From nobody Mon Feb 9 06:50:18 2026 Received: from smtp-relay-internal-0.canonical.com (smtp-relay-internal-0.canonical.com [185.125.188.122]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C7E4A1B3F26 for ; Wed, 14 Aug 2024 11:41:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.125.188.122 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1723635685; cv=none; b=tECSlo/uOnkQbmInQzDHl5jtH+yGckw95cIUMaqQBn+XDBbOPbvezujuTnb5IhEXAE+HFqsrvZhWTkBWsLB7vSF2PvohG/Ba4JVnjVKG/tFcpbuTNkRw9dvapmLNr6tgPKiNYCHzp3Mf3lcIoAGXbmLB1Q8+8GaMhQyX7ehSaaU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1723635685; c=relaxed/simple; bh=3sKR5heXsN3+PDmKkyp9ATdAOr7cyhuezAbCen+o5+Y=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=tiePiVK8Bk3s9gV4F1VPfp3l6HImYuKUhuxhaATi5RBP12CVM8YfxjXZP4ZI/KdhBHI5h5CEOqo7ticTJwyabowc/0vumcYTik//8DTO5Y85zhsmSp8WT/PY16//avBEzM3DRdXvCEQEnh4jG6mbzkgyUg6yexwCDgo7GzeBsdI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=canonical.com; spf=pass smtp.mailfrom=canonical.com; dkim=pass (2048-bit key) header.d=canonical.com header.i=@canonical.com header.b=n2yyGUrO; arc=none smtp.client-ip=185.125.188.122 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=canonical.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=canonical.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=canonical.com header.i=@canonical.com header.b="n2yyGUrO" Received: from mail-ed1-f71.google.com (mail-ed1-f71.google.com [209.85.208.71]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 3B7D93F670 for ; Wed, 14 Aug 2024 11:41:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1723635682; bh=m96HZWLn8OKWP/L3it/bQmtO6VIcFcKI507cIhh46m0=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=n2yyGUrO1q4hgX6FjiqQpkHG23CAwCAuBtVRDoSPss2LEnj/vFxyBX2qMP2yQEqdz /AwPYoTcb0pXs1AB71nKId7XUk+xSrs2ovTaMD5f7PINtQYIk3Y5b797gqxn6eJXz3 SzMYZ0BPtt3H+k8MIH+5xgLo5MO588vPxHacooE8opH69p6Cb4mCQ2h+jk34NpgYvx iij70I/pZ6Drdfty1D/yG25RWDQqu4eAU1fqp1+BsxsIl3CnAyyq5T6SE2A92j6HCW hn+vZQNZH3lBTnVoUEkTLYgsjwRWoeBZ4Yn8UGufJMKERkarkxmKEsHiMk/BF4xdsk vcfc+eOv9BQ/g== Received: by mail-ed1-f71.google.com with SMTP id 4fb4d7f45d1cf-5a74845546bso5710329a12.2 for ; Wed, 14 Aug 2024 04:41:22 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1723635682; x=1724240482; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=m96HZWLn8OKWP/L3it/bQmtO6VIcFcKI507cIhh46m0=; b=XqdVcrYo0B1YRjl2E/jIs6xt4XMc3d88yAmp2qIZYyDf/eG+A1ISIxHr2oveupsvQH dnR3oDPF2odEAi4ERTsSCoZIgaS0r/HRz1eCaNKDmcc3cjbJIhV1+D+yjNezwOF8ltIv wJxOC23ENSBjwOrMODe8ByA+qc2GMO+bUZOl1ke5lwyEEclskD2VsFqIEzy+EyGJfgW2 0MLmwH0CeXADyxKgmh5qINODs0HFz+6s9zrXPKD0vUkE13080BtlBg1sk4nPbkuWefo7 LSppiuyRKbWmvhn0Bj1lwX1YEPhGQwET7rM+wLcCmMyIT0YT/6/9/eWJSXUHHJB6JG3D wCtA== X-Forwarded-Encrypted: i=1; AJvYcCV7St1KZ8zq3h9aKAZhDpcv4EnUZr7ofOINspT2si/1mo84cXQ1ELFtCks6P0wBl9QiBGds/qa814l0yZoeKkjlNsxRBuqb8R/yq2Ct X-Gm-Message-State: AOJu0YyWOg2H5DFocp/K7h2OW+Ynu5fMLrRqQMzE7P89BwOpfAeEqyZp a+vQq+7RH8vebC8cYqu83Fh0KKaifYxvgRqNjKKqfA0Id8LoGFdV1ZzUfFuzDGmNc7xu0ROKCWk yundPggNpFQuvNQd1h/6bi9l0/odWFJYAzIReeUmlVcaM4oSkXP+8j5sKL6u5/gE5VLY9frCaCl Hh9w== X-Received: by 2002:a17:907:e6e9:b0:a7a:bae8:f292 with SMTP id a640c23a62f3a-a8366d5d5bfmr158202666b.41.1723635681727; Wed, 14 Aug 2024 04:41:21 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGlthGC9YqBA7AhyDAumby6ziF6nCxsMV3VHlphvXCxY4n73dzJQ2uZULnAELI07tonD3Wd3A== X-Received: by 2002:a17:907:e6e9:b0:a7a:bae8:f292 with SMTP id a640c23a62f3a-a8366d5d5bfmr158200266b.41.1723635681200; Wed, 14 Aug 2024 04:41:21 -0700 (PDT) Received: from amikhalitsyn.. ([188.192.113.77]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-a80f3fa782csm162586166b.60.2024.08.14.04.41.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Aug 2024 04:41:20 -0700 (PDT) From: Alexander Mikhalitsyn To: mszeredi@redhat.com Cc: brauner@kernel.org, stgraber@stgraber.org, linux-fsdevel@vger.kernel.org, Miklos Szeredi , Seth Forshee , Amir Goldstein , Bernd Schubert , Alexander Mikhalitsyn , linux-kernel@vger.kernel.org Subject: [PATCH v2 1/9] fs/fuse: add FUSE_OWNER_UID_GID_EXT extension Date: Wed, 14 Aug 2024 13:40:26 +0200 Message-Id: <20240814114034.113953-2-aleksandr.mikhalitsyn@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240814114034.113953-1-aleksandr.mikhalitsyn@canonical.com> References: <20240814114034.113953-1-aleksandr.mikhalitsyn@canonical.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" To properly support vfs idmappings we need to provide a fuse daemon with the correct owner uid/gid for inode creation requests like mkdir, mknod, atomic_open, symlink. Right now, fuse daemons use req->in.h.uid/req->in.h.gid to set inode owner. These fields contain fsuid/fsgid of the syscall's caller. And that's perfectly fine, because inode owner have to be set to these values. But, for idmapped mounts it's not the case and caller fsuid/fsgid !=3D inode owner, because idmapped mounts do nothing with the caller fsuid/fsgid, but affect inode owner uid/gid. It means that we can't apply vfsid mapping to caller fsuid/fsgid, but instead we have to introduce a new fields to store inode owner uid/gid which will be appropriately transformed. Christian and I have done the same to support idmapped mounts in the cephfs recently [1]. [1] 5ccd8530 ("ceph: handle idmapped mounts in create_request_message()") Cc: Miklos Szeredi Cc: Christian Brauner Cc: Seth Forshee Cc: Amir Goldstein Cc: Bernd Schubert Cc: Signed-off-by: Alexander Mikhalitsyn --- fs/fuse/dir.c | 34 +++++++++++++++++++++++++++++++--- fs/fuse/fuse_i.h | 3 +++ fs/fuse/inode.c | 4 +++- include/uapi/linux/fuse.h | 19 +++++++++++++++++++ 4 files changed, 56 insertions(+), 4 deletions(-) diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c index 2b0d4781f394..30d27d4f3b5a 100644 --- a/fs/fuse/dir.c +++ b/fs/fuse/dir.c @@ -572,7 +572,33 @@ static int get_create_supp_group(struct inode *dir, st= ruct fuse_in_arg *ext) return 0; } =20 -static int get_create_ext(struct fuse_args *args, +static int get_owner_uid_gid(struct mnt_idmap *idmap, struct fuse_conn *fc= , struct fuse_in_arg *ext) +{ + struct fuse_ext_header *xh; + struct fuse_owner_uid_gid *owner_creds; + u32 owner_creds_len =3D fuse_ext_size(sizeof(*owner_creds)); + kuid_t owner_fsuid; + kgid_t owner_fsgid; + + xh =3D extend_arg(ext, owner_creds_len); + if (!xh) + return -ENOMEM; + + xh->size =3D owner_creds_len; + xh->type =3D FUSE_EXT_OWNER_UID_GID; + + owner_creds =3D (struct fuse_owner_uid_gid *) &xh[1]; + + owner_fsuid =3D mapped_fsuid(idmap, fc->user_ns); + owner_fsgid =3D mapped_fsgid(idmap, fc->user_ns); + owner_creds->uid =3D from_kuid(fc->user_ns, owner_fsuid); + owner_creds->gid =3D from_kgid(fc->user_ns, owner_fsgid); + + return 0; +} + +static int get_create_ext(struct mnt_idmap *idmap, + struct fuse_args *args, struct inode *dir, struct dentry *dentry, umode_t mode) { @@ -584,6 +610,8 @@ static int get_create_ext(struct fuse_args *args, err =3D get_security_context(dentry, mode, &ext); if (!err && fc->create_supp_group) err =3D get_create_supp_group(dir, &ext); + if (!err && fc->owner_uid_gid_ext) + err =3D get_owner_uid_gid(idmap, fc, &ext); =20 if (!err && ext.size) { WARN_ON(args->in_numargs >=3D ARRAY_SIZE(args->in_args)); @@ -668,7 +696,7 @@ static int fuse_create_open(struct inode *dir, struct d= entry *entry, args.out_args[1].size =3D sizeof(*outopenp); args.out_args[1].value =3D outopenp; =20 - err =3D get_create_ext(&args, dir, entry, mode); + err =3D get_create_ext(&nop_mnt_idmap, &args, dir, entry, mode); if (err) goto out_put_forget_req; =20 @@ -798,7 +826,7 @@ static int create_new_entry(struct fuse_mount *fm, stru= ct fuse_args *args, args->out_args[0].value =3D &outarg; =20 if (args->opcode !