh = lo_add_fd_mapping(req, fd);
1963     pthread_mutex_unlock(&lo->mutex);
1964     if (fh == -1) {
1965         close(fd);
1966         fuse_reply_err(req, ENOMEM);
1967         return;
1968     }
1969
1970     fi->fh = fh;
1971     if (lo->cache == CACHE_NONE) {
1972         fi->direct_io = 1;
1973     } else if (lo->cache == CACHE_ALWAYS) {
1974         fi->keep_cache = 1;
1975     }
1976     fuse_reply_open(req, fi);
1977 }
1978
1979 static void lo_release(fuse_req_t req, fuse_ino_t ino,
1980                        struct fuse_file_info *fi)
1981 {
1982     struct lo_data *lo = lo_data(req);
1983     struct lo_map_elem *elem;
1984     int fd = -1;
1985
1986     (void)ino;
1987
1988     pthread_mutex_lock(&lo->mutex);
1989     elem = lo_map_get(&lo->fd_map, fi->fh);
1990     if (elem) {
1991         fd = elem->fd;
1992         elem = NULL;
1993         lo_map_remove(&lo->fd_map, fi->fh);
1994     }
1995     pthread_mutex_unlock(&lo->mutex);
1996
1997     close(fd);
1998     fuse_reply_err(req, 0);
1999 }
2000
2001 static void lo_flush(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi)
2002 {
2003     int res;
2004     (void)ino;
2005     struct lo_inode *inode;
2006
2007     inode = lo_inode(req, ino);
2008     if (!inode) {
2009         fuse_reply_err(req, EBADF);
2010         return;
2011     }
2012
2013     /* An fd is going away. Cleanup associated posix locks */
2014     pthread_mutex_lock(&inode->plock_mutex);
2015     g_hash_table_remove(inode->posix_locks, GUINT_TO_POINTER(fi->lock_owner));
2016     pthread_mutex_unlock(&inode->plock_mutex);
2017
2018     res = close(dup(lo_fi_fd(req, fi)));
2019     lo_inode_put(lo_data(req), &inode);
2020     fuse_reply_err(req, res == -1 ? errno : 0);
2021 }
2022
2023 static void lo_fsync(fuse_req_t req, fuse_ino_t ino, int datasync,
2024                      struct fuse_file_info *fi)
2025 {
2026     int res;
2027     int fd;
2028     char *buf;
2029
2030     fuse_log(FUSE_LOG_DEBUG, "lo_fsync(ino=%" PRIu64 ", fi=0x%p)\n", ino,
2031              (void *)fi);
2032
2033     if (!fi) {
2034         struct lo_data *lo = lo_data(req);
2035
2036         res = asprintf(&buf, "%i", lo_fd(req, ino));
2037         if (res == -1) {
2038             return (void)fuse_reply_err(req, errno);
2039         }
2040
2041         fd = openat(lo->proc_self_fd, buf, O_RDWR);
2042         free(buf);
2043         if (fd == -1) {
2044             return (void)fuse_reply_err(req, errno);
2045         }
2046     } else {
2047         fd = lo_fi_fd(req, fi);
2048     }
2049
2050     if (datasync) {
2051         res = fdatasync(fd);
2052     } else {
2053         res = fsync(fd);
2054     }
2055     if (!fi) {
2056         close(fd);
2057     }
2058     fuse_reply_err(req, res == -1 ? errno : 0);
2059 }
2060
2061 static void lo_read(fuse_req_t req, fuse_ino_t ino, size_t size, off_t offset,
2062                     struct fuse_file_info *fi)
2063 {
2064     struct fuse_bufvec buf = FUSE_BUFVEC_INIT(size);
2065
2066     fuse_log(FUSE_LOG_DEBUG,
2067              "lo_read(ino=%" PRIu64 ", size=%zd, "
2068              "off=%lu)\n",
2069              ino, size, (unsigned long)offset);
2070
2071     buf.buf[0].flags = FUSE_BUF_IS_FD | FUSE_BUF_FD_SEEK;
2072     buf.buf[0].fd = lo_fi_fd(req, fi);
2073     buf.buf[0].pos = offset;
2074
2075     fuse_reply_data(req, &buf);
2076 }
2077
2078 static void lo_write_buf(fuse_req_t req, fuse_ino_t ino,
2079                          struct fuse_bufvec *in_buf, off_t off,
2080                          struct fuse_file_info *fi)
2081 {
2082     (void)ino;
2083     ssize_t res;
2084     struct fuse_bufvec out_buf = FUSE_BUFVEC_INIT(fuse_buf_size(in_buf));
2085     bool cap_fsetid_dropped = false;
2086
2087     out_buf.buf[0].flags = FUSE_BUF_IS_FD | FUSE_BUF_FD_SEEK;
2088     out_buf.buf[0].fd = lo_fi_fd(req, fi);
2089     out_buf.buf[0].pos = off;
2090
2091     fuse_log(FUSE_LOG_DEBUG,
2092              "lo_write_buf(ino=%" PRIu64 ", size=%zd, off=%lu)\n", ino,
2093              out_buf.buf[0].size, (unsigned long)off);
2094
2095     /*
2096      * If kill_priv is set, drop CAP_FSETID which should lead to kernel
2097      * clearing setuid/setgid on file.
