summaryrefslogtreecommitdiffstats
path: root/tools
Commit message (Collapse)AuthorAgeFilesLines
...
* virtiofsd: add helper for lo_data cleanupLiu Bo2020-01-231-16/+21
| | | | | | | | This offers an helper function for lo_data's cleanup. Signed-off-by: Liu Bo <bo.liu@linux.alibaba.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: fix memory leak on lo.sourceLiu Bo2020-01-231-3/+4
| | | | | | | | | valgrind reported that lo.source is leaked on quiting, but it was defined as (const char*) as it may point to a const string "/". Signed-off-by: Liu Bo <bo.liu@linux.alibaba.com> Reviewed-by: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: cleanup allocated resource in seLiu Bo2020-01-233-1/+15
| | | | | | | | | This cleans up unfreed resources in se on quiting, including se->virtio_dev, se->vu_socket_path, se->vu_socketfd. Signed-off-by: Liu Bo <bo.liu@linux.alibaba.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: fix error handling in main()Liu Bo2020-01-231-2/+3
| | | | | | | | | Neither fuse_parse_cmdline() nor fuse_opt_parse() goes to the right place to do cleanup. Signed-off-by: Liu Bo <bo.liu@linux.alibaba.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: support nanosecond resolution for file timestampJiufei Xue2020-01-231-0/+1
| | | | | | | | | | Define HAVE_STRUCT_STAT_ST_ATIM to 1 if `st_atim' is member of `struct stat' which means support nanosecond resolution for the file timestamp fields. Signed-off-by: Jiufei Xue <jiufei.xue@linux.alibaba.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: Clean up inodes on destroyDr. David Alan Gilbert2020-01-231-0/+26
| | | | | | | | | Clear out our inodes and fd's on a 'destroy' - so we get rid of them if we reboot the guest. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: passthrough_ll: use hashtableMiklos Szeredi2020-01-231-36/+45
| | | | | | | | | | Improve performance of inode lookup by using a hash table. Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Liu Bo <bo.liu@linux.alibaba.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: passthrough_ll: clean up cache related optionsMiklos Szeredi2020-01-232-11/+14
| | | | | | | | | | | | - Rename "cache=never" to "cache=none" to match 9p's similar option. - Rename CACHE_NORMAL constant to CACHE_AUTO to match the "cache=auto" option. Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: extract root inode init into setup_root()Miklos Szeredi2020-01-231-10/+25
| | | | | | | | | | | Inititialize the root inode in a single place. Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> dgilbert: with fix suggested by Misono Tomohiro <misono.tomohiro@jp.fujitsu.com> Reviewed-by: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: fail when parent inode isn't known in lo_do_lookup()Miklos Szeredi2020-01-231-2/+12
| | | | | | | | | | | | | The Linux file handle APIs (struct export_operations) can access inodes that are not attached to parents because path name traversal is not performed. Refuse if there is no parent in lo_do_lookup(). Also clean up lo_do_lookup() while we're here. Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: rename unref_inode() to unref_inode_lolocked()Miklos Szeredi2020-01-231-7/+8
| | | | | | | Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: passthrough_ll: control readdirplusMiklos Szeredi2020-01-232-1/+10
| | | | | | Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Reviewed-by: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: passthrough_ll: disable readdirplus on cache=neverMiklos Szeredi2020-01-231-0/+4
| | | | | | | | | ...because the attributes sent in the READDIRPLUS reply would be discarded anyway. Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: passthrough_ll: add renameat2 supportMiklos Szeredi2020-01-231-0/+10
| | | | | Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: Kill threads when queues are stoppedDr. David Alan Gilbert2020-01-231-7/+44
| | | | | | | | | | Kill the threads we've started when the queues get stopped. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> With improvements by: Signed-off-by: Eryu Guan <eguan@linux.alibaba.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: Handle hard rebootDr. David Alan Gilbert2020-01-231-1/+15
| | | | | | | | | | | | | Handle a mount hard reboot (without unmount) mount we get another 'init' which FUSE doesn't normally expect. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: Handle reinitDr. David Alan Gilbert2020-01-231-0/+2
