linux-kernel - Re: [RFC] fuse: disable support for file handle when FUSE_EXPORT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 23 Jan 2024 18:40:40 +0800
From: Jingbo Xu <jefflexu@...ux.alibaba.com>
To: Amir Goldstein <amir73il@...il.com>
Cc: miklos@...redi.hu, linux-fsdevel@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: Re: [RFC] fuse: disable support for file handle when
 FUSE_EXPORT_SUPPORT not configured



On 1/23/24 6:17 PM, Amir Goldstein wrote:
> If you somehow find a way to mitigate the regression for NFS export of
> old fuse servers (maybe an opt-in Kconfig?), your patch is also going to
> regress AT_HANDLE_FID functionality, which can be used by fanotify to
> monitor fuse.
> 
> AT_HANDLE_FID flag to name_to_handle_at(2) means that
> open_by_handle_at(2) is not supposed to be called on that fh.
> 
> The correct way to deal with that would be something like this:
> 
> +static const struct export_operations fuse_fid_operations = {
> +       .encode_fh      = fuse_encode_fh,
> +};
> +
>  static const struct export_operations fuse_export_operations = {
>         .fh_to_dentry   = fuse_fh_to_dentry,
>         .fh_to_parent   = fuse_fh_to_parent,
> @@ -1529,12 +1533,16 @@ static void fuse_fill_attr_from_inode(struct
> fuse_attr *attr,
> 
>  static void fuse_sb_defaults(struct super_block *sb)
>  {
> +       struct fuse_mount *fm = get_fuse_mount_super(sb);
> +
>         sb->s_magic = FUSE_SUPER_MAGIC;
>         sb->s_op = &fuse_super_operations;
>         sb->s_xattr = fuse_xattr_handlers;
>         sb->s_maxbytes = MAX_LFS_FILESIZE;
>         sb->s_time_gran = 1;
> -       sb->s_export_op = &fuse_export_operations;
> +       if (fm->fc->export_support)
> +               sb->s_export_op = &fuse_export_operations;
> +       else
> +               sb->s_export_op = &fuse_fid_operations;
>         sb->s_iflags |= SB_I_IMA_UNVERIFIABLE_SIGNATURE;
>         if (sb->s_user_ns != &init_user_ns)
>                 sb->s_iflags |= SB_I_UNTRUSTED_MOUNTER;
> 
> ---
> 
> This would make name_to_handle_at() without AT_HANDLE_FID fail
> and name_to_handle_at() with AT_HANDLE_FID to succeed as it should.
> 

Oh I didn't notice this.  Many thanks!


-- 
Thanks,
Jingbo