=3D FUSE_LINK) { - err =3D get_create_ext(args, dir, entry, mode); + err =3D get_create_ext(&nop_mnt_idmap, args, dir, entry, mode); if (err) goto out_put_forget_req; } diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h index f23919610313..d06934e70cc5 100644 --- a/fs/fuse/fuse_i.h +++ b/fs/fuse/fuse_i.h @@ -845,6 +845,9 @@ struct fuse_conn { /* Add supplementary group info when creating a new inode */ unsigned int create_supp_group:1; =20 + /* Add owner_{u,g}id info when creating a new inode */ + unsigned int owner_uid_gid_ext:1; + /* Does the filesystem support per inode DAX? */ unsigned int inode_dax:1; =20 diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c index d8ab4e93916f..6c205731c844 100644 --- a/fs/fuse/inode.c +++ b/fs/fuse/inode.c @@ -1343,6 +1343,8 @@ static void process_init_reply(struct fuse_mount *fm,= struct fuse_args *args, } if (flags & FUSE_NO_EXPORT_SUPPORT) fm->sb->s_export_op =3D &fuse_export_fid_operations; + if (flags & FUSE_OWNER_UID_GID_EXT) + fc->owner_uid_gid_ext =3D 1; } else { ra_pages =3D fc->max_read / PAGE_SIZE; fc->no_lock =3D 1; @@ -1390,7 +1392,7 @@ void fuse_send_init(struct fuse_mount *fm) FUSE_HANDLE_KILLPRIV_V2 | FUSE_SETXATTR_EXT | FUSE_INIT_EXT | FUSE_SECURITY_CTX | FUSE_CREATE_SUPP_GROUP | FUSE_HAS_EXPIRE_ONLY | FUSE_DIRECT_IO_ALLOW_MMAP | - FUSE_NO_EXPORT_SUPPORT | FUSE_HAS_RESEND; + FUSE_NO_EXPORT_SUPPORT | FUSE_HAS_RESEND | FUSE_OWNER_UID_GID_EXT; #ifdef CONFIG_FUSE_DAX if (fm->fc->dax) flags |=3D FUSE_MAP_ALIGNMENT; diff --git a/include/uapi/linux/fuse.h b/include/uapi/linux/fuse.h index d08b99d60f6f..d9ecc17fd13b 100644 --- a/include/uapi/linux/fuse.h +++ b/include/uapi/linux/fuse.h @@ -217,6 +217,10 @@ * - add backing_id to fuse_open_out, add FOPEN_PASSTHROUGH open flag * - add FUSE_NO_EXPORT_SUPPORT init flag * - add FUSE_NOTIFY_RESEND, add FUSE_HAS_RESEND init flag + * + * 7.41 + * - add FUSE_EXT_OWNER_UID_GID + * - add FUSE_OWNER_UID_GID_EXT */ =20 #ifndef _LINUX_FUSE_H @@ -421,6 +425,8 @@ struct fuse_file_lock { * FUSE_NO_EXPORT_SUPPORT: explicitly disable export support * FUSE_HAS_RESEND: kernel supports resending pending requests, and the hi= gh bit * of the request ID indicates resend requests + * FUSE_OWNER_UID_GID_EXT: add inode owner UID/GID info to create, mkdir, + * symlink and mknod */ #define FUSE_ASYNC_READ (1 << 0) #define FUSE_POSIX_LOCKS (1 << 1) @@ -466,6 +472,7 @@ struct fuse_file_lock { =20 /* Obsolete alias for FUSE_DIRECT_IO_ALLOW_MMAP */ #define FUSE_DIRECT_IO_RELAX FUSE_DIRECT_IO_ALLOW_MMAP +#define FUSE_OWNER_UID_GID_EXT (1ULL << 40) =20 /** * CUSE INIT request/reply flags @@ -575,11 +582,13 @@ struct fuse_file_lock { * extension type * FUSE_MAX_NR_SECCTX: maximum value of &fuse_secctx_header.nr_secctx * FUSE_EXT_GROUPS: &fuse_supp_groups extension + * FUSE_EXT_OWNER_UID_GID: &fuse_owner_uid_gid extension */ enum fuse_ext_type { /* Types 0..31 are reserved for fuse_secctx_header */ FUSE_MAX_NR_SECCTX =3D 31, FUSE_EXT_GROUPS =3D 32, + FUSE_EXT_OWNER_UID_GID =3D 33, }; =20 enum fuse_opcode { @@ -1186,4 +1195,14 @@ struct fuse_supp_groups { uint32_t groups[]; }; =20 +/** + * struct fuse_owner_uid_gid - Inode owner UID/GID extension + * @uid: inode owner UID + * @gid: inode owner GID + */ +struct fuse_owner_uid_gid { + uint32_t uid; + uint32_t gid; +}; + #endif /* _LINUX_FUSE_H */ --=20 2.34.1 From nobody Mon Feb 9 06:50:18 2026 Received: from smtp-relay-internal-0.canonical.com (smtp-relay-internal-0.canonical.com [185.125.188.122]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CBA5E1B4C23 for ; Wed, 14 Aug 2024 11:41:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.125.188.122 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1723635690; cv=none; b=Hc8GtTzsgiRZ7w/ODTSI6zKfm0seoNEaN1yqbzRjET7xG0iDxyIW8Uxy0jpGVEh14EaEt9fRJBWYRqUf9JFOlFDvDlI2m4Q1hR9uQM6qrlp6idX7lWZZPmI4F/Ju2Wh6q6ZGE33jm0t7fd4sRBSNGXdP95rigku73pUO7rS+RlU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1723635690; c=relaxed/simple; bh=4eTUDWhrEbeO6LacpkSTpWZsQS6mjvQhzRI0A/zxHU4=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=FYCx6rs771LhtI2xKi0PIgcMpU5PmkO1ZvGTXxHcXThCWm7XUtYcA4HaX2Gv2M3hKL8T+Fxu/tQNXqRpqy8GzSG5yBHd/40NUjmNNc/G8QZp2NHeEurk0plSSiMM293s5lV7XTPu6V75Xl9pLwPF71fBXr8jr3LUeNRm1YytZG8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=canonical.com; spf=pass smtp.mailfrom=canonical.com; dkim=pass (2048-bit key) header.d=canonical.com header.i=@canonical.com header.b=UqoZHq6z; arc=none smtp.client-ip=185.125.188.122 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=canonical.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=canonical.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=canonical.com header.i=@canonical.com header.b="UqoZHq6z" Received: from mail-ej1-f72.google.com (mail-ej1-f72.google.com [209.85.218.72]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 624174596C for ; Wed, 14 Aug 2024 11:41:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1723635685; bh=cuULsUu9z+BvalrO9+cGgsIucfP8fxo4BNYi78/zGSU=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=UqoZHq6zTGMAi6LaCTItI7q4lizIQQhQ87OCLeZBJfNRKL2TJbG4WnvlXiJkrR4+a RBOQd9Bip3O5PA2VeeWEA2HQSW2k3N822x5NMQPJez0AgIhlZ+HddzByXMVMmjlNYX juLM5fI+FqWXc8ycvm+n+4SM6mVcz2a6qtJNACgmTP538AYuPW8pgoDR/H1edJIn1Z V0lE6KNl4RCWC/1Hd5nEjvIiQXI2dxQe1aKVagoOfQM4R30W5T0/CvR0R29+zkQSr0 L/GUMUTaYO3p21SqSZ9Y32bjtgxv4eqjGFN+vEwp1iG14cziuKVf/F3vAAin3L/5RO cMFrjw/iKpRJw== Received: by mail-ej1-f72.google.com with SMTP id a640c23a62f3a-a7a8281dba5so545934566b.3 for ; Wed, 14 Aug 2024 04:41:25 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1723635685; x=1724240485; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=cuULsUu9z+BvalrO9+cGgsIucfP8fxo4BNYi78/zGSU=; b=VIAGkiHBLrYCs8pnIInaqJJqSy12stwt4P5H/o1qNr4DFNcwnkW782E9IUwRHJt1pj 9TlQWsgO6zp4DJJtQL4jf/SwuziwFYgPMm2yAUxEePXcczsHCBXloVCYpzN5Q5Ak2ryq G2f800V9cruYZk6OhaiDUlNtIQhA6hHVAmZ+WU9C2aMbA9kpcxWsv2znuMo4sTQornUT OfSxroH+q0Y46cyvuy6tggGo26FNx2dNyAo1i7VrvfPpDpmO+b18H8cxwo2jUVR5GarY ElnpYaMtwftgPoZlU+Zyqjepks6cvHuIbJjB9+dEGR2AjkolIPX06yN4SPbDtcQoqkvt O/Ww== X-Forwarded-Encrypted: i=1; AJvYcCVEzK2II0tNIqcBvaFMz+gczlDYuB/2mui2oLkRfzOAAPN5X8reN6Nr19vlzTrvSXpWBjnRXTcz/bImdG4fbegY+t70m5a6fAfFVUZf X-Gm-Message-State: AOJu0YzjCpUPLOR6B8WS4jkqU7V7tYksjT74IRgGruwABVGz6EgvRS0W AiidtQ9kZ02erhN+i85doEC8MXCiORKNacq83k1kwc6sXxH9wAF69mZBwHR7ZdJWpsIWspP8HtZ Cm6qLDky5VzZceryV3TJZrtzO2QJ0CcG055i9Grx4uFLRerFr7cmD/bOZiE1tkLPruNLxCE+S+z MGYg== X-Received: by 2002:a17:907:e257:b0:a77:e0ed:8c4 with SMTP id a640c23a62f3a-a8366c10d6emr161899266b.7.1723635684820; Wed, 14 Aug 2024 04:41:24 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGSJqi6p3D1QYD5zqxfrHLXoXcCcs9WXjsJL3AnIrFo/DOpEIxIBPJIbf9Ss6W7p94SVwH0Sg== X-Received: by 2002:a17:907:e257:b0:a77:e0ed:8c4 with SMTP id a640c23a62f3a-a8366c10d6emr161897366b.7.1723635684266; Wed, 14 Aug 2024 04:41:24 -0700 (PDT) Received: from amikhalitsyn.. ([188.192.113.77]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-a80f3fa782csm162586166b.60.2024.08.14.04.41.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Aug 2024 04:41:23 -0700 (PDT) From: Alexander Mikhalitsyn To: mszeredi@redhat.com Cc: brauner@kernel.org, stgraber@stgraber.org, linux-fsdevel@vger.kernel.org, Seth Forshee , Miklos Szeredi , Amir Goldstein , Bernd Schubert , Alexander Mikhalitsyn , linux-kernel@vger.kernel.org Subject: [PATCH v2 2/9] fs/fuse: support idmap for mkdir/mknod/symlink/create Date: Wed, 14 Aug 2024 13:40:27 +0200 Message-Id: <20240814114034.113953-3-aleksandr.mikhalitsyn@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240814114034.113953-1-aleksandr.mikhalitsyn@canonical.com> References: <20240814114034.113953-1-aleksandr.mikhalitsyn@canonical.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" We have all the infrastructure in place, we just need to pass an idmapping here. Cc: Christian Brauner Cc: Seth Forshee Cc: Miklos Szeredi Cc: Amir Goldstein Cc: Bernd Schubert Cc: Signed-off-by: Alexander Mikhalitsyn --- fs/fuse/dir.c | 33 +++++++++++++++++---------------- 1 file changed, 17 insertions(+), 16 deletions(-) diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c index 30d27d4f3b5a..1e45c6157af4 100644 --- a/fs/fuse/dir.c +++ b/fs/fuse/dir.c @@ -637,9 +637,9 @@ static void free_ext_value(struct fuse_args *args) * If the filesystem doesn't support this, then fall back to separate * 'mknod' + 'open' requests. */ -static int fuse_create_open(struct inode *dir, struct dentry *entry, - struct file *file, unsigned int flags, - umode_t mode, u32 opcode) +static int fuse_create_open(struct mnt_idmap *idmap, struct inode *dir, + struct dentry *entry, struct file *file, + unsigned int flags, umode_t mode, u32 opcode) { int err; struct inode *inode; @@ -696,7 +696,7 @@ static int fuse_create_open(struct inode *dir, struct d= entry *entry, args.out_args[1].size =3D sizeof(*outopenp); args.out_args[1].value =3D outopenp; =20 - err =3D get_create_ext(&nop_mnt_idmap, &args, dir, entry, mode); + err =3D get_create_ext(idmap, &args, dir, entry, mode); if (err) goto out_put_forget_req; =20 @@ -757,6 +757,7 @@ static int fuse_atomic_open(struct inode *dir, struct d= entry *entry, umode_t mode) { int err; + struct mnt_idmap *idmap =3D file_mnt_idmap(file); struct fuse_conn *fc =3D get_fuse_conn(dir); struct dentry *res =3D NULL; =20 @@ -781,7 +782,7 @@ static int fuse_atomic_open(struct inode *dir, struct d= entry *entry, if (fc->no_create) goto mknod; =20 - err =3D fuse_create_open(dir, entry, file, flags, mode, FUSE_CREATE); + err =3D fuse_create_open(idmap, dir, entry, file, flags, mode, FUSE_CREAT= E); if (err =3D=3D -ENOSYS) { fc->no_create =3D 1; goto mknod; @@ -792,7 +793,7 @@ static int fuse_atomic_open(struct inode *dir, struct d= entry *entry, return err; =20 mknod: - err =3D fuse_mknod(&nop_mnt_idmap, dir, entry, mode, 0); + err =3D fuse_mknod(idmap, dir, entry, mode, 0); if (err) goto out_dput; no_open: @@ -802,9 +803,9 @@ static int fuse_atomic_open(struct inode *dir, struct d= entry *entry, /* * Code shared between mknod, mkdir, symlink and link */ -static int create_new_entry(struct fuse_mount *fm, struct fuse_args *args, - struct inode *dir, struct dentry *entry, - umode_t mode) +static int create_new_entry(struct mnt_idmap *idmap, struct fuse_mount *fm, + struct fuse_args *args, struct inode *dir, + struct dentry *entry, umode_t mode) { struct fuse_entry_out outarg; struct inode *inode; @@ -826,7 +827,7 @@ static int create_new_entry(struct fuse_mount *fm, stru= ct fuse_args *args, args->out_args[0].value =3D &outarg; =20 if (args->opcode !