| | | | | | | | Allow init->destroy->init for mount->umount->mount Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: Add timestamp to the log with FUSE_LOG_DEBUG levelMasayoshi Mizuma2020-01-231-1/+8
| | | | | | | | | | | | | | | | | | | | virtiofsd has some threads, so we see a lot of logs with debug option. It would be useful for debugging if we can see the timestamp. Add nano second timestamp, which got by get_clock(), to the log with FUSE_LOG_DEBUG level if the syslog option isn't set. The log is like as: # ./virtiofsd -d -o vhost_user_socket=/tmp/vhostqemu0 -o source=/tmp/share0 -o cache=auto ... [5365943125463727] [ID: 00000002] fv_queue_thread: Start for queue 0 kick_fd 9 [5365943125568644] [ID: 00000002] fv_queue_thread: Waiting for Queue 0 event [5365943125573561] [ID: 00000002] fv_queue_thread: Got queue event on Queue 0 Signed-off-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: Add ID to the log with FUSE_LOG_DEBUG levelMasayoshi Mizuma2020-01-231-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | virtiofsd has some threads, so we see a lot of logs with debug option. It would be useful for debugging if we can identify the specific thread from the log. Add ID, which is got by gettid(), to the log with FUSE_LOG_DEBUG level so that we can grep the specific thread. The log is like as: ]# ./virtiofsd -d -o vhost_user_socket=/tmp/vhostqemu0 -o source=/tmp/share0 -o cache=auto ... [ID: 00000097] unique: 12696, success, outsize: 120 [ID: 00000097] virtio_send_msg: elem 18: with 2 in desc of length 120 [ID: 00000003] fv_queue_thread: Got queue event on Queue 1 [ID: 00000003] fv_queue_thread: Queue 1 gave evalue: 1 available: in: 65552 out: 80 [ID: 00000003] fv_queue_thread: Waiting for Queue 1 event [ID: 00000071] fv_queue_worker: elem 33: with 2 out desc of length 80 bad_in_num=0 bad_out_num=0 [ID: 00000071] unique: 12694, opcode: READ (15), nodeid: 2, insize: 80, pid: 2014 [ID: 00000071] lo_read(ino=2, size=65536, off=131072) Signed-off-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> added rework as suggested by Daniel P. Berrangé during review Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: print log only when priority is high enoughEryu Guan2020-01-234-115/+87Star
| | | | | | | | | | | | | | | | | | | | Introduce "-o log_level=" command line option to specify current log level (priority), valid values are "debug info warn err", e.g. ./virtiofsd -o log_level=debug ... So only log priority higher than "debug" will be printed to stderr/syslog. And the default level is info. The "-o debug"/"-d" options are kept, and imply debug log level. Signed-off-by: Eryu Guan <eguan@linux.alibaba.com> dgilbert: Reworked for libfuse's log_func Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> with fix by: Signed-off-by: Xiao Yang <yangx.jy@cn.fujitsu.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: add --syslog command-line optionStefan Hajnoczi2020-01-235-13/+76
| | | | | | | | | | | | Sometimes collecting output from stderr is inconvenient or does not fit within the overall logging architecture. Add syslog(3) support for cases where stderr cannot be used. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> dgilbert: Reworked as a logging function Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: fix libfuse information leaksStefan Hajnoczi2020-01-231-74/+76
| | | | | | | | | | | | | | | | Some FUSE message replies contain padding fields that are not initialized by libfuse. This is fine in traditional FUSE applications because the kernel is trusted. virtiofsd does not trust the guest and must not expose uninitialized memory. Use C struct initializers to automatically zero out memory. Not all of these code changes are strictly necessary but they will prevent future information leaks if the structs are extended. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: set maximum RLIMIT_NOFILE limitStefan Hajnoczi2020-01-231-0/+32
| | | | | | | | | | | virtiofsd can exceed the default open file descriptor limit easily on most systems. Take advantage of the fact that it runs as root to raise the limit. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: Drop CAP_FSETID if client asked for itVivek Goyal2020-01-231-0/+105
| | | | | | | | | | | | | | If client requested killing setuid/setgid bits on file being written, drop CAP_FSETID capability so that setuid/setgid bits are cleared upon write automatically. pjdfstest chown/12.t needs this. Signed-off-by: Vivek Goyal <vgoyal@redhat.com> dgilbert: reworked for libcap-ng Reviewed-by: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com> Reviewed-by: Sergio Lopez <slp@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: cap-ng helpersDr. David Alan Gilbert2020-01-231-0/+72