2098      */
2099     if (fi->kill_priv) {
2100         res = drop_effective_cap("FSETID", &cap_fsetid_dropped);
2101         if (res != 0) {
2102             fuse_reply_err(req, res);
2103             return;
2104         }
2105     }
2106
2107     res = fuse_buf_copy(&out_buf, in_buf);
2108     if (res < 0) {
2109         fuse_reply_err(req, -res);
2110     } else {
2111         fuse_reply_write(req, (size_t)res);
2112     }
2113
2114     if (cap_fsetid_dropped) {
2115         res = gain_effective_cap("FSETID");
2116         if (res) {
2117             fuse_log(FUSE_LOG_ERR, "Failed to gain CAP_FSETID\n");
2118         }
2119     }
2120 }
2121
2122 static void lo_statfs(fuse_req_t req, fuse_ino_t ino)
2123 {
2124     int res;
2125     struct statvfs stbuf;
2126
2127     res = fstatvfs(lo_fd(req, ino), &stbuf);
2128     if (res == -1) {
2129         fuse_reply_err(req, errno);
2130     } else {
2131         fuse_reply_statfs(req, &stbuf);
2132     }
2133 }
2134
2135 static void lo_fallocate(fuse_req_t req, fuse_ino_t ino, int mode, off_t offset,
2136                          off_t length, struct fuse_file_info *fi)
2137 {
2138     int err = EOPNOTSUPP;
2139     (void)ino;
2140
2141 #ifdef CONFIG_FALLOCATE
2142     err = fallocate(lo_fi_fd(req, fi), mode, offset, length);
2143     if (err < 0) {
2144         err = errno;
2145     }
2146
2147 #elif defined(CONFIG_POSIX_FALLOCATE)
2148     if (mode) {
2149         fuse_reply_err(req, EOPNOTSUPP);
2150         return;
2151     }
2152
2153     err = posix_fallocate(lo_fi_fd(req, fi), offset, length);
2154 #endif
2155
2156     fuse_reply_err(req, err);
2157 }
2158
2159 static void lo_flock(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi,
2160                      int op)
2161 {
2162     int res;
2163     (void)ino;
2164
2165     res = flock(lo_fi_fd(req, fi), op);
2166
2167     fuse_reply_err(req, res == -1 ? errno : 0);
2168 }
2169
2170 static void lo_getxattr(fuse_req_t req, fuse_ino_t ino, const char *name,
2171                         size_t size)
2172 {
2173     struct lo_data *lo = lo_data(req);
2174     char *value = NULL;
2175     char procname[64];
2176     struct lo_inode *inode;
2177     ssize_t ret;
2178     int saverr;
2179     int fd = -1;
2180
2181     inode = lo_inode(req, ino);
2182     if (!inode) {
2183         fuse_reply_err(req, EBADF);
2184         return;
2185     }
2186
2187     saverr = ENOSYS;
2188     if (!lo_data(req)->xattr) {
2189         goto out;
2190     }
2191
2192     fuse_log(FUSE_LOG_DEBUG, "lo_getxattr(ino=%" PRIu64 ", name=%s size=%zd)\n",
2193              ino, name, size);
2194
2195     if (inode->is_symlink) {
2196         /* Sorry, no race free way to getxattr on symlink. */
2197         saverr = EPERM;
2198         goto out;
2199     }
2200
2201     sprintf(procname, "%i", inode->fd);
2202     fd = openat(lo->proc_self_fd, procname, O_RDONLY);
2203     if (fd < 0) {
2204         goto out_err;
2205     }
2206
2207     if (size) {
2208         value = malloc(size);
2209         if (!value) {
2210             goto out_err;
2211         }
2212
2213         ret = fgetxattr(fd, name, value, size);
2214         if (ret == -1) {
2215             goto out_err;
2216         }
2217         saverr = 0;
2218         if (ret == 0) {
2219             goto out;
2220         }
2221
2222         fuse_reply_buf(req, value, ret);
2223     } else {
2224         ret = fgetxattr(fd, name, NULL, 0);
2225         if (ret == -1) {
2226             goto out_err;
2227         }
2228
2229         fuse_reply_xattr(req, ret);
2230     }
2231 out_free:
2232     free(value);
2233
2234     if (fd >= 0) {
2235         close(fd);
2236     }
2237
2238     lo_inode_put(lo, &inode);
2239     return;
2240
2241 out_err:
2242     saverr = errno;
2243 out:
2244     lo_inode_put(lo, &inode);
2245     fuse_reply_err(req, saverr);
2246     goto out_free;
2247 }
2248
2249 static void lo_listxattr(fuse_req_t req, fuse_ino_t ino, size_t size)
2250 {
