linux-stable.git/fs/fuse/dir.c, branch v3.8

userns: Support fuse interacting with multiple user namespaces

2012-11-15T06:05:33+00:00

Use kuid_t and kgid_t in struct fuse_conn and struct fuse_mount_data.

The connection between between a fuse filesystem and a fuse daemon is
established when a fuse filesystem is mounted and provided with a file
descriptor the fuse daemon created by opening /dev/fuse.

For now restrict the communication of uids and gids between the fuse
filesystem and the fuse daemon to the initial user namespace.  Enforce
this by verifying the file descriptor passed to the mount of fuse was
opened in the initial user namespace.  Ensuring the mount happens in
the initial user namespace is not necessary as mounts from non-initial
user namespaces are not yet allowed.

In fuse_req_init_context convert the currrent fsuid and fsgid into the
initial user namespace for the request that will be sent to the fuse
daemon.

In fuse_fill_attr convert the uid and gid passed from the fuse daemon
from the initial user namespace into kuids and kgids.

In iattr_to_fattr called from fuse_setattr convert kuids and kgids
into the uids and gids in the initial user namespace before passing
them to the fuse filesystem.

In fuse_change_attributes_common called from fuse_dentry_revalidate,
fuse_permission, fuse_geattr, and fuse_setattr, and fuse_iget convert
the uid and gid from the fuse daemon into a kuid and a kgid to store
on the fuse inode.

By default fuse mounts are restricted to task whose uid, suid, and
euid matches the fuse user_id and whose gid, sgid, and egid matches
the fuse group id.  Convert the user_id and group_id mount options
into kuids and kgids at mount time, and use uid_eq and gid_eq to
compare the in fuse_allow_task.

Cc: Miklos Szeredi 
Acked-by: Serge Hallyn 
Signed-off-by: Eric W. Biederman

fuse: check create mode in atomic open

2012-08-15T11:01:24+00:00

Verify that the VFS is passing us a complete create mode with the S_IFREG to
atomic open.

Reported-by: Steve 
Reported-by: Richard W.M. Jones 
Signed-off-by: Miklos Szeredi 
Tested-by: Richard W.M. Jones

don't pass nameidata to ->create()

2012-07-14T12:34:47+00:00

boolean "does it have to be exclusive?" flag is passed instead;
Local filesystem should just ignore it - the object is guaranteed
not to be there yet.

Signed-off-by: Al Viro

stop passing nameidata to ->lookup()

2012-07-14T12:34:32+00:00

Just the flags; only NFS cares even about that, but there are
legitimate uses for such argument.  And getting rid of that
completely would require splitting ->lookup() into a couple
of methods (at least), so let's leave that alone for now...

Signed-off-by: Al Viro

stop passing nameidata * to ->d_revalidate()

2012-07-14T12:34:14+00:00

Just the lookup flags.  Die, bastard, die...

Signed-off-by: Al Viro

make finish_no_open() return int

2012-07-14T12:33:45+00:00

namely, 1 ;-)  That's what we want to return from ->atomic_open()
instances after finish_no_open().

Signed-off-by: Al Viro

kill struct opendata

2012-07-14T12:33:39+00:00

Just pass struct file *.  Methods are happier that way...
There's no need to return struct file * from finish_open() now,
so let it return int.  Next: saner prototypes for parts in
namei.c

Signed-off-by: Al Viro

make ->atomic_open() return int

2012-07-14T12:33:35+00:00

Change of calling conventions:
old		new
NULL		1
file		0
ERR_PTR(-ve)	-ve

Caller *knows* that struct file *; no need to return it.

Signed-off-by: Al Viro

->atomic_open() prototype change - pass int * instead of bool *

2012-07-14T12:33:31+00:00

... and let finish_open() report having opened the file via that sucker.
Next step: don't modify od->filp at all.

[AV: FILE_CREATE was already used by cifs; Miklos' fix folded]

Signed-off-by: Al Viro

fuse: implement i_op->atomic_open()

2012-07-14T12:33:14+00:00

Add an ->atomic_open implementation which replaces the atomic open+create
operation implemented via ->create.  No functionality is changed.

Signed-off-by: Miklos Szeredi 
Signed-off-by: Al Viro