=3D FUSE_LINK) { - err =3D get_create_ext(&nop_mnt_idmap, args, dir, entry, mode); + err =3D get_create_ext(idmap, args, dir, entry, mode); if (err) goto out_put_forget_req; } @@ -892,13 +893,13 @@ static int fuse_mknod(struct mnt_idmap *idmap, struct= inode *dir, args.in_args[0].value =3D &inarg; args.in_args[1].size =3D entry->d_name.len + 1; args.in_args[1].value =3D entry->d_name.name; - return create_new_entry(fm, &args, dir, entry, mode); + return create_new_entry(idmap, fm, &args, dir, entry, mode); } =20 static int fuse_create(struct mnt_idmap *idmap, struct inode *dir, struct dentry *entry, umode_t mode, bool excl) { - return fuse_mknod(&nop_mnt_idmap, dir, entry, mode, 0); + return fuse_mknod(idmap, dir, entry, mode, 0); } =20 static int fuse_tmpfile(struct mnt_idmap *idmap, struct inode *dir, @@ -910,7 +911,7 @@ static int fuse_tmpfile(struct mnt_idmap *idmap, struct= inode *dir, if (fc->no_tmpfile) return -EOPNOTSUPP; =20 - err =3D fuse_create_open(dir, file->f_path.dentry, file, file->f_flags, m= ode, FUSE_TMPFILE); + err =3D fuse_create_open(idmap, dir, file->f_path.dentry, file, file->f_f= lags, mode, FUSE_TMPFILE); if (err =3D=3D -ENOSYS) { fc->no_tmpfile =3D 1; err =3D -EOPNOTSUPP; @@ -937,7 +938,7 @@ static int fuse_mkdir(struct mnt_idmap *idmap, struct i= node *dir, args.in_args[0].value =3D &inarg; args.in_args[1].size =3D entry->d_name.len + 1; args.in_args[1].value =3D entry->d_name.name; - return create_new_entry(fm, &args, dir, entry, S_IFDIR); + return create_new_entry(idmap, fm, &args, dir, entry, S_IFDIR); } =20 static int fuse_symlink(struct mnt_idmap *idmap, struct inode *dir, @@ -953,7 +954,7 @@ static int fuse_symlink(struct mnt_idmap *idmap, struct= inode *dir, args.in_args[0].value =3D entry->d_name.name; args.in_args[1].size =3D len; args.in_args[1].value =3D link; - return create_new_entry(fm, &args, dir, entry, S_IFLNK); + return create_new_entry(idmap, fm, &args, dir, entry, S_IFLNK); } =20 void fuse_flush_time_update(struct inode *inode) @@ -1147,7 +1148,7 @@ static int fuse_link(struct dentry *entry, struct ino= de *newdir, args.in_args[0].value =3D &inarg; args.in_args[1].size =3D newent->d_name.len + 1; args.in_args[1].value =3D newent->d_name.name; - err =3D create_new_entry(fm, &args, newdir, newent, inode->i_mode); + err =3D create_new_entry(&nop_mnt_idmap, fm, &args, newdir, newent, inode= ->i_mode); if (!err) fuse_update_ctime_in_cache(inode); else if (err =3D=3D -EINTR) --=20 2.34.1 From nobody Mon Feb 9 06:50:18 2026 Received: from smtp-relay-internal-1.canonical.com (smtp-relay-internal-1.canonical.com [185.125.188.123]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D538A1B4C33 for ; Wed, 14 Aug 2024 11:41:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.125.188.123 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1723635691; cv=none; b=n2g776Cxx8dzkDhppVEt6gBS+iegzRXUALmUPPdTLSkE313Y+cRRHD3dn1ugyzPSvynsd7RR3dlsbdAo4xw1SOwDjNGlsYilEEJ+tfvTcJwxw0yp853zuulzhUGi08D9iIiU8FbUEdetPPuopzeqysP0GcjCNFy8CubDlXzSkfI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1723635691; c=relaxed/simple; bh=sQYa/TGQk7UO1dlX0MW4Xvi9uLCqrYRQlAcXitEceno=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=qQuIscR7SNi8M8dYRg8k+30zd83lUaKGwd9PQIU01vP07ntSgGUvZNMUdWhw/QQpvxKMGnobmrgoLBf+/JKmD5jSF4NLflqZsFbED265b2oVmPukP4IhSnvJ4X1ENKo+1zF8EgFU33lWOg/1hIdMMpvjmvP8LIlWuyrcg+zhfi0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=canonical.com; spf=pass smtp.mailfrom=canonical.com; dkim=pass (2048-bit key) header.d=canonical.com header.i=@canonical.com header.b=SXhJjWd5; arc=none smtp.client-ip=185.125.188.123 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=canonical.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=canonical.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=canonical.com header.i=@canonical.com header.b="SXhJjWd5" Received: from mail-lf1-f69.google.com (mail-lf1-f69.google.com [209.85.167.69]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 4DE23400B2 for ; Wed, 14 Aug 2024 11:41:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1723635688; bh=kX3REIljluq5iUQsttUuiM8BSwi4GrOWWl8ceulatPE=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=SXhJjWd5wEgmDw3hLEFmCaIq5N55DWwuhDeDl3RYjk32yUsKAUxJjv0bjcwSlOwzB wZ69EIYD5K/ct2SdrQxlMsqgKzFKtdbh8M26Wmtc9eiebCpzFYKXHQ0Hn76srmJZZK gyaEK0kPyBlOw6oNrqpEpxyUrApJJctBv44AqRfDZBjlkWMgEL2/Qzz0sY3T+DStJx RwbUz4f0SOBpoMT37v3Ezizcyk8kH2m3dDidHZCWlC69CDPH5ewZMxSIgXZ+uGHuJt hMgg882qbLeTVHeRYQn9FrZqa65MV2lG+IxPxEjRGUJlJRMHFXlo36oxFWJFSsdfqB QaJi5AJTO65sg== Received: by mail-lf1-f69.google.com with SMTP id 2adb3069b0e04-53214baf2abso2504151e87.1 for ; Wed, 14 Aug 2024 04:41:28 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1723635687; x=1724240487; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=kX3REIljluq5iUQsttUuiM8BSwi4GrOWWl8ceulatPE=; b=qTo1SR2xkEIvCtTHi73MrWbewkNPzx4kLYNoISkEwbhhACvsBC+MkvsnOTkG0RWKTW 1lvwdD5dn0hBmpW/nx/QoxIlCQSwoUM4VXMpqpSwpv4ZRRU6+czJ4yPoFc5mSBuHwMEN znOvfCRhbZOkQ3q8L2gTTdkOHLHcG7BX1e0hs+o8adGE2J1b6Ekd8VoJFJ0gL/BnSC1T oxCNPdQn+udt+Q6gh2cwP+/gqF9VFemC/O2oIj4BmYM6yJGgx8/sFScUFzPMLg78Rzf1 oAbTadqjTwhIulvOlnvso2qmP4+WY4ObSy83vb93RhxzuGZvbOILJoZNBhTGvwelGO27 Gy7Q== X-Forwarded-Encrypted: i=1; AJvYcCW6pYmtTq8E6bSKE32VG0IDZpg2aN0YbTXsYY2dU1VckvDEzMZ+sD7VBFroZ98w9upqsEsYPPi7sY9lLjOeQLzs1kWz0ohUF5kVq7pQ X-Gm-Message-State: AOJu0YyfUlb/g7rSLXOuUpq0jXVTmd+S4OmMMNaKaJZTEqHdQ8SpacdH UazN1DsrDrnA5EZWwfGD9rdrgL8OdT7Y6AXzx+zGCgJxUQnI1gFbGGlkm4HT2CRevtlfVrbq2Qr 6eQSweYf60ePxOxLjZD384Ox1QSbYDJvQb6IShBMwrjQIsWLmUVo2AqoDDsqnTtKXptshyRCCFp PJkg== X-Received: by 2002:a05:6512:230a:b0:52e:a63d:e5c1 with SMTP id 2adb3069b0e04-532eda83586mr1580865e87.30.1723635687506; Wed, 14 Aug 2024 04:41:27 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGfI4f7MYsqVeqcum/urkA2c8ZrkB367gdfi8exfw6an4iZX6W6jbiZZlbDbsNeu4towZFUWg== X-Received: by 2002:a05:6512:230a:b0:52e:a63d:e5c1 with SMTP id 2adb3069b0e04-532eda83586mr1580842e87.30.1723635686883; Wed, 14 Aug 2024 04:41:26 -0700 (PDT) Received: from amikhalitsyn.. ([188.192.113.77]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-a80f3fa782csm162586166b.60.2024.08.14.04.41.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Aug 2024 04:41:26 -0700 (PDT) From: Alexander Mikhalitsyn To: mszeredi@redhat.com Cc: brauner@kernel.org, stgraber@stgraber.org, linux-fsdevel@vger.kernel.org, Seth Forshee , Miklos Szeredi , Amir Goldstein , Bernd Schubert , Alexander Mikhalitsyn , linux-kernel@vger.kernel.org Subject: [PATCH v2 3/9] fs/fuse: support idmapped getattr inode op Date: Wed, 14 Aug 2024 13:40:28 +0200 Message-Id: <20240814114034.113953-4-aleksandr.mikhalitsyn@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240814114034.113953-1-aleksandr.mikhalitsyn@canonical.com> References: <20240814114034.113953-1-aleksandr.mikhalitsyn@canonical.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" We have to: - pass an idmapping to the generic_fillattr() to properly handle UIG/GID mapping for the userspace. - pass -/- to fuse_fillattr() (analog of generic_fillattr() in fuse). Difference between these two is that generic_fillattr() takes all the stat() data from the inode directly, while fuse_fillattr() codepath takes a fresh data just from the userspace reply on the FUSE_GETATTR reques= t. In some cases we can just pass &nop_mnt_idmap, because idmapping won't be used in these codepaths. For example, when 3rd argument of fuse_do_getat= tr() is NULL then idmap argument is not used. Cc: Christian Brauner Cc: Seth Forshee Cc: Miklos Szeredi Cc: Amir Goldstein Cc: Bernd Schubert Cc: Signed-off-by: Alexander Mikhalitsyn --- fs/fuse/dir.c | 44 ++++++++++++++++++++++++-------------------- 1 file changed, 24 insertions(+), 20 deletions(-) diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c index 1e45c6157af4..a5bf8c18a0ae 100644 --- a/fs/fuse/dir.c +++ b/fs/fuse/dir.c @@ -1157,18 +1157,22 @@ static int fuse_link(struct dentry *entry, struct i= node *newdir, return err; } =20 -static void fuse_fillattr(struct inode *inode, struct fuse_attr *attr, - struct kstat *stat) +static void fuse_fillattr(struct mnt_idmap *idmap, struct inode *inode, + struct fuse_attr *attr, struct kstat *stat) { unsigned int blkbits; struct fuse_conn *fc =3D get_fuse_conn(inode); + vfsuid_t vfsuid =3D make_vfsuid(idmap, fc->user_ns, + make_kuid(fc->user_ns, attr->uid)); + vfsgid_t vfsgid =3D make_vfsgid(idmap, fc->user_ns, + make_kgid(fc->user_ns, attr->gid)); =20 stat->dev =3D inode->i_sb->s_dev; stat->ino =3D attr->ino; stat->mode =3D (inode->i_mode & S_IFMT) | (attr->mode & 07777); stat->nlink =3D attr->nlink; - stat->uid =3D make_kuid(fc->user_ns, attr->uid); - stat->gid =3D make_kgid(fc->user_ns, attr->gid); + stat->uid =3D vfsuid_into_kuid(vfsuid); + stat->gid =3D vfsgid_into_kgid(vfsgid); stat->rdev =3D inode->i_rdev; stat->atime.tv_sec =3D attr->atime; stat->atime.tv_nsec =3D attr->atimensec; @@ -1207,8 +1211,8 @@ static void fuse_statx_to_attr(struct fuse_statx *sx,= struct fuse_attr *attr) attr->blksize =3D sx->blksize; } =20 -static int fuse_do_statx(struct inode *inode, struct file *file, - struct kstat *stat) +static int fuse_do_statx(struct mnt_idmap *idmap, struct inode *inode, + struct file *file, struct kstat *stat) { int err; struct fuse_attr attr; @@ -1261,15 +1265,15 @@ static int fuse_do_statx(struct inode *inode, struc= t file *file, stat->result_mask =3D sx->mask & (STATX_BASIC_STATS | STATX_BTIME); stat->btime.tv_sec =3D sx->btime.tv_sec; stat->btime.tv_nsec =3D min_t(u32, sx->btime.tv_nsec, NSEC_PER_SEC - 1); - fuse_fillattr(inode, &attr, stat); + fuse_fillattr(idmap, inode, &attr, stat); stat->result_mask |=3D STATX_TYPE; } =20 return 0; } =20 -static int fuse_do_getattr(struct inode *inode, struct kstat *stat, - struct file *file) +static int fuse_do_getattr(struct mnt_idmap *idmap, struct inode *inode, + struct kstat *stat, struct file *file) { int err; struct fuse_getattr_in inarg; @@ -1308,15 +1312,15 @@ static int fuse_do_getattr(struct inode *inode, str= uct kstat *stat, ATTR_TIMEOUT(&outarg), attr_version); if (stat) - fuse_fillattr(inode, &outarg.attr, stat); + fuse_fillattr(idmap, inode, &outarg.attr, stat); } } return err; } =20 -static int fuse_update_get_attr(struct inode *inode, struct file *file, - struct kstat *stat, u32 request_mask, - unsigned int flags) +static int fuse_update_get_attr(struct mnt_idmap *idmap, struct inode *ino= de, + struct file *file, struct kstat *stat, + u32 request_mask, unsigned int flags) { struct fuse_inode *fi =3D get_fuse_inode(inode); struct fuse_conn *fc =3D get_fuse_conn(inode); @@ -1347,17 +1351,17 @@ static int fuse_update_get_attr(struct inode *inode= , struct file *file, forget_all_cached_acls(inode); /* Try statx if BTIME is requested */ if (!fc->no_statx && (request_mask & ~STATX_BASIC_STATS)) { - err =3D fuse_do_statx(inode, file, stat); + err =3D fuse_do_statx(idmap, inode, file, stat); if (err =3D=3D -ENOSYS) { fc->no_statx =3D 1; err =3D 0; goto retry; } } else { - err =3D fuse_do_getattr(inode, stat, file); + err =3D fuse_do_getattr(idmap, inode, stat, file); } } else if (stat) { - generic_fillattr(&nop_mnt_idmap, request_mask, inode, stat); + generic_fillattr(idmap, request_mask, inode, stat); stat->mode =3D fi->orig_i_mode; stat->ino =3D fi->orig_ino; if (test_bit(FUSE_I_BTIME, &fi->state)) { @@ -1371,7 +1375,7 @@ static int fuse_update_get_attr(struct inode *inode, = struct file *file, =20 int fuse_update_attributes(struct inode *inode, struct file *file, u32 mas= k) { - return fuse_update_get_attr(inode, file, NULL, mask, 0); + return fuse_update_get_attr(&nop_mnt_idmap, inode, file, NULL, mask, 0); } =20 int fuse_reverse_inval_entry(struct fuse_conn *fc, u64 parent_nodeid, @@ -1515,7 +1519,7 @@ static int fuse_perm_getattr(struct inode *inode, int= mask) return -ECHILD; =20 forget_all_cached_acls(inode); - return fuse_do_getattr(inode, NULL, NULL); + return fuse_do_getattr(&nop_mnt_idmap, inode, NULL, NULL); } =20 /* @@ -2094,7 +2098,7 @@ static int fuse_setattr(struct mnt_idmap *idmap, stru= ct dentry *entry, * ia_mode calculation may have used stale i_mode. * Refresh and recalculate. */ - ret =3D fuse_do_getattr(inode, NULL, file); + ret =3D fuse_do_getattr(idmap, inode, NULL, file); if (ret) return ret; =20 @@ -2151,7 +2155,7 @@ static int fuse_getattr(struct mnt_idmap *idmap, return -EACCES; } =20 - return fuse_update_get_attr(inode, NULL, stat, request_mask, flags); + return fuse_update_get_attr(idmap, inode, NULL, stat, request_mask, flags= ); } =20 static const struct inode_operations fuse_dir_inode_operations =3D { --=20 2.34.1 From nobody Mon Feb 9 06:50:18 2026 Received: from smtp-relay-internal-0.canonical.com (smtp-relay-internal-0.canonical.com [185.125.188.122]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A27AF1B581A for ; Wed, 14 Aug 2024 11:41:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.125.188.122 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1723635696; cv=none; b=XGMRgm8OdZqcgd4urfUMGivWIf3XA93Yzyp0HDLOgOgEMgSuRUo+DgH0v61iQRMzQ2+6AbHaKSic/3+HO2ZiVX9/+sZSjec4bDiUrgcUSFt6bFSDEeg9AvAbXAzN22SGEz9buiPcDs3JApJRp2SPSPzuAkeAVYq9krHM7e+83xY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1723635696; c=relaxed/simple; bh=ONyUrWrgUBZRJvO+nhcwWS/g3zi/w0z15wLOTv3nesw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=IqkeRy4fMrrS9e5E8h5WYrfi10TgeFUEvAz+a1ntflH/TFuyQkoH3jULUu9K/G5TaNtB0gJ7duhWCBHDUYNs2lc4+poZSeT83Wa4aFEuo5nIJ3TE0sj3i9yjJPcuivCdI1O1VTcAtUocthN/6sXi0Z0YVUAVYvo4gi9aTMkSBTY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=canonical.com; spf=pass smtp.mailfrom=canonical.com; dkim=pass (2048-bit key) header.d=canonical.com header.i=@canonical.com header.b=Y5E1Ogwl; arc=none smtp.client-ip=185.125.188.122 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=canonical.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=canonical.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=canonical.com header.i=@canonical.com header.b="Y5E1Ogwl" Received: from mail-ed1-f72.google.com (mail-ed1-f72.google.com [209.85.208.72]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 6431E4596A for ; Wed, 14 Aug 2024 11:41:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1723635693; bh=+wGAYIUsqVxDBSfRQAij7GIIUQJC7PY8L940f+LK16E=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=Y5E1OgwlICh8d+kK1UBixZ4okzc04l6jhRuTM/iuFhdscitsgPZhCG/A7cpM7bb9w TxICb8D06O2U8Q5ZR22LanANrfRnOs0zNjfBn/kQlbTp2vo9LPc2CmPm+Uw2QiMJgr kpdDEIES0mUe0ZpEsVLszf4raWcJgyb4FYr8DDovGhEAbBn95OXG2EqGoAclqzwryj 1fmx+wRn1rob3lGdpB8+SAxf+YFjItE+QAXuwh3ktjCpM5mj+KAJARzQR7IotMlGOe OX8vRA8Uc8Q2njOLBRZ/OQhFTtJZrGtjHwPsFzfwpeIwp3CJaU63ElgmKXlwlKeRAW ljsls1DP0esjQ== Received: by mail-ed1-f72.google.com with SMTP id 4fb4d7f45d1cf-5b58f321a2dso4674341a12.2 for ; Wed, 14 Aug 2024 04:41:33 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1723635692; x=1724240492; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=+wGAYIUsqVxDBSfRQAij7GIIUQJC7PY8L940f+LK16E=; b=q3BsbC/fxlZ6s23ORBYbxppkbytmQm2SZGMuBqAkI86i0q/9hoftq+8IdARIwTOcLG 7evHlIl1Rb8CBhdqtPYRl6nWeXGwtulTepjcltgADs0XNtOrl2mtyvLZpxZ8bJEKdK0e 70RG7h71pvwTy9e6h7mPJLpRLZBmWRPAPjDjIJ55cADmraFQlulPcC7in+ZrxzI6ANA+ XjamKTaMh6BCZQIsfiS2fNAD9foyB9ogmDwxLkR6D9p01fK8ZUAHj5jycY41qizxCJyR dUPMxAYc4Nbvfkwqwus3vR1szMppQzTTShqb9B3lfoKVOXvzJecdEhKCnj0qSXtnC6BO i06Q== X-Forwarded-Encrypted: i=1; AJvYcCXkpjHonRfFlSzGP8nVdOqOUW7tqh5hOwgvYOxWsAno8VEVlMQCRg/u2tcNIDAjdO5oWdWN+l2zf7Sj9Lj6FhvMJFWkCmxQWENmAJ5R X-Gm-Message-State: AOJu0YwcfYhODuIApaYPBrgnQm43v2U7GEp086c5KN5ued7g+JTvgtA0 R+WsQTzunwPYz7vbx8/XedfNSpLL/h8KFepsX2tAaGmnXQjsezQ0S5x42DOSeccMwb+Cml5DulB bB+5zYXG5l+inwMdW4EayQvpNRLdqjr5qRRrtw43+9DXnnrgRNOBDdvo6pQby8dPj0HYSlzwn9i 6xTwcTHd6uhw== X-Received: by 2002:a17:907:e299:b0:a7a:a30b:7b93 with SMTP id a640c23a62f3a-a8366bfc205mr185943966b.2.1723635692272; Wed, 14 Aug 2024 04:41:32 -0700 (PDT) X-Google-Smtp-Source: AGHT+IHVElzlGQvCp40SGYdLshfg4SAiY1Lf5Iy2oHIC3dUD7p8/6p96C39Yy7gEUeBpOKaBSMFHag== X-Received: by 2002:a17:907:e299:b0:a7a:a30b:7b93 with SMTP id a640c23a62f3a-a8366bfc205mr185941466b.2.1723635691845; Wed, 14 Aug 2024 04:41:31 -0700 (PDT) Received: from amikhalitsyn.. ([188.192.113.77]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-a80f3fa782csm162586166b.60.2024.08.14.04.41.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Aug 2024 04:41:31 -0700 (PDT) From: Alexander Mikhalitsyn To: mszeredi@redhat.com Cc: brauner@kernel.org, stgraber@stgraber.org, linux-fsdevel@vger.kernel.org, Seth Forshee , Miklos Szeredi , Amir Goldstein , Bernd Schubert , Alexander Mikhalitsyn , linux-kernel@vger.kernel.org Subject: [PATCH v2 4/9] fs/fuse: support idmapped ->permission inode op Date: Wed, 14 Aug 2024 13:40:29 +0200 Message-Id: <20240814114034.113953-5-aleksandr.mikhalitsyn@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240814114034.113953-1-aleksandr.mikhalitsyn@canonical.com> References: <20240814114034.113953-1-aleksandr.mikhalitsyn@canonical.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" We only cover the case when "default_permissions" flag is used. A reason for that is that otherwise all the permission checks are done in the userspace and we have to deal with VFS idmapping in the userspace (which is bad), alternatively we have to provide the userspace with idmapped req->in.h.uid/req->in.h.gid which is also not align with VFS idmaps philosophy. Cc: Christian Brauner Cc: Seth Forshee Cc: Miklos Szeredi Cc: Amir Goldstein Cc: Bernd Schubert Cc: Signed-off-by: Alexander Mikhalitsyn --- fs/fuse/dir.