2251     struct lo_data *lo = lo_data(req);
2252     char *value = NULL;
2253     char procname[64];
2254     struct lo_inode *inode;
2255     ssize_t ret;
2256     int saverr;
2257     int fd = -1;
2258
2259     inode = lo_inode(req, ino);
2260     if (!inode) {
2261         fuse_reply_err(req, EBADF);
2262         return;
2263     }
2264
2265     saverr = ENOSYS;
2266     if (!lo_data(req)->xattr) {
2267         goto out;
2268     }
2269
2270     fuse_log(FUSE_LOG_DEBUG, "lo_listxattr(ino=%" PRIu64 ", size=%zd)\n", ino,
2271              size);
2272
2273     if (inode->is_symlink) {
2274         /* Sorry, no race free way to listxattr on symlink. */
2275         saverr = EPERM;
2276         goto out;
2277     }
2278
2279     sprintf(procname, "%i", inode->fd);
2280     fd = openat(lo->proc_self_fd, procname, O_RDONLY);
2281     if (fd < 0) {
2282         goto out_err;
2283     }
2284
2285     if (size) {
2286         value = malloc(size);
2287         if (!value) {
2288             goto out_err;
2289         }
2290
2291         ret = flistxattr(fd, value, size);
2292         if (ret == -1) {
2293             goto out_err;
2294         }
2295         saverr = 0;
2296         if (ret == 0) {
2297             goto out;
2298         }
2299
2300         fuse_reply_buf(req, value, ret);
2301     } else {
2302         ret = flistxattr(fd, NULL, 0);
2303         if (ret == -1) {
2304             goto out_err;
2305         }
2306
2307         fuse_reply_xattr(req, ret);
2308     }
2309 out_free:
2310     free(value);
2311
2312     if (fd >= 0) {
2313         close(fd);
2314     }
2315
2316     lo_inode_put(lo, &inode);
2317     return;
2318
2319 out_err:
2320     saverr = errno;
2321 out:
2322     lo_inode_put(lo, &inode);
2323     fuse_reply_err(req, saverr);
2324     goto out_free;
2325 }
2326
2327 static void lo_setxattr(fuse_req_t req, fuse_ino_t ino, const char *name,
2328                         const char *value, size_t size, int flags)
2329 {
2330     char procname[64];
2331     struct lo_data *lo = lo_data(req);
2332     struct lo_inode *inode;
2333     ssize_t ret;
2334     int saverr;
2335     int fd = -1;
2336
2337     inode = lo_inode(req, ino);
2338     if (!inode) {
2339         fuse_reply_err(req, EBADF);
2340         return;
2341     }
2342
2343     saverr = ENOSYS;
2344     if (!lo_data(req)->xattr) {
2345         goto out;
2346     }
2347
2348     fuse_log(FUSE_LOG_DEBUG, "lo_setxattr(ino=%" PRIu64
2349              ", name=%s value=%s size=%zd)\n", ino, name, value, size);
2350
2351     if (inode->is_symlink) {
2352         /* Sorry, no race free way to setxattr on symlink. */
2353         saverr = EPERM;
2354         goto out;
2355     }
2356
2357     sprintf(procname, "%i", inode->fd);
2358     fd = openat(lo->proc_self_fd, procname, O_RDWR);
2359     if (fd < 0) {
2360         saverr = errno;
2361         goto out;
2362     }
2363
2364     ret = fsetxattr(fd, name, value, size, flags);
2365     saverr = ret == -1 ? errno : 0;
2366
2367 out:
2368     if (fd >= 0) {
2369         close(fd);
2370     }
2371
2372     lo_inode_put(lo, &inode);
2373     fuse_reply_err(req, saverr);
2374 }
2375
2376 static void lo_removexattr(fuse_req_t req, fuse_ino_t ino, const char *name)
2377 {
2378     char procname[64];
2379     struct lo_data *lo = lo_data(req);
2380     struct lo_inode *inode;
2381     ssize_t ret;
2382     int saverr;
2383     int fd = -1;
2384
2385     inode = lo_inode(req, ino);
2386     if (!inode) {
2387         fuse_reply_err(req, EBADF);
2388         return;
2389     }
2390
2391     saverr = ENOSYS;
2392     if (!lo_data(req)->xattr) {
2393         goto out;
2394     }
2395
2396     fuse_log(FUSE_LOG_DEBUG, "lo_removexattr(ino=%" PRIu64 ", name=%s)\n", ino,
2397              name);
2398
2399     if (inode->is_symlink) {
2400         /* Sorry, no race free way to setxattr on symlink. */
2401         saverr = EPERM;
2402         goto out;
2403     }
2404
2405     sprintf(procname, "%i", inode->fd);
