linux-ext4 - [PATCHSET v6 5/5] libfuse: run fuse servers as a contained service

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <176169814833.1428772.4461258885999504499.stgit@frogsfrogsfrogs>
Date: Tue, 28 Oct 2025 17:41:03 -0700
From: "Darrick J. Wong" <djwong@...nel.org>
To: djwong@...nel.org, bschubert@....com
Cc: linux-ext4@...r.kernel.org, linux-fsdevel@...r.kernel.org,
 bernd@...ernd.com, miklos@...redi.hu, joannelkoong@...il.com, neal@...pa.dev
Subject: [PATCHSET v6 5/5] libfuse: run fuse servers as a contained service

Hi all,

This patchset defines the necessary communication protocols and library
code so that users can mount fuse servers that run in unprivileged
systemd service containers.  That in turn allows unprivileged untrusted
mounts, because the worst that can happen is that a malicious image
crashes the fuse server and the mount dies, instead of corrupting the
kernel.  As part of the delegation, add a new ioctl allowing any process
with an open fusedev fd to ask for permission for anyone with that
fusedev fd to use iomap.

If you're going to start using this code, I strongly recommend pulling
from my git trees, which are linked below.

With a bit of luck, this should all go splendidly.
Comments and questions are, as always, welcome.

--D

kernel git tree:
https://git.kernel.org/cgit/linux/kernel/git/djwong/xfs-linux.git/log/?h=fuse-service-container
---
Commits in this patchset:
 * libfuse: add systemd/inetd socket service mounting helper
 * libfuse: integrate fuse services into mount.fuse3
 * libfuse: delegate iomap privilege from mount.service to fuse services
 * libfuse: enable setting iomap block device block size
 * fuservicemount: create loop devices for regular files
---
 include/fuse_kernel.h       |    8 
 include/fuse_lowlevel.h     |   23 +
 include/fuse_service.h      |  170 +++++++
 include/fuse_service_priv.h |  112 ++++
 lib/fuse_i.h                |    5 
 util/mount_service.h        |   41 ++
 doc/fuservicemount3.8       |   32 +
 doc/meson.build             |    3 
 include/meson.build         |    4 
 lib/fuse_lowlevel.c         |   16 +
 lib/fuse_service.c          |  828 +++++++++++++++++++++++++++++++++
 lib/fuse_service_stub.c     |   91 ++++
 lib/fuse_versionscript      |   16 +
 lib/helper.c                |   53 ++
 lib/meson.build             |   14 +
 lib/mount.c                 |   57 ++
 meson.build                 |   36 +
 meson_options.txt           |    6 
 util/fuservicemount.c       |   66 +++
 util/meson.build            |   13 -
 util/mount.fuse.c           |   58 +-
 util/mount_service.c        | 1086 +++++++++++++++++++++++++++++++++++++++++++
 22 files changed, 2701 insertions(+), 37 deletions(-)
 create mode 100644 include/fuse_service.h
 create mode 100644 include/fuse_service_priv.h
 create mode 100644 util/mount_service.h
 create mode 100644 doc/fuservicemount3.8
 create mode 100644 lib/fuse_service.c
 create mode 100644 lib/fuse_service_stub.c
 create mode 100644 util/fuservicemount.c
 create mode 100644 util/mount_service.c