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c index a5bf8c18a0ae..cd3b91b60cae 100644 --- a/fs/fuse/dir.c +++ b/fs/fuse/dir.c @@ -1567,7 +1567,7 @@ static int fuse_permission(struct mnt_idmap *idmap, } =20 if (fc->default_permissions) { - err =3D generic_permission(&nop_mnt_idmap, inode, mask); + err =3D generic_permission(idmap, inode, mask); =20 /* If permission is denied, try to refresh file attributes. This is also needed, because the root @@ -1575,7 +1575,7 @@ static int fuse_permission(struct mnt_idmap *idmap, if (err =3D=3D -EACCES && !refreshed) { err =3D fuse_perm_getattr(inode, mask); if (!err) - err =3D generic_permission(&nop_mnt_idmap, + err =3D generic_permission(idmap, inode, mask); } =20 --=20 2.34.1 From nobody Mon Feb 9 06:50:18 2026 Received: from smtp-relay-internal-0.canonical.com (smtp-relay-internal-0.canonical.com [185.125.188.122]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3805E1B583E for ; Wed, 14 Aug 2024 11:41:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.125.188.122 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1723635698; cv=none; b=SuhgZTs7Q+YQbc3AfqIF2eQmnr8ITAZ8Nic6yGaHX5B9DyHTwvqoAHLGmoPf61FSbny/MMeYkbjxeeF0V8GI8bWtZBAr0rGEhv3zfgQzsKIiQ6YtpTdD/bTuxeWzt66ySSPU25M1fEmZ9m0HV323lLOAS8gFKKC30Dd8KshpSNE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1723635698; c=relaxed/simple; bh=RkuH2BauyDIocB2ovqLtoiU8KDMUmIFO0WjdtWi8Ntc=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=dO95h+/v5UKNi7zjJmQvcrcssJCmY/yuZnKkxWvzmzwlQEwwbU4hRTeHf1SvCXO79LxfUvK+Slg1caN93WKVUTZKPcMA2ARSLRZ2rEOlcyL0L6BM1DLLzWbc9lFLg0mJCS4ntbdk9/MBaJUUUKaG014wYQtY11oVh9bpMv9uNfw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=canonical.com; spf=pass smtp.mailfrom=canonical.com; dkim=pass (2048-bit key) header.d=canonical.com header.i=@canonical.com header.b=YjQ7TUuQ; arc=none smtp.client-ip=185.125.188.122 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=canonical.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=canonical.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=canonical.com header.i=@canonical.com header.b="YjQ7TUuQ" Received: from mail-lf1-f72.google.com (mail-lf1-f72.google.com [209.85.167.72]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 94A8F4596C for ; Wed, 14 Aug 2024 11:41:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1723635695; bh=EYWyI91Y390dF1i7aBpa8hiQocB2iGszfdxdXheQ3fA=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=YjQ7TUuQLRlb9VmOXQMxVw7sPFMQZofLEjo6XludMkeb6F4Gufr81szl7d7H9wmKT nWNsUIxiyQrwsU2K1MNbX6+z+Bka1oFlTkCaMod6lEyBrHRxCCE/t0rbYgJIDBh5yb HL7ZiGjNDkyBGmKPlmsJBxfljpI+gZHlFodavHhXecDpI6XA73/DZMnJXOtCPKRVjz TS4jXtWT5KEvXUsz52t0BXv3yjwFPM08QcLFH/n1X/K0Gsgd+tD9Lp+lsaN/W8EWVf 8KyMgrrfa60+bYuUOcnsw+/FSJ4eLliH/WALflaUBvhUTaOUDxSSGbE2Y/WIl8GC/1 KkeJ9iDPvyjcA== Received: by mail-lf1-f72.google.com with SMTP id 2adb3069b0e04-52efd58cc5dso7941962e87.1 for ; Wed, 14 Aug 2024 04:41:35 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1723635695; x=1724240495; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=EYWyI91Y390dF1i7aBpa8hiQocB2iGszfdxdXheQ3fA=; b=dqeCvuIorYq7i4/NQwJqmSOCc1Dls3qyaVOtXQTFZQvEDpNG80b/98PgCZUpgEbwB8 ML4RDxnAi8xZ1kDqXj01N3unmiGJFTp1BZYTFda2z2P3KYRdvsGg+cFYbd7LwxVifvwY YKGLzhDynrGeGa3sQmdU9mUt2xqdmm6tMTMbxnly2IulXno6RTrvRQNA629rmaNNLf7z SsLLKPZqL6YzqaFd+RdDDQHLoMBDJWHbvaOV142S4oRjpo1KC+V7B0WQg0WRvUTatkBc tslbT96ITZEemMIYNmu1BSn9j7c/LUTRi1eQb7ObjcZyGL5ZIouH2+yzG9SigFXm1o8M BjzA== X-Forwarded-Encrypted: i=1; AJvYcCVwPmpp8uJRmBQ6HhUy9sik9cq7ydlfEEWDe+YSb1Ob3zXhDMqREyEIn5o9nhKpXjjLnqyThT9G8dcOrc5xmuN8zvb5ZMo6hCdTOX4h X-Gm-Message-State: AOJu0Yyggd1oJAq3IqGbLnQoXXZoTwxsAgLRoDeo4tShdgq8J/1hachY 9Nk7n6jhtVbHLHPqtXg0YyljHrFDSueTypJgp1cMoFW+bVtFK4IxEkVIn48J7qU1jeGaFwAfY+T WERm9BQXE1CB5wZd4JJU/G6x2AEUYwP0gHPsavwF4eK2vTHRWzk0xlBnF6YnKC0osphNF4iJPDg 8GKQ== X-Received: by 2002:a05:6512:3e29:b0:530:ac7d:58b0 with SMTP id 2adb3069b0e04-532eda59b78mr1743724e87.5.1723635694768; Wed, 14 Aug 2024 04:41:34 -0700 (PDT) X-Google-Smtp-Source: AGHT+IFCfBqIBOYzImrNkJqxw9487Gp+jn3aeoKRLxLbNwK9pHzrLOBBIEwRhNOpnGklER7AE1/Q+g== X-Received: by 2002:a05:6512:3e29:b0:530:ac7d:58b0 with SMTP id 2adb3069b0e04-532eda59b78mr1743704e87.5.1723635694319; Wed, 14 Aug 2024 04:41:34 -0700 (PDT) Received: from amikhalitsyn.. ([188.192.113.77]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-a80f3fa782csm162586166b.60.2024.08.14.04.41.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Aug 2024 04:41:33 -0700 (PDT) From: Alexander Mikhalitsyn To: mszeredi@redhat.com Cc: brauner@kernel.org, stgraber@stgraber.org, linux-fsdevel@vger.kernel.org, Seth Forshee , Miklos Szeredi , Amir Goldstein , Bernd Schubert , Alexander Mikhalitsyn , linux-kernel@vger.kernel.org Subject: [PATCH v2 5/9] fs/fuse: support idmapped ->setattr op Date: Wed, 14 Aug 2024 13:40:30 +0200 Message-Id: <20240814114034.113953-6-aleksandr.mikhalitsyn@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240814114034.113953-1-aleksandr.mikhalitsyn@canonical.com> References: <20240814114034.113953-1-aleksandr.mikhalitsyn@canonical.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Cc: Christian Brauner Cc: Seth Forshee Cc: Miklos Szeredi Cc: Amir Goldstein Cc: Bernd Schubert Cc: Signed-off-by: Alexander Mikhalitsyn --- fs/fuse/dir.c | 32 +++++++++++++++++++++----------- fs/fuse/file.c | 2 +- fs/fuse/fuse_i.h | 4 ++-- 3 files changed, 24 insertions(+), 14 deletions(-) diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c index cd3b91b60cae..c50f951596dd 100644 --- a/fs/fuse/dir.c +++ b/fs/fuse/dir.c @@ -1771,17 +1771,27 @@ static bool update_mtime(unsigned ivalid, bool trus= t_local_mtime) return true; } =20 -static void iattr_to_fattr(struct fuse_conn *fc, struct iattr *iattr, - struct fuse_setattr_in *arg, bool trust_local_cmtime) +static void iattr_to_fattr(struct mnt_idmap *idmap, struct fuse_conn *fc, + struct iattr *iattr, struct fuse_setattr_in *arg, + bool trust_local_cmtime) { unsigned ivalid =3D iattr->ia_valid; =20 if (ivalid & ATTR_MODE) arg->valid |=3D FATTR_MODE, arg->mode =3D iattr->ia_mode; - if (ivalid & ATTR_UID) - arg->valid |=3D FATTR_UID, arg->uid =3D from_kuid(fc->user_ns, iattr-= >ia_uid); - if (ivalid & ATTR_GID) - arg->valid |=3D FATTR_GID, arg->gid =3D from_kgid(fc->user_ns, iattr-= >ia_gid); + + if (ivalid & ATTR_UID) { + kuid_t fsuid =3D from_vfsuid(idmap, fc->user_ns, iattr->ia_vfsuid); + arg->valid |=3D FATTR_UID; + arg->uid =3D from_kuid(fc->user_ns, fsuid); + } + + if (ivalid & ATTR_GID) { + kgid_t fsgid =3D from_vfsgid(idmap, fc->user_ns, iattr->ia_vfsgid); + arg->valid |=3D FATTR_GID; + arg->gid =3D from_kgid(fc->user_ns, fsgid); + } + if (ivalid & ATTR_SIZE) arg->valid |=3D FATTR_SIZE, arg->size =3D iattr->ia_size; if (ivalid & ATTR_ATIME) { @@ -1901,8 +1911,8 @@ int fuse_flush_times(struct inode *inode, struct fuse= _file *ff) * vmtruncate() doesn't allow for this case, so do the rlimit checking * and the actual truncation by hand. */ -int fuse_do_setattr(struct dentry *dentry, struct iattr *attr, - struct file *file) +int fuse_do_setattr(struct mnt_idmap *idmap, struct dentry *dentry, + struct iattr *attr, struct file *file) { struct inode *inode =3D d_inode(dentry); struct fuse_mount *fm =3D get_fuse_mount(inode); @@ -1922,7 +1932,7 @@ int fuse_do_setattr(struct dentry *dentry, struct iat= tr *attr, if (!fc->default_permissions) attr->ia_valid |=3D ATTR_FORCE; =20 - err =3D setattr_prepare(&nop_mnt_idmap, dentry, attr); + err =3D setattr_prepare(idmap, dentry, attr); if (err) return err; =20 @@ -1981,7 +1991,7 @@ int fuse_do_setattr(struct dentry *dentry, struct iat= tr *attr, =20 memset(&inarg, 0, sizeof(inarg)); memset(&outarg, 0, sizeof(outarg)); - iattr_to_fattr(fc, attr, &inarg, trust_local_cmtime); + iattr_to_fattr(idmap, fc, attr, &inarg, trust_local_cmtime); if (file) { struct fuse_file *ff =3D file->private_data; inarg.valid |=3D FATTR_FH; @@ -2116,7 +2126,7 @@ static int fuse_setattr(struct mnt_idmap *idmap, stru= ct dentry *entry, if (!attr->ia_valid) return 0; =20 - ret =3D fuse_do_setattr(entry, attr, file); + ret =3D fuse_do_setattr(idmap, entry, attr, file); if (!ret) { /* * If filesystem supports acls it may have updated acl xattrs in diff --git a/fs/fuse/file.c b/fs/fuse/file.c index f39456c65ed7..562bdf8d5976 100644 --- a/fs/fuse/file.c +++ b/fs/fuse/file.c @@ -2966,7 +2966,7 @@ static void fuse_do_truncate(struct file *file) attr.ia_file =3D file; attr.ia_valid |=3D ATTR_FILE; =20 - fuse_do_setattr(file_dentry(file), &attr, file); + fuse_do_setattr(file_mnt_idmap(file), file_dentry(file), &attr, file); } =20 static inline loff_t fuse_round_up(struct fuse_conn *fc, loff_t off) diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h index d06934e70cc5..883151a44d72 100644 --- a/fs/fuse/fuse_i.h +++ b/fs/fuse/fuse_i.h @@ -1333,8 +1333,8 @@ bool fuse_write_update_attr(struct inode *inode, loff= _t pos, ssize_t written); int fuse_flush_times(struct inode *inode, struct fuse_file *ff); int fuse_write_inode(struct inode *inode, struct writeback_control *wbc); =20 -int fuse_do_setattr(struct dentry *dentry, struct iattr *attr, - struct file *file); +int fuse_do_setattr(struct mnt_idmap *idmap, struct dentry *dentry, + struct iattr *attr, struct file *file); =20 void fuse_set_initialized(struct fuse_conn *fc); =20 --=20 2.34.1 From nobody Mon Feb 9 06:50:18 2026 Received: from smtp-relay-internal-1.canonical.com (smtp-relay-internal-1.canonical.com [185.125.188.123]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9E01A1B86F0 for ; Wed, 14 Aug 2024 11:41:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.125.188.123 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1723635701; cv=none; b=g5KxdvSbzoGNCKbyvWBTwP8W8QDPfzgMDDp+QvjG7mATpfQmJrz5xVP8ynyLHfGWGdPVCq6j7PLqaZoqg5jUKZ62UramvyV8T+kNE5D/ieypXMOK2tSZPGEyahXbErT1GNt/mRE5vlm5/qTQfpTBGoUqGYF3Wzq2m3cy8+RjnyI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1723635701; c=relaxed/simple; bh=4adc61tKzjK2fTdo7B9pTquQAHQKVd/XEnUnW9CoK7g=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=DoPmn0D5PB1O7Ubzih6Ng3KSCqv8DzUUCsO/TqxNt4KUOSf4mEq1xaOn2YowXOWGm0jzhnmFSOYSOG6m3gOKJ4xTEqCws38LqIkXg965M9ZrOJ7QO2KyF4GpUO59f2O26RzjQYylnBmQ+WBlAN66glxSzGUr9UJPYdFrjdU4AD8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=canonical.com; spf=pass smtp.mailfrom=canonical.com; dkim=pass (2048-bit key) header.d=canonical.com header.i=@canonical.com header.b=anhspGiT; arc=none smtp.client-ip=185.125.188.123 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=canonical.