2406     fd = openat(lo->proc_self_fd, procname, O_RDWR);
2407     if (fd < 0) {
2408         saverr = errno;
2409         goto out;
2410     }
2411
2412     ret = fremovexattr(fd, name);
2413     saverr = ret == -1 ? errno : 0;
2414
2415 out:
2416     if (fd >= 0) {
2417         close(fd);
2418     }
2419
2420     lo_inode_put(lo, &inode);
2421     fuse_reply_err(req, saverr);
2422 }
2423
2424 #ifdef HAVE_COPY_FILE_RANGE
2425 static void lo_copy_file_range(fuse_req_t req, fuse_ino_t ino_in, off_t off_in,
2426                                struct fuse_file_info *fi_in, fuse_ino_t ino_out,
2427                                off_t off_out, struct fuse_file_info *fi_out,
2428                                size_t len, int flags)
2429 {
2430     int in_fd, out_fd;
2431     ssize_t res;
2432
2433     in_fd = lo_fi_fd(req, fi_in);
2434     out_fd = lo_fi_fd(req, fi_out);
2435
2436     fuse_log(FUSE_LOG_DEBUG,
2437              "lo_copy_file_range(ino=%" PRIu64 "/fd=%d, "
2438              "off=%lu, ino=%" PRIu64 "/fd=%d, "
2439              "off=%lu, size=%zd, flags=0x%x)\n",
2440              ino_in, in_fd, off_in, ino_out, out_fd, off_out, len, flags);
2441
2442     res = copy_file_range(in_fd, &off_in, out_fd, &off_out, len, flags);
2443     if (res < 0) {
2444         fuse_reply_err(req, -errno);
2445     } else {
2446         fuse_reply_write(req, res);
2447     }
2448 }
2449 #endif
2450
2451 static void lo_lseek(fuse_req_t req, fuse_ino_t ino, off_t off, int whence,
2452                      struct fuse_file_info *fi)
2453 {
2454     off_t res;
2455
2456     (void)ino;
2457     res = lseek(lo_fi_fd(req, fi), off, whence);
2458     if (res != -1) {
2459         fuse_reply_lseek(req, res);
2460     } else {
2461         fuse_reply_err(req, errno);
2462     }
2463 }
2464
2465 static void lo_destroy(void *userdata)
2466 {
2467     struct lo_data *lo = (struct lo_data *)userdata;
2468
2469     pthread_mutex_lock(&lo->mutex);
2470     while (true) {
2471         GHashTableIter iter;
2472         gpointer key, value;
2473
2474         g_hash_table_iter_init(&iter, lo->inodes);
2475         if (!g_hash_table_iter_next(&iter, &key, &value)) {
2476             break;
2477         }
2478
2479         struct lo_inode *inode = value;
2480         unref_inode(lo, inode, inode->nlookup);
2481     }
2482     pthread_mutex_unlock(&lo->mutex);
2483 }
2484
2485 static struct fuse_lowlevel_ops lo_oper = {
2486     .init = lo_init,
2487     .lookup = lo_lookup,
2488     .mkdir = lo_mkdir,
2489     .mknod = lo_mknod,
2490     .symlink = lo_symlink,
2491     .link = lo_link,
2492     .unlink = lo_unlink,
2493     .rmdir = lo_rmdir,
2494     .rename = lo_rename,
2495     .forget = lo_forget,
2496     .forget_multi = lo_forget_multi,
2497     .getattr = lo_getattr,
2498     .setattr = lo_setattr,
2499     .readlink = lo_readlink,
2500     .opendir = lo_opendir,
2501     .readdir = lo_readdir,
2502     .readdirplus = lo_readdirplus,
2503     .releasedir = lo_releasedir,
2504     .fsyncdir = lo_fsyncdir,
2505     .create = lo_create,
2506     .getlk = lo_getlk,
2507     .setlk = lo_setlk,
2508     .open = lo_open,
2509     .release = lo_release,
2510     .flush = lo_flush,
2511     .fsync = lo_fsync,
2512     .read = lo_read,
2513     .write_buf = lo_write_buf,
2514     .statfs = lo_statfs,
2515     .fallocate = lo_fallocate,
2516     .flock = lo_flock,
2517     .getxattr = lo_getxattr,
2518     .listxattr = lo_listxattr,
2519     .setxattr = lo_setxattr,
2520     .removexattr = lo_removexattr,
2521 #ifdef HAVE_COPY_FILE_RANGE
2522     .copy_file_range = lo_copy_file_range,
2523 #endif
2524     .lseek = lo_lseek,
2525     .destroy = lo_destroy,
2526 };
2527
2528 /* Print vhost-user.json backend program capabilities */
2529 static void print_capabilities(void)
2530 {
2531     printf("{\n");
2532     printf("  \"type\": \"fs\"\n");
2533     printf("}\n");
2534 }
2535
2536 /*
2537  * Move to a new mount, net, and pid namespaces to isolate this process.