| | | | | | | | | | libcap-ng reads /proc during capng_get_caps_process, and virtiofsd's sandboxing doesn't have /proc mounted; thus we have to do the caps read before we sandbox it and save/restore the state. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: Parse flag FUSE_WRITE_KILL_PRIVVivek Goyal2020-01-232-2/+8
| | | | | | | | | | Caller can set FUSE_WRITE_KILL_PRIV in write_flags. Parse it and pass it to the filesystem. Signed-off-by: Vivek Goyal <vgoyal@redhat.com> Reviewed-by: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com> Reviewed-by: Sergio Lopez <slp@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: add seccomp whitelistStefan Hajnoczi2020-01-234-1/+171
| | | | | | | | | | | | | | | | | | | Only allow system calls that are needed by virtiofsd. All other system calls cause SIGSYS to be directed at the thread and the process will coredump. Restricting system calls reduces the kernel attack surface and limits what the process can do when compromised. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> with additional entries by: Signed-off-by: Ganesh Maharaj Mahalingam <ganesh.mahalingam@intel.com> Signed-off-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com> Signed-off-by: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com> Signed-off-by: piaojun <piaojun@huawei.com> Signed-off-by: Vivek Goyal <vgoyal@redhat.com> Signed-off-by: Eric Ren <renzhen@linux.alibaba.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: move to a new pid namespaceStefan Hajnoczi2020-01-231-48/+86
| | | | | | | | | | | | | | | | virtiofsd needs access to /proc/self/fd. Let's move to a new pid namespace so that a compromised process cannot see another other processes running on the system. One wrinkle in this approach: unshare(CLONE_NEWPID) affects *child* processes and not the current process. Therefore we need to fork the pid 1 process that will actually run virtiofsd and leave a parent in waitpid(2). This is not the same thing as daemonization and parent processes should not notice a difference. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: move to an empty network namespaceStefan Hajnoczi2020-01-231-0/+14
| | | | | | | | | If the process is compromised there should be no network access. Use an empty network namespace to sandbox networking. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: sandbox mount namespaceStefan Hajnoczi2020-01-231-0/+89
| | | | | | | | | | | | | Use a mount namespace with the shared directory tree mounted at "/" and no other mounts. This prevents symlink escape attacks because symlink targets are resolved only against the shared directory and cannot go outside it. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Peng Tao <tao.peng@linux.alibaba.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: use /proc/self/fd/ O_PATH file descriptorStefan Hajnoczi2020-01-231-27/+103
| | | | | | | | | | | | Sandboxing will remove /proc from the mount namespace so we can no longer build string paths into "/proc/self/fd/...". Keep an O_PATH file descriptor so we can still re-open fds via /proc/self/fd. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: prevent ".." escape in lo_do_readdir()Stefan Hajnoczi2020-01-231-14/+22
| | | | | | | | | Construct a fake dirent for the root directory's ".." entry. This hides the parent directory from the FUSE client. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Sergio Lopez <slp@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: prevent ".." escape in lo_do_lookup()Stefan Hajnoczi2020-01-231-1/+6
| | | | | | Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Sergio Lopez <slp@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: check input buffer size in fuse_lowlevel.c opsStefan Hajnoczi2020-01-231-125/+456
| | | | | | | | | | | | | | Each FUSE operation involves parsing the input buffer. Currently the code assumes the input buffer is large enough for the expected arguments. This patch uses fuse_mbuf_iter to check the size. Most operations are simple to convert. Some are more complicated due to variable-length inputs or different sizes depending on the protocol version. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Sergio Lopez <slp@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: validate input buffer sizes in do_write_buf()Stefan Hajnoczi2020-01-231-19/+30