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=canonical.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=canonical.com header.i=@canonical.com header.b="anhspGiT" Received: from mail-ej1-f72.google.com (mail-ej1-f72.google.com [209.85.218.72]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id DF612402E8 for ; Wed, 14 Aug 2024 11:41:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1723635697; bh=ftHOv+os2MH3Qk9OKnsGMHrGZxHBoFg3umKFJ4e1joU=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=anhspGiTCGzdMTo/vaun3DzQpCpPvdq4ZQddlSqroyh76F4yoPsaYky8lxSLhbmld DdHcqdvCtjO9MXtKtJzM1IwgH0CIqYhGY/UwxTet1o2JlIldVZ3hKrbawwEydrAJID N49fb4BLpGxk5zpQkq4L16/mknLgAJVhV8ljenGEhu9c3K4xQTRi6O0Uzt9TIzLTqZ t8kjor2PCbyDyE5J8MEnpbpdRAL1NWgQFNIWplPfCU0qFqo3KHzUuMBOPpBQowJ8Uc RXFE7slJiWSt0YVvH5Vyb0plyXuDs/f1JX6030HjMrqL8S7EBpcDmJyKJsZGGv6qpv MTWd3fGmz4BaQ== Received: by mail-ej1-f72.google.com with SMTP id a640c23a62f3a-a7aa26f342cso498671466b.1 for ; Wed, 14 Aug 2024 04:41:37 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1723635697; x=1724240497; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=ftHOv+os2MH3Qk9OKnsGMHrGZxHBoFg3umKFJ4e1joU=; b=uKPtCn+IetVfi6ineNl9c4M03wpSvwIXNUmixS4I7JoAUieUOml4Cwrek3R5HlQBiG SbxnOj1fDUYlw/JLuOn+GDqqveP2BJulbdmmSEbsPPFPCYbWZMQT9I3HhuRydhMU5bOd Gthap/nCORqatQmpe7UqhA0FTTA/5vKv1ceN4/FfmvQ6Yqo7niZBSp/rkC1MHd9KczVs CFZkW/q4zUssxqRj9xI9wVFZv8qWlV8FCbIgebJcnO1v2bRi5HVCSCrcy8LxFTxQa8ll QEYu7IS6B5/znVs3G5ViB9upAOBQSNw0XAEetdHDK+6fy2ZBqKxR6CAVONc51jFPLvEL kJXw== X-Forwarded-Encrypted: i=1; AJvYcCX8zZgFE1XMkc570r3HGU31NBq0TVxT97mLyfoyxnClawjdTas2mr34GQzy3iNZUasxbZc7f+aYqbq1n07KAn9TULpvJYrSV7TUuq+J X-Gm-Message-State: AOJu0YzT7kSNrX1jUih5G+CSNV+8Wgs3wo29LYfGa0WS0tJOHknCRT5/ Gh09fn31XLOZxZ/pK72YLRToc9qS8sv5WqeGNAIYz/bVrD+RQW77dzAS7SmcydSh5Ne+eK3rI8C 89NJ+K3mA15P/jOEu5A9BAG6gFYeJXLxEg4+FqafyzK7v32RnZQgJDu8FeSVhOFECs7hNbeX+2M VEqA== X-Received: by 2002:a17:907:60d6:b0:a7d:a178:cd35 with SMTP id a640c23a62f3a-a83670bd5b2mr177717866b.64.1723635697361; Wed, 14 Aug 2024 04:41:37 -0700 (PDT) X-Google-Smtp-Source: AGHT+IEmjKqsGrx0ul0wb1XIoGECqCVrDs1V6uhHyqPC1//LdYgqMr4vyNwmguX/RN/gAEhqphkSRw== X-Received: by 2002:a17:907:60d6:b0:a7d:a178:cd35 with SMTP id a640c23a62f3a-a83670bd5b2mr177715066b.64.1723635696887; Wed, 14 Aug 2024 04:41:36 -0700 (PDT) Received: from amikhalitsyn.. ([188.192.113.77]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-a80f3fa782csm162586166b.60.2024.08.14.04.41.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Aug 2024 04:41:36 -0700 (PDT) From: Alexander Mikhalitsyn To: mszeredi@redhat.com Cc: brauner@kernel.org, stgraber@stgraber.org, linux-fsdevel@vger.kernel.org, Seth Forshee , Miklos Szeredi , Amir Goldstein , Bernd Schubert , Alexander Mikhalitsyn , linux-kernel@vger.kernel.org Subject: [PATCH v2 6/9] fs/fuse: drop idmap argument from __fuse_get_acl Date: Wed, 14 Aug 2024 13:40:31 +0200 Message-Id: <20240814114034.113953-7-aleksandr.mikhalitsyn@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240814114034.113953-1-aleksandr.mikhalitsyn@canonical.com> References: <20240814114034.113953-1-aleksandr.mikhalitsyn@canonical.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" We don't need to have idmap in the __fuse_get_acl as we don't have any use for it. In the current POSIX ACL implementation, idmapped mounts are taken into account on the userspace/kernel border (see vfs_set_acl_idmapped_mnt() and vfs_posix_acl_to_xattr()). Cc: Christian Brauner Cc: Seth Forshee Cc: Miklos Szeredi Cc: Amir Goldstein Cc: Bernd Schubert Cc: Signed-off-by: Alexander Mikhalitsyn Reviewed-by: Christian Brauner --- fs/fuse/acl.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/fs/fuse/acl.c b/fs/fuse/acl.c index 04cfd8fee992..897d813c5e92 100644 --- a/fs/fuse/acl.c +++ b/fs/fuse/acl.c @@ -12,7 +12,6 @@ #include =20 static struct posix_acl *__fuse_get_acl(struct fuse_conn *fc, - struct mnt_idmap *idmap, struct inode *inode, int type, bool rcu) { int size; @@ -74,7 +73,7 @@ struct posix_acl *fuse_get_acl(struct mnt_idmap *idmap, if (fuse_no_acl(fc, inode)) return ERR_PTR(-EOPNOTSUPP); =20 - return __fuse_get_acl(fc, idmap, inode, type, false); + return __fuse_get_acl(fc, inode, type, false); } =20 struct posix_acl *fuse_get_inode_acl(struct inode *inode, int type, bool r= cu) @@ -90,8 +89,7 @@ struct posix_acl *fuse_get_inode_acl(struct inode *inode,= int type, bool rcu) */ if (!fc->posix_acl) return NULL; - - return __fuse_get_acl(fc, &nop_mnt_idmap, inode, type, rcu); + return __fuse_get_acl(fc, inode, type, rcu); } =20 int fuse_set_acl(struct mnt_idmap *idmap, struct dentry *dentry, --=20 2.34.1 From nobody Mon Feb 9 06:50:18 2026 Received: from smtp-relay-internal-1.canonical.com (smtp-relay-internal-1.canonical.com [185.125.188.123]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D6BE21B8EA3 for ; Wed, 14 Aug 2024 11:41:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.125.188.123 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1723635703; cv=none; b=chuH569ix3vZ6hg317Gpha62Gs+VrvBz9Lhob3k6JCQfIg0LG8/zIvhBchdkUseWOVhW2I1VSePMZ8Eavlv+/SyqkPF7UHqhxu1I9w6rkO673cGBcigXSR4CGoU0lJAe8xHJa123X5/cmCvfIuW/JtmA0nIv544bUm1HaR60ipc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1723635703; c=relaxed/simple; bh=ItY86ikXLB5CiOOsAivB6bVSog31+kYXgujXhFdDat8=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=YUl8jcPGJRwPXYAzSPJoZlQ5iAda3MeNrrq9m3EByC1IMiW0lf4wXZt3Ypf7ZnQ7KiGHJyt5WqULMHftYlw6GYPxilG5kFTTmNji6C+gt/DGxrQI1sals/xp5E0T9/yc/hKMVSbQTVswNnXjROyaWCdgjnN3sEpOiY7m50qAfaE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=canonical.com; spf=pass smtp.mailfrom=canonical.com; dkim=pass (2048-bit key) header.d=canonical.com header.i=@canonical.com header.b=GW+JoGSF; arc=none smtp.client-ip=185.125.188.123 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=canonical.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=canonical.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=canonical.com header.i=@canonical.com header.b="GW+JoGSF" Received: from mail-ed1-f70.google.com (mail-ed1-f70.google.com [209.85.208.70]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 0930D3F0F8 for ; Wed, 14 Aug 2024 11:41:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1723635700; bh=AKgOJzf1FD6sazbw1kqXlY4ydMZMTG/q+wfid3Wy6NY=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=GW+JoGSFctlWaIynxyhHWIYq+Ha8p24ifX4AkHPSgx1V9uSHQ/1tE90m19WtI07kj +6NW076IeWYuH1fjdz4xatXPIlvIxWNrk8cN+SvUgHsFw2k4o9Q0Qxx3pTzW0CUczl yniTlMyGqrhIzhiWLpc0lbFDkWQGBTs+cw+n9CRjdDMzUPR24neTwjU37oIIelqEK/ lMJo2NNf4CoNEVR1amSKzihPqr+Avkktmm9ED7Q1CJkqkZrOYOaylX5Q2kq6tV0OSd iAVIAw8ejcNu/Xos+wHFgGjmegSrVusMcstHouAj8ncd48/egTsBopL5nCX/VWx/+A ZR1KFEhR5IxKw== Received: by mail-ed1-f70.google.com with SMTP id 4fb4d7f45d1cf-5bb35b28f82so4575147a12.2 for ; Wed, 14 Aug 2024 04:41:40 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1723635699; x=1724240499; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=AKgOJzf1FD6sazbw1kqXlY4ydMZMTG/q+wfid3Wy6NY=; b=D6YO8A8xG2lgEZ9X3rtjCykahBUYVy6eAE/sp7oJz9qPo3mExyk1x86iEs3/AHesOJ PoktI6+eObDYMtY4zEDpZJ1Lek06oWCM63fYnoLw7wXl+Nf6GQAq4lpJ91OQ9pEhImZv I//4QMcnbIzrJ1oOtXCW8CkvKA1FzgPra1gnJBs7YCAxs49o5vjWy/OUz9XR2Xq53bJ3 VBukcI1mPOthhmdrWNqGOtacV5ikTIvKr0AvDEZQrfYdRdUYhHmGMuGo/OAGVycCeMTO Dq7Bz5I2PnYQQ2AAUEUc664qto/PrPEaxycJ8LQECr+s+eacKU7kFzkPtf7CjDz/1PKd IHyg== X-Forwarded-Encrypted: i=1; AJvYcCU86N8WzTuWD6a/btDJh/f+p1xNUNS5OFlwTNqOiOPTRCUo6hjU5cLKxotQt14aHXQ4597hVeTbM/3lMZW/mbkMr+L8JSio7CXdiPxu X-Gm-Message-State: AOJu0YxBUHsasY6Cbfbe0x6G/6q4RV17CHsxsH5A59qx1zlPcQW2GdU4 Zop4ZyakrfxIre9T+LTlLpFRd9KxnC1auRuExMpvax/C5i2ZmEonUzQ3oQBFFnQSym4A/hD0nAL U/zVHdQn5qQ+BDTzdwZUGnUuEgdHvK4CCvK4O9ayVitJLsx9nW6pdWbptk3YfJG3oFou2/2XNKw ymbA== X-Received: by 2002:a17:906:d25b:b0:a77:de2a:af00 with SMTP id a640c23a62f3a-a8367026317mr187631366b.44.1723635699538; Wed, 14 Aug 2024 04:41:39 -0700 (PDT) X-Google-Smtp-Source: AGHT+IG5139C2GtCKpY//YiiF+7oG06NRNE51BKEi55w6sj5WoOK8gcp46+pzNqcXQJShEtt5z7FGQ== X-Received: by 2002:a17:906:d25b:b0:a77:de2a:af00 with SMTP id a640c23a62f3a-a8367026317mr187629066b.44.1723635699193; Wed, 14 Aug 2024 04:41:39 -0700 (PDT) Received: from amikhalitsyn.. ([188.192.113.77]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-a80f3fa782csm162586166b.60.2024.08.14.04.41.