2538  */
2539 static void setup_namespaces(struct lo_data *lo, struct fuse_session *se)
2540 {
2541     pid_t child;
2542
2543     /*
2544      * Create a new pid namespace for *child* processes.  We'll have to
2545      * fork in order to enter the new pid namespace.  A new mount namespace
2546      * is also needed so that we can remount /proc for the new pid
2547      * namespace.
2548      *
2549      * Our UNIX domain sockets have been created.  Now we can move to
2550      * an empty network namespace to prevent TCP/IP and other network
2551      * activity in case this process is compromised.
2552      */
2553     if (unshare(CLONE_NEWPID | CLONE_NEWNS | CLONE_NEWNET) != 0) {
2554         fuse_log(FUSE_LOG_ERR, "unshare(CLONE_NEWPID | CLONE_NEWNS): %m\n");
2555         exit(1);
2556     }
2557
2558     child = fork();
2559     if (child < 0) {
2560         fuse_log(FUSE_LOG_ERR, "fork() failed: %m\n");
2561         exit(1);
2562     }
2563     if (child > 0) {
2564         pid_t waited;
2565         int wstatus;
2566
2567         /* The parent waits for the child */
2568         do {
2569             waited = waitpid(child, &wstatus, 0);
2570         } while (waited < 0 && errno == EINTR && !se->exited);
2571
2572         /* We were terminated by a signal, see fuse_signals.c */
2573         if (se->exited) {
2574             exit(0);
2575         }
2576
2577         if (WIFEXITED(wstatus)) {
2578             exit(WEXITSTATUS(wstatus));
2579         }
2580
2581         exit(1);
2582     }
2583
2584     /* Send us SIGTERM when the parent thread terminates, see prctl(2) */
2585     prctl(PR_SET_PDEATHSIG, SIGTERM);
2586
2587     /*
2588      * If the mounts have shared propagation then we want to opt out so our
2589      * mount changes don't affect the parent mount namespace.
2590      */
2591     if (mount(NULL, "/", NULL, MS_REC | MS_SLAVE, NULL) < 0) {
2592         fuse_log(FUSE_LOG_ERR, "mount(/, MS_REC|MS_SLAVE): %m\n");
2593         exit(1);
2594     }
2595
2596     /* The child must remount /proc to use the new pid namespace */
2597     if (mount("proc", "/proc", "proc",
2598               MS_NODEV | MS_NOEXEC | MS_NOSUID | MS_RELATIME, NULL) < 0) {
2599         fuse_log(FUSE_LOG_ERR, "mount(/proc): %m\n");
2600         exit(1);
2601     }
2602
2603     /* Now we can get our /proc/self/fd directory file descriptor */
2604     lo->proc_self_fd = open("/proc/self/fd", O_PATH);
2605     if (lo->proc_self_fd == -1) {
2606         fuse_log(FUSE_LOG_ERR, "open(/proc/self/fd, O_PATH): %m\n");
2607         exit(1);
2608     }
2609 }
2610
2611 /*
2612  * Capture the capability state, we'll need to restore this for individual
2613  * threads later; see load_capng.