| | | | | | | | | | | There is a small change in behavior: if fuse_write_in->size doesn't match the input buffer size then the request is failed. Previously write requests with 1 fuse_buf element would truncate to fuse_write_in->size. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Sergio Lopez <slp@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: add fuse_mbuf_iter APIStefan Hajnoczi2020-01-232-1/+76
| | | | | | | | | Introduce an API for consuming bytes from a buffer with size checks. All FUSE operations will be converted to use this safe API instead of void *inarg. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: Pass write iov's all the way throughDr. David Alan Gilbert2020-01-231-6/+73
| | | | | | | | | Pass the write iov pointing to guest RAM all the way through rather than copying the data. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Xiao Yang <yangx.jy@cn.fujitsu.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: Plumb fuse_bufvec through to do_write_bufDr. David Alan Gilbert2020-01-233-22/+44
| | | | | | | | | | | | Let fuse_session_process_buf_int take a fuse_bufvec * instead of a fuse_buf; and then through to do_write_buf - where in the best case it can pass that straight through to op.write_buf without copying (other than skipping a header). Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: validate path componentsStefan Hajnoczi2020-01-231-6/+53
| | | | | | | | | | | | | Several FUSE requests contain single path components. A correct FUSE client sends well-formed path components but there is currently no input validation in case something went wrong or the client is malicious. Refuse ".", "..", and paths containing '/' when we expect a path component. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: passthrough_ll: add fallback for racy opsMiklos Szeredi2020-01-232-17/+145
| | | | | | | | | | | | | | | | | | | | | | | | | | We have two operations that cannot be done race-free on a symlink in certain cases: utimes and link. Add racy fallback for these if the race-free method doesn't work. We do our best to avoid races even in this case: - get absolute path by reading /proc/self/fd/NN symlink - lookup parent directory: after this we are safe against renames in ancestors - lookup name in parent directory, and verify that we got to the original inode, if not retry the whole thing Both utimes(2) and link(2) hold i_lock on the inode across the operation, so a racing rename/delete by this fuse instance is not possible, only from other entities changing the filesystem. If the "norace" option is given, then disable the racy fallbacks. Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Reviewed-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: passthrough_ll: add fd_map to hide file descriptorsStefan Hajnoczi2020-01-231-22/+94
| | | | | | | | | | | | | Do not expose file descriptor numbers to clients. This prevents the abuse of internal file descriptors (like stdin/stdout). Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Fix from: Signed-off-by: Xiao Yang <yangx.jy@cn.fujitsu.com> dgilbert: Added lseek Reviewed-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: passthrough_ll: add dirp_map to hide lo_dirp pointersStefan Hajnoczi2020-01-231-27/+76
| | | | | | | | Do not expose lo_dirp pointers to clients. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: passthrough_ll: add ino_map to hide lo_inode pointersStefan Hajnoczi2020-01-231-30/+114
| | | | | | | | Do not expose lo_inode pointers to clients. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: passthrough_ll: add lo_map for ino/fh indirectionStefan Hajnoczi2020-01-231-0/+124
| | | | | | | | | | | | | | A layer of indirection is needed because passthrough_ll cannot expose pointers or file descriptor numbers to untrusted clients. Malicious clients could send invalid pointers or file descriptors in order to crash or exploit the file system daemon. lo_map provides an integer key->value mapping. This will be used for ino and fh fields in the patches that follow. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: passthrough_ll: create new files in caller's contextVivek Goyal2020-01-231-5/+91
| | | | | | | | | | | | | | | | We need to create files in the caller's context. Otherwise after creating a file, the caller might not be able to do file operations on that file. Changed effective uid/gid to caller's uid/gid, create file and then switch back to uid/gid 0. Use syscall(setresuid, ...) otherwise glibc does some magic to change EUID in all threads, which is not what we want. Signed-off-by: Vivek Goyal <vgoyal@redhat.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: add --print