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Aug 2024 04:41:38 -0700 (PDT) From: Alexander Mikhalitsyn To: mszeredi@redhat.com Cc: brauner@kernel.org, stgraber@stgraber.org, linux-fsdevel@vger.kernel.org, Seth Forshee , Miklos Szeredi , Amir Goldstein , Bernd Schubert , Alexander Mikhalitsyn , linux-kernel@vger.kernel.org Subject: [PATCH v2 7/9] fs/fuse: support idmapped ->set_acl Date: Wed, 14 Aug 2024 13:40:32 +0200 Message-Id: <20240814114034.113953-8-aleksandr.mikhalitsyn@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240814114034.113953-1-aleksandr.mikhalitsyn@canonical.com> References: <20240814114034.113953-1-aleksandr.mikhalitsyn@canonical.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" It's just a matter of adjusting a permission check condition for S_ISGID flag. All the rest is already handled in the generic VFS code. Notice that this permission check is the analog of what we have in posix_acl_update_mode() generic helper, but fuse doesn't use this helper as on the kernel side we don't care about ensuring that POSIX ACL and CHMOD permissions are in sync as it is a responsibility of a userspace daemon to handle that. For the same reason we don't have a calls to posix_acl_chmod(), while most of other filesystem do. Cc: Christian Brauner Cc: Seth Forshee Cc: Miklos Szeredi Cc: Amir Goldstein Cc: Bernd Schubert Cc: Signed-off-by: Alexander Mikhalitsyn --- fs/fuse/acl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/fuse/acl.c b/fs/fuse/acl.c index 897d813c5e92..8f484b105f13 100644 --- a/fs/fuse/acl.c +++ b/fs/fuse/acl.c @@ -144,8 +144,8 @@ int fuse_set_acl(struct mnt_idmap *idmap, struct dentry= *dentry, * be stripped. */ if (fc->posix_acl && - !in_group_or_capable(&nop_mnt_idmap, inode, - i_gid_into_vfsgid(&nop_mnt_idmap, inode))) + !in_group_or_capable(idmap, inode, + i_gid_into_vfsgid(idmap, inode))) extra_flags |=3D FUSE_SETXATTR_ACL_KILL_SGID; =20 ret =3D fuse_setxattr(inode, name, value, size, 0, extra_flags); --=20 2.34.1 From nobody Mon Feb 9 06:50:18 2026 Received: from smtp-relay-internal-0.canonical.com (smtp-relay-internal-0.canonical.com [185.125.188.122]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D1F331B8EA2 for ; Wed, 14 Aug 2024 11:41:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.125.188.122 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1723635705; cv=none; b=QiQYaRqNXGRtRHC+TV1GgMBAm9y95OFX9tva9FnWFFByNYk3zckyHrKbj4aWSw8aaKyfAUfbgfeJL+lRmrBq7n2oJSbC62YPnWCJznBQvo55xfCt8GyhsRIkX/f58tRHniySHJfgermVu3O/y6DfDsQbYlrpeBgtsT3PvVXVra4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1723635705; c=relaxed/simple; bh=AYEAerKkLpmYgBzqRigBShCxCtiDnWAQEM03p6Pjgd8=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=abrf6LM5/Ox/WF2tyP6BfFQOIqlP9XWp0zXa4VaDuLL4Pzg1MaZLlnnlGaWSzL855SudUd4GBQmhyhhmM6NQK16a5ehhAOC3gHxUQU5D6phHwv3IsgT0Zx7h817YsQo9ePCi16mOSnbLvL/dhG1i30JuaI/LFabhdcigD8Hie7s= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=canonical.com; spf=pass smtp.mailfrom=canonical.com; dkim=pass (2048-bit key) header.d=canonical.com header.i=@canonical.com header.b=Rg+VbWJ3; arc=none smtp.client-ip=185.125.188.122 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=canonical.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=canonical.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=canonical.com header.i=@canonical.com header.b="Rg+VbWJ3" Received: from mail-ej1-f72.google.com (mail-ej1-f72.google.com [209.85.218.72]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 4F9A1421F8 for ; Wed, 14 Aug 2024 11:41:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1723635702; bh=BMXgySWvbec+2JD6o4seP2DJpr4vHPmjXo1CkaHyEdA=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=Rg+VbWJ3Fd1VYi7E8IfDU9blFklvK/H8/ABfRhgEMeMKe9leuN5RSE11S0teEYDc/ WKhxRF/aOhE8hAHMMQsKgay0mAg2jQMR009veOKy84MzAmFD9fWndIbHoKIorYESZA TYG2ooeUITzP1E+alOXJysPUH+4dWdzp86He+crGpjnI6O9qmAudL3a9ZFigMDeC2u kxlHjZ5G+dqNWLcPqBotxipdSsykLDdt1SQgdf4KITbSqNWwBWIM9EqM0ecQuJoQ0u 9htkmfogvavvzwFOAWWUwi+kAY56QYX0/yHVz/B2kn68/fWru7Tz5ZIDzmgAERWEoR ut/AF/mZQCqXA== Received: by mail-ej1-f72.google.com with SMTP id a640c23a62f3a-a7a8d5ad9bcso468136866b.1 for ; Wed, 14 Aug 2024 04:41:42 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1723635702; x=1724240502; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=BMXgySWvbec+2JD6o4seP2DJpr4vHPmjXo1CkaHyEdA=; b=HnVbfEFVTbrx3jm7eHwb+D0/ZAU8t2JGH/gvXB7mF/rGGU6IrhG1nbT4Aj3BlM2ECy o6TchtEz8uDePgkHOKoeo0zC3z0/4yObEyzMzzGKmmA1G4akTYR9IcuCyJnbZy99hXy+ gpr0UxzOpOQzu8jhfLMNSSa4OwN/t1/3JsCc5oWUmhq1aqsjv0KkbDwb3q0l94aX2kCY 6InHV2IGS6gjHDK3Sik7Oud4B58ffN95I+sxNfbe7F4moMnte6kqrMfHc+3GdJMBs4Qi cEBROZoFgd2LFuji9XmeiIgt125kBJWVzBHra+oRldoG+US0Hdju72ZqDvFPVlVtaDTJ QSPA== X-Forwarded-Encrypted: i=1; AJvYcCVlGOGMJmtFfXX3QuNp6WQElu3ptlVikDNV+19y5niwQReJVurYceDxWerKrnsEehpxklSLh8zR0JpYhtsOLdBK0a21DssdDTTB9UMe X-Gm-Message-State: AOJu0YxDI1tD2ur+aNokKQJus7xrQnjOmEkIei7m6AkO0r4gybXFeVM8 IydsREVD01aVqSfZJhsXuyDdmLYfwhM0OFwOI2WhuvoNVjw39oksV4wD2NMEGFNigVAsOHF+FSD YXtfgrRRrpuigsopuTjpxTpNbEM2ut54V4GlUVOTEMyEF1Yrf9oxAoc+8mS/rLa7qFV+zxfuain mPvw== X-Received: by 2002:a17:907:e697:b0:a7a:a2e3:3734 with SMTP id a640c23a62f3a-a8366d4424fmr160210866b.28.1723635701796; Wed, 14 Aug 2024 04:41:41 -0700 (PDT) X-Google-Smtp-Source: AGHT+IEY+L+0zpcMxZ0FBkn3BMW+g/GgV8SZkKdvktwTfQoiwXcU482wpOHRCoifda++ee12gpLk/Q== X-Received: by 2002:a17:907:e697:b0:a7a:a2e3:3734 with SMTP id a640c23a62f3a-a8366d4424fmr160209566b.28.1723635701387; Wed, 14 Aug 2024 04:41:41 -0700 (PDT) Received: from amikhalitsyn.. ([188.192.113.77]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-a80f3fa782csm162586166b.60.2024.08.14.04.41.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Aug 2024 04:41:40 -0700 (PDT) From: Alexander Mikhalitsyn To: mszeredi@redhat.com Cc: brauner@kernel.org, stgraber@stgraber.org, linux-fsdevel@vger.kernel.org, Seth Forshee , Miklos Szeredi , Amir Goldstein , Bernd Schubert , Alexander Mikhalitsyn , linux-kernel@vger.kernel.org Subject: [PATCH v2 8/9] fs/fuse: properly handle idmapped ->rename op Date: Wed, 14 Aug 2024 13:40:33 +0200 Message-Id: <20240814114034.113953-9-aleksandr.mikhalitsyn@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240814114034.113953-1-aleksandr.mikhalitsyn@canonical.com> References: <20240814114034.113953-1-aleksandr.mikhalitsyn@canonical.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Support of RENAME_WHITEOUT with idmapped mounts requires an API extension for FUSE_RENAME2. Let's just forbid this combination for now. It's not critical at all as it's only needed for overlayfs on top of fuse/virtiofs. Choice of EINVAL is not random, we just simulate a standard behavior when RENAME_WHITEOUT flag is not supported. Cc: Christian Brauner Cc: Seth Forshee Cc: Miklos Szeredi Cc: Amir Goldstein Cc: Bernd Schubert Cc: Signed-off-by: Alexander Mikhalitsyn --- fs/fuse/dir.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c index c50f951596dd..0cd01f25251f 100644 --- a/fs/fuse/dir.c +++ b/fs/fuse/dir.c @@ -1111,6 +1111,9 @@ static int fuse_rename2(struct mnt_idmap *idmap, stru= ct inode *olddir, if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE | RENAME_WHITEOUT)) return -EINVAL; =20 + if ((flags & RENAME_WHITEOUT) && (idmap !=3D &nop_mnt_idmap)) + return -EINVAL; + if (flags) { if (fc->no_rename2 || fc->minor < 23) return -EINVAL; --=20 2.34.1 From nobody Mon Feb 9 06:50:18 2026 Received: from smtp-relay-internal-0.canonical.com (smtp-relay-internal-0.canonical.com [185.125.188.122]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 164FA1B9B59 for ; Wed, 14 Aug 2024 11:41:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.125.188.122 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1723635708; cv=none; b=Tm1kfz0FmcfGnmlB2GKR5uIrdPfk34RxSGNK04g3/H1hxoxOZAVgMfaUeaxmXyvnLXnITZbQOTtOsiPW5QEDOobJ5Kf3s1ZhZqntEPMlktGkR469q3N9am93KS8v1GVTqoGgKDtZbO4lB7PiJ2rIs17Vfh5i2ssbqIxYqF5eaOI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1723635708; c=relaxed/simple; bh=Nu3JnzracDB30usuIQ+vj3dQwpeU56RAKyxTWUIz45g=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=CtBxty2piXVOWa+/kh4VpQTwuRnoRZWkA19DEyKG1bg/54TVIaEw17FtDnnzPhtQ7Ubs1OyYbhTtQXntG7c9/FTVm1iSphOBUX0TS1GRxVTJhOiUDqoqaDY5ByD8eLpL+2iD725h8qCd7UavM6Crj1lk2nCmDol69pXR4IBnzHg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=canonical.com; spf=pass smtp.mailfrom=canonical.com; dkim=pass (2048-bit key) header.d=canonical.com header.i=@canonical.com header.b=Mq2+gTyL; arc=none smtp.client-ip=185.125.188.122 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=canonical.