2614  */
2615 static void setup_capng(void)
2616 {
2617     /* Note this accesses /proc so has to happen before the sandbox */
2618     if (capng_get_caps_process()) {
2619         fuse_log(FUSE_LOG_ERR, "capng_get_caps_process\n");
2620         exit(1);
2621     }
2622     pthread_mutex_init(&cap.mutex, NULL);
2623     pthread_mutex_lock(&cap.mutex);
2624     cap.saved = capng_save_state();
2625     if (!cap.saved) {
2626         fuse_log(FUSE_LOG_ERR, "capng_save_state\n");
2627         exit(1);
2628     }
2629     pthread_mutex_unlock(&cap.mutex);
2630 }
2631
2632 static void cleanup_capng(void)
2633 {
2634     free(cap.saved);
2635     cap.saved = NULL;
2636     pthread_mutex_destroy(&cap.mutex);
2637 }
2638
2639
2640 /*
2641  * Make the source directory our root so symlinks cannot escape and no other
2642  * files are accessible.  Assumes unshare(CLONE_NEWNS) was already called.
2643  */
2644 static void setup_mounts(const char *source)
2645 {
2646     int oldroot;
2647     int newroot;
2648
2649     if (mount(source, source, NULL, MS_BIND, NULL) < 0) {
2650         fuse_log(FUSE_LOG_ERR, "mount(%s, %s, MS_BIND): %m\n", source, source);
2651         exit(1);
2652     }
2653
2654     /* This magic is based on lxc's lxc_pivot_root() */
2655     oldroot = open("/", O_DIRECTORY | O_RDONLY | O_CLOEXEC);
2656     if (oldroot < 0) {
2657         fuse_log(FUSE_LOG_ERR, "open(/): %m\n");
2658         exit(1);
2659     }
2660
2661     newroot = open(source, O_DIRECTORY | O_RDONLY | O_CLOEXEC);
2662     if (newroot < 0) {
2663         fuse_log(FUSE_LOG_ERR, "open(%s): %m\n", source);
2664         exit(1);
2665     }
2666
2667     if (fchdir(newroot) < 0) {
2668         fuse_log(FUSE_LOG_ERR, "fchdir(newroot): %m\n");
2669         exit(1);
2670     }
2671
2672     if (syscall(__NR_pivot_root, ".", ".") < 0) {
2673         fuse_log(FUSE_LOG_ERR, "pivot_root(., .): %m\n");
2674         exit(1);
2675     }
2676
2677     if (fchdir(oldroot) < 0) {
2678         fuse_log(FUSE_LOG_ERR, "fchdir(oldroot): %m\n");
2679         exit(1);
2680     }
2681
2682     if (mount("", ".", "", MS_SLAVE | MS_REC, NULL) < 0) {
2683         fuse_log(FUSE_LOG_ERR, "mount(., MS_SLAVE | MS_REC): %m\n");
2684         exit(1);
2685     }
2686
2687     if (umount2(".", MNT_DETACH) < 0) {
2688         fuse_log(FUSE_LOG_ERR, "umount2(., MNT_DETACH): %m\n");
2689         exit(1);
2690     }
2691
2692     if (fchdir(newroot) < 0) {
2693         fuse_log(FUSE_LOG_ERR, "fchdir(newroot): %m\n");
2694         exit(1);
2695     }
2696
2697     close(newroot);
2698     close(oldroot);
2699 }
2700
2701 /*
2702  * Lock down this process to prevent access to other processes or files outside
2703  * source directory.  This reduces the impact of arbitrary code execution bugs.
2704  */
2705 static void setup_sandbox(struct lo_data *lo, struct fuse_session *se,
2706                           bool enable_syslog)
2707 {
2708     setup_namespaces(lo, se);
2709     setup_mounts(lo->source);
2710     setup_seccomp(enable_syslog);
2711 }
2712
2713 /* Raise the maximum number of open file descriptors */
2714 static void setup_nofile_rlimit(void)
2715 {
2716     const rlim_t max_fds = 1000000;
2717     struct rlimit rlim;
2718
2719     if (getrlimit(RLIMIT_NOFILE, &rlim) < 0) {
2720         fuse_log(FUSE_LOG_ERR, "getrlimit(RLIMIT_NOFILE): %m\n");
2721         exit(1);
2722     }
2723
2724     if (rlim.rlim_cur >= max_fds) {
2725         return; /* nothing to do */
2726     }
2727
2728     rlim.rlim_cur = max_fds;
2729     rlim.rlim_max = max_fds;
2730
2731     if (setrlimit(RLIMIT_NOFILE, &rlim) < 0) {
2732         /* Ignore SELinux denials */
2733         if (errno == EPERM) {
2734             return;
2735         }
2736
2737         fuse_log(FUSE_LOG_ERR, "setrlimit(RLIMIT_NOFILE): %m\n");
2738         exit(1);
2739     }
2740 }
2741
2742 static void log_func(enum fuse_log_level level, const char *fmt, va_list ap)
2743 {
2744     g_autofree char *localfmt = NULL;
2745
2746     if (current_log_level < level) {
2747         return;
2748     }
2749
2750     if (current_log_level == FUSE_LOG_DEBUG) {
2751         if (!use_syslog) {
2752             localfmt = g_strdup_printf("[%" PRId64 "] [ID: %08ld] %s",
2753                                        get_clock(), syscall(__NR_gettid), fmt);
2754         } else {
2755             localfmt = g_strdup_printf("[ID: %08ld] %s", syscall(__NR_gettid),
2756                                        fmt);
2757         }
2758         fmt = localfmt;
2759     }
2760
2761     if (use_syslog) {
2762         int priority = LOG_ERR;
2763         switch (level) {
2764         case FUSE_LOG_EMERG:
2765             priority = LOG_EMERG;
2766             break;
2767         case FUSE_LOG_ALERT:
2768             priority = LOG_ALERT;
2769             break;
2770         case FUSE_LOG_CRIT:
2771             priority = LOG_CRIT;
2772             break;
2773         case FUSE_LOG_ERR:
2774             priority = LOG_ERR;
2775             break;
2776         case FUSE_LOG_WARNING:
2777             priority = LOG_WARNING;
2778             break;
2779         case FUSE_LOG_NOTICE:
2780             priority = LOG_NOTICE;
2781             break;
2782         case FUSE_LOG_INFO:
2783             priority = LOG_INFO;
2784             break;
2785         case FUSE_LOG_DEBUG:
2786             priority = LOG_DEBUG;
2787             break;
2788         }
2789         vsyslog(priority, fmt, ap);
2790     } else {
2791         vfprintf(stderr, fmt, ap);
2792     }
2793 }
2794
2795 static void setup_root(struct lo_data *lo, struct lo_inode *root)
2796 {
2797     int fd, res;
2798     struct stat stat;
2799
2800     fd = open("/", O_PATH);
2801     if (fd == -1) {
2802         fuse_log(FUSE_LOG_ERR, "open(%s, O_PATH): %m\n", lo->source);
2803         exit(1);
2804     }
2805
2806     res = fstatat(fd, "", &stat, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
2807     if (res == -1) {
2808         fuse_log(FUSE_LOG_ERR, "fstatat(%s): %m\n", lo->source);
2809         exit(1);
2810     }
2811
2812     root->is_symlink = false;
2813     root->fd = fd;
2814     root->key.ino = stat.st_ino;
2815     root->key.dev = stat.st_dev;
2816     root->nlookup = 2;
2817     g_atomic_int_set(&root->refcount, 2);
2818 }
2819
2820 static guint lo_key_hash(gconstpointer key)
2821 {
2822     const struct lo_key *lkey = key;
2823
2824     return (guint)lkey->ino + (guint)lkey->dev;
2825 }
2826
2827 static gboolean lo_key_equal(gconstpointer a, gconstpointer b)
2828 {
2829     const struct lo_key *la = a;
2830     const struct lo_key *lb = b;
2831
2832     return la->ino == lb->ino && la->dev == lb->dev;
2833 }
2834
2835 static void fuse_lo_data_cleanup(struct lo_data *lo)
2836 {
2837     if (lo->inodes) {
2838         g_hash_table_destroy(lo->inodes);
2839     }
2840     lo_map_destroy(&lo->fd_map);
2841     lo_map_destroy(&lo->dirp_map);
2842     lo_map_destroy(&lo->ino_map);
2843
2844     if (lo->proc_self_fd >= 0) {
2845         close(lo->proc_self_fd);
2846     }
2847
2848     if (lo->root.fd >= 0) {
2849         close(lo->root.fd);
2850     }
2851
2852     free(lo->source);
2853 }
2854
2855 int main(int argc, char *argv[])
