linux-kernel - Re: [PATCH RFC] fuse: require FUSE drivers to opt-in for local file leases

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <c1ba341a7f6b7bd631be7f2a992910acd2c497da.camel@kernel.org>
Date: Tue, 26 Mar 2024 06:10:45 -0400
From: Jeff Layton <jlayton@...nel.org>
To: Miklos Szeredi <miklos@...redi.hu>
Cc: linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH RFC] fuse: require FUSE drivers to opt-in for local file
 leases

On Tue, 2024-03-26 at 10:47 +0100, Miklos Szeredi wrote:
> On Tue, 19 Mar 2024 at 17:54, Jeff Layton <jlayton@...nel.org> wrote:
> > 
> > Traditionally, we've allowed people to set leases on FUSE inodes.  Some
> > FUSE drivers are effectively local filesystems and should be fine with
> > kernel-internal lease support. But others are backed by a network server
> > that may have multiple clients, or may be backed by something non-file
> > like entirely.
> > 
> > Have the filesytem driver to set a fuse_conn flag to indicate whether it
> > wants support for local, in-kernel leases. If the flag is unset (the
> > default), then setlease attempts will fail with -EINVAL, indicating that
> > leases aren't supported on that inode.
> > 
> > Signed-off-by: Jeff Layton <jlayton@...nel.org>
> > ---
> > This is only tested for compilation, but it's fairly straightforward.
> > Having the FUSE drivers opt-out of this support might be more
> > backward-compatible, but that is a bit more dangerous. I'd rather driver
> > maintainer consciously opt-in.
> 
> In the end the lease behavior will need to be reverted if there are
> regressions.  I really don't know which is worse, the risk of
> regressions or the of risk data corruption...
> 

Yeah, it's a tough call. My hope was that FUSE drivers that did want
lease support can just set the flag and and rebuild. Worst case, they'd
just lose lease support until that was done. Lease support is generally
an optimization, so things should still work but may be slower.

> Also I'd prefer a more general flag indicating that the the kernel
> driver can assume no external changes to the filesystem.  E.g.
> FUSE_NO_OUTSIDE_CHANGE.
> 
> Does this make sense?  Can you imagine a case where FUSE_LOCAL_LEASES
> would be set, but caching policy would not assume no external changes?
> 

No, that seems like it would work just as well. I can respin the patch
along those lines and resend.
-- 
Jeff Layton <jlayton@...nel.org>