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=canonical.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=canonical.com header.i=@canonical.com header.b="Mq2+gTyL" Received: from mail-ej1-f71.google.com (mail-ej1-f71.google.com [209.85.218.71]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id EBD004596C for ; Wed, 14 Aug 2024 11:41:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1723635704; bh=KD9NzSm5+MMz93MQtyiG/0y5v89JycwxOffT6YGByAg=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=Mq2+gTyLGqPeBpOgRLIH5AKqn2oBHrvAZk3M7xtH+F4Sirzh6zBB05xHa7uxwtxQZ nzv/rbE6eZhb8tPch/JhCzB/UuJVSFVv0vPgTSDtnGJGdeStpLn7/yIuRA+xGoianI n2CoB/TlBKBLAo6w3hrBtdkx1LJAXvdDpUgw5X9isBLIBsgjccMQexHwj42kCa7nug ED2ud/T4gSx6tcTl+QKoE6sRwnEqtryXJlAjCrxjuOOSQwFekApcsZi31J3ptwU0IH Mp6VkXCeNpk2/uugHOnOlSNceOM3fo7dHtgdKW/4G6GpGlrUTgoLyvM+83Sv32ABpV 4TWubTLx8aFUg== Received: by mail-ej1-f71.google.com with SMTP id a640c23a62f3a-a7275e17256so526476666b.0 for ; Wed, 14 Aug 2024 04:41:44 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1723635704; x=1724240504; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=KD9NzSm5+MMz93MQtyiG/0y5v89JycwxOffT6YGByAg=; b=qywNRcR6G3UFxTk/3CvmjQALj+brRTCgkQAIqUrjwcS1BRAwEaK13O2FjLi8SVhk0y WW+ZgVu4yGoCJ3ds1NPNG8XtJ4hAlqsq7hVXvilWcYhUoXasiZNwCRnCypNquih+UNRz WYenq/AcDdNMno+hvVBQllG2LsCb+StPmWPrGWf6NpTJDbmVqq4SVNN6pnBcEvmFFWDu 6e0cU+xBR4HQog5y2LN+2m+VCGEFAqxtsPaEfWSJ8nC/Adm+v4s3CS/e+rjbKq9G6ydv jYpmIm48YnjNlzKg/WnOrGfBzKxo+lYt9Oy08uXoxpoCkFWxkE9D47iRA+2MiHVeOWBY nAdQ== X-Forwarded-Encrypted: i=1; AJvYcCVu0ehv7vMfejrji2+r3PZTdAnUUR3JniRnq6YppFtN2RrSuv6AXlTC3NtXhU8Obx66JStXRIewyupZYVHO69tdrK1nWLxvdivCjKYI X-Gm-Message-State: AOJu0YyrBzvtXlH4Es+p48JD+Rhi8tUhxwwaCvMTrzR2OtTvw985FUB0 jxA8WCC5+GX1y8RDIxJETFubP4OJrqGL3G3AnLKKPGjGz/onKt+Gjbe88n2hTgOJt5/oIpKQhUX FM7UX0b4lnWwOaFOVw3Tzukh6oKwN4CJ/viwXVpiPtw8eQklS/E+FH5aCbzk/Xz5y5KSLlBOx1E /jJg== X-Received: by 2002:a17:907:e69e:b0:a6f:dc17:500a with SMTP id a640c23a62f3a-a8366c346e8mr193024766b.23.1723635703974; Wed, 14 Aug 2024 04:41:43 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGCtDuBcjhSjqmuN/1KTcbSpwd8Zoqt9Rg7qDsLMEgubihtTvt9UxHmb+ZDmB/MWTEeXYYmHg== X-Received: by 2002:a17:907:e69e:b0:a6f:dc17:500a with SMTP id a640c23a62f3a-a8366c346e8mr193021966b.23.1723635703569; Wed, 14 Aug 2024 04:41:43 -0700 (PDT) Received: from amikhalitsyn.. ([188.192.113.77]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-a80f3fa782csm162586166b.60.2024.08.14.04.41.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Aug 2024 04:41:43 -0700 (PDT) From: Alexander Mikhalitsyn To: mszeredi@redhat.com Cc: brauner@kernel.org, stgraber@stgraber.org, linux-fsdevel@vger.kernel.org, Seth Forshee , Miklos Szeredi , Amir Goldstein , Bernd Schubert , Alexander Mikhalitsyn , linux-kernel@vger.kernel.org Subject: [PATCH v2 9/9] fs/fuse: allow idmapped mounts Date: Wed, 14 Aug 2024 13:40:34 +0200 Message-Id: <20240814114034.113953-10-aleksandr.mikhalitsyn@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240814114034.113953-1-aleksandr.mikhalitsyn@canonical.com> References: <20240814114034.113953-1-aleksandr.mikhalitsyn@canonical.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Now we have everything in place and we can allow idmapped mounts by setting the FS_ALLOW_IDMAP flag. Notice that real availability of idmapped mounts will depend on the fuse daemon. Fuse daemon have to set FUSE_ALLOW_IDMAP flag in the FUSE_INIT reply. To discuss: - we enable idmapped mounts support only if "default_permissions" mode is e= nabled, because otherwise we would need to deal with UID/GID mappings in the usersp= ace side OR provide the userspace with idmapped req->in.h.uid/req->in.h.gid values whic= h is not something that we probably want to. Idmapped mounts phylosophy is not about= faking caller uid/gid. - We have a small offlist discussion with Christian around adding fs_type->= allow_idmap hook. Christian pointed that it would be nice to have a superblock flag ins= tead like SB_I_NOIDMAP and we can set this flag during mount time if we see that file= system does not support idmappings. But, unfortunately I didn't succeed here because the ke= rnel will know if the filesystem supports idmapping or not after FUSE_INIT request, b= ut FUSE_INIT request is being sent at the end of mounting process, so mount and superblock will = exist and visible by the userspace in that time. It seems like setting SB_I_NOIDMAP f= lag in this case is too late as user may do the trick with creating a idmapped mount wh= ile it wasn't restricted by SB_I_NOIDMAP. Alternatively, we can introduce a "positive" ve= rsion SB_I_ALLOWIDMAP and "weak" version of FS_ALLOW_IDMAP like FS_MAY_ALLOW_IDMAP. So if FS_MAY_= ALLOW_IDMAP is set, then SB_I_ALLOWIDMAP has to be set on the superblock to allow creation of a= n idmapped mount. But that's a matter of our discussion. Some extra links and examples: - libfuse support https://github.com/mihalicyn/libfuse/commits/idmap_support - fuse-overlayfs support: https://github.com/mihalicyn/fuse-overlayfs/commits/idmap_support - cephfs-fuse conversion example https://github.com/mihalicyn/ceph/commits/fuse_idmap - glusterfs conversion example https://github.com/mihalicyn/glusterfs/commits/fuse_idmap Cc: Christian Brauner Cc: Seth Forshee Cc: Miklos Szeredi Cc: Amir Goldstein Cc: Bernd Schubert Cc: Signed-off-by: Alexander Mikhalitsyn --- fs/fuse/fuse_i.h | 3 +++ fs/fuse/inode.c | 13 ++++++++++--- include/uapi/linux/fuse.h | 5 ++++- 3 files changed, 17 insertions(+), 4 deletions(-) diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h index 883151a44d72..b2780ab59069 100644 --- a/fs/fuse/fuse_i.h +++ b/fs/fuse/fuse_i.h @@ -848,6 +848,9 @@ struct fuse_conn { /* Add owner_{u,g}id info when creating a new inode */ unsigned int owner_uid_gid_ext:1; =20 + /* Allow creation of idmapped mounts */ + unsigned int allow_idmap:1; + /* Does the filesystem support per inode DAX? */ unsigned int inode_dax:1; =20 diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c index 6c205731c844..ed4c2688047f 100644 --- a/fs/fuse/inode.c +++ b/fs/fuse/inode.c @@ -1345,6 +1345,12 @@ static void process_init_reply(struct fuse_mount *fm= , struct fuse_args *args, fm->sb->s_export_op =3D &fuse_export_fid_operations; if (flags & FUSE_OWNER_UID_GID_EXT) fc->owner_uid_gid_ext =3D 1; + if (flags & FUSE_ALLOW_IDMAP) { + if (fc->owner_uid_gid_ext && fc->default_permissions) + fc->allow_idmap =3D 1; + else + ok =3D false; + } } else { ra_pages =3D fc->max_read / PAGE_SIZE; fc->no_lock =3D 1; @@ -1392,7 +1398,8 @@ void fuse_send_init(struct fuse_mount *fm) FUSE_HANDLE_KILLPRIV_V2 | FUSE_SETXATTR_EXT | FUSE_INIT_EXT | FUSE_SECURITY_CTX | FUSE_CREATE_SUPP_GROUP | FUSE_HAS_EXPIRE_ONLY | FUSE_DIRECT_IO_ALLOW_MMAP | - FUSE_NO_EXPORT_SUPPORT | FUSE_HAS_RESEND | FUSE_OWNER_UID_GID_EXT; + FUSE_NO_EXPORT_SUPPORT | FUSE_HAS_RESEND | FUSE_OWNER_UID_GID_EXT | + FUSE_ALLOW_IDMAP; #ifdef CONFIG_FUSE_DAX if (fm->fc->dax) flags |=3D FUSE_MAP_ALIGNMENT; @@ -1981,7 +1988,7 @@ static void fuse_kill_sb_anon(struct super_block *sb) static struct file_system_type fuse_fs_type =3D { .owner =3D THIS_MODULE, .name =3D "fuse", - .fs_flags =3D FS_HAS_SUBTYPE | FS_USERNS_MOUNT, + .fs_flags =3D FS_HAS_SUBTYPE | FS_USERNS_MOUNT | FS_ALLOW_IDMAP, .init_fs_context =3D fuse_init_fs_context, .parameters =3D fuse_fs_parameters, .kill_sb =3D fuse_kill_sb_anon, @@ -2002,7 +2009,7 @@ static struct file_system_type fuseblk_fs_type =3D { .init_fs_context =3D fuse_init_fs_context, .parameters =3D fuse_fs_parameters, .kill_sb =3D fuse_kill_sb_blk, - .fs_flags =3D FS_REQUIRES_DEV | FS_HAS_SUBTYPE, + .fs_flags =3D FS_REQUIRES_DEV | FS_HAS_SUBTYPE | FS_ALLOW_IDMAP, }; MODULE_ALIAS_FS("fuseblk"); =20 diff --git a/include/uapi/linux/fuse.h b/include/uapi/linux/fuse.h index d9ecc17fd13b..b23e8247ce43 100644 --- a/include/uapi/linux/fuse.h +++ b/include/uapi/linux/fuse.h @@ -221,6 +221,7 @@ * 7.41 * - add FUSE_EXT_OWNER_UID_GID * - add FUSE_OWNER_UID_GID_EXT + * - add FUSE_ALLOW_IDMAP */ =20 #ifndef _LINUX_FUSE_H @@ -256,7 +257,7 @@ #define FUSE_KERNEL_VERSION 7 =20 /** Minor version number of this interface */ -#define FUSE_KERNEL_MINOR_VERSION 40 +#define FUSE_KERNEL_MINOR_VERSION 41 =20 /** The node ID of the root inode */ #define FUSE_ROOT_ID 1 @@ -427,6 +428,7 @@ struct fuse_file_lock { * of the request ID indicates resend requests * FUSE_OWNER_UID_GID_EXT: add inode owner UID/GID info to create, mkdir, * symlink and mknod + * FUSE_ALLOW_IDMAP: allow creation of idmapped mounts */ #define FUSE_ASYNC_READ (1 << 0) #define FUSE_POSIX_LOCKS (1 << 1) @@ -473,6 +475,7 @@ struct fuse_file_lock { /* Obsolete alias for FUSE_DIRECT_IO_ALLOW_MMAP */ #define FUSE_DIRECT_IO_RELAX FUSE_DIRECT_IO_ALLOW_MMAP #define FUSE_OWNER_UID_GID_EXT (1ULL << 40) +#define FUSE_ALLOW_IDMAP (1ULL << 41) =20 /** * CUSE INIT request/reply flags --=20 2.34.1