2856 {
2857     struct fuse_args args = FUSE_ARGS_INIT(argc, argv);
2858     struct fuse_session *se;
2859     struct fuse_cmdline_opts opts;
2860     struct lo_data lo = {
2861         .debug = 0,
2862         .writeback = 0,
2863         .posix_lock = 1,
2864         .proc_self_fd = -1,
2865     };
2866     struct lo_map_elem *root_elem;
2867     int ret = -1;
2868
2869     /* Don't mask creation mode, kernel already did that */
2870     umask(0);
2871
2872     pthread_mutex_init(&lo.mutex, NULL);
2873     lo.inodes = g_hash_table_new(lo_key_hash, lo_key_equal);
2874     lo.root.fd = -1;
2875     lo.root.fuse_ino = FUSE_ROOT_ID;
2876     lo.cache = CACHE_AUTO;
2877
2878     /*
2879      * Set up the ino map like this:
2880      * [0] Reserved (will not be used)
2881      * [1] Root inode
2882      */
2883     lo_map_init(&lo.ino_map);
2884     lo_map_reserve(&lo.ino_map, 0)->in_use = false;
2885     root_elem = lo_map_reserve(&lo.ino_map, lo.root.fuse_ino);
2886     root_elem->inode = &lo.root;
2887
2888     lo_map_init(&lo.dirp_map);
2889     lo_map_init(&lo.fd_map);
2890
2891     if (fuse_parse_cmdline(&args, &opts) != 0) {
2892         goto err_out1;
2893     }
2894     fuse_set_log_func(log_func);
2895     use_syslog = opts.syslog;
2896     if (use_syslog) {
2897         openlog("virtiofsd", LOG_PID, LOG_DAEMON);
2898     }
2899
2900     if (opts.show_help) {
2901         printf("usage: %s [options]\n\n", argv[0]);
2902         fuse_cmdline_help();
2903         printf("    -o source=PATH             shared directory tree\n");
2904         fuse_lowlevel_help();
2905         ret = 0;
2906         goto err_out1;
2907     } else if (opts.show_version) {
2908         fuse_lowlevel_version();
2909         ret = 0;
2910         goto err_out1;
2911     } else if (opts.print_capabilities) {
2912         print_capabilities();
2913         ret = 0;
2914         goto err_out1;
2915     }
2916
2917     if (fuse_opt_parse(&args, &lo, lo_opts, NULL) == -1) {
2918         goto err_out1;
2919     }
2920
2921     /*
2922      * log_level is 0 if not configured via cmd options (0 is LOG_EMERG,
2923      * and we don't use this log level).
2924      */
2925     if (opts.log_level != 0) {
2926         current_log_level = opts.log_level;
2927     }
2928     lo.debug = opts.debug;
2929     if (lo.debug) {
2930         current_log_level = FUSE_LOG_DEBUG;
2931     }
2932     if (lo.source) {
2933         struct stat stat;
2934         int res;
2935
2936         res = lstat(lo.source, &stat);
2937         if (res == -1) {
2938             fuse_log(FUSE_LOG_ERR, "failed to stat source (\"%s\"): %m\n",
2939                      lo.source);
2940             exit(1);
2941         }
2942         if (!S_ISDIR(stat.st_mode)) {
2943             fuse_log(FUSE_LOG_ERR, "source is not a directory\n");
2944             exit(1);
2945         }
2946     } else {
2947         lo.source = strdup("/");
2948     }
2949     if (!lo.timeout_set) {
2950         switch (lo.cache) {
2951         case CACHE_NONE:
2952             lo.timeout = 0.0;
2953             break;
2954
2955         case CACHE_AUTO:
2956             lo.timeout = 1.0;
2957             break;
2958
2959         case CACHE_ALWAYS:
2960             lo.timeout = 86400.0;
2961             break;
2962         }
2963     } else if (lo.timeout < 0) {
2964         fuse_log(FUSE_LOG_ERR, "timeout is negative (%lf)\n", lo.timeout);
2965         exit(1);
2966     }
2967
2968     se = fuse_session_new(&args, &lo_oper, sizeof(lo_oper), &lo);
2969     if (se == NULL) {
2970         goto err_out1;
2971     }
2972
2973     if (fuse_set_signal_handlers(se) != 0) {
2974         goto err_out2;
2975     }
2976
2977     if (fuse_session_mount(se) != 0) {
2978         goto err_out3;
2979     }
2980
2981     fuse_daemonize(opts.foreground);
2982
2983     setup_nofile_rlimit();
2984
2985     /* Must be before sandbox since it wants /proc */
2986     setup_capng();
2987
2988     setup_sandbox(&lo, se, opts.syslog);
2989
2990     setup_root(&lo, &lo.root);
2991     /* Block until ctrl+c or fusermount -u */
2992     ret = virtio_loop(se);
2993
2994     fuse_session_unmount(se);
2995     cleanup_capng();
2996 err_out3:
2997     fuse_remove_signal_handlers(se);
2998 err_out2:
2999     fuse_session_destroy(se);
3000 err_out1:
3001     fuse_opt_free_args(&args);
3002
3003     fuse_lo_data_cleanup(&lo);
3004
3005     return ret ? 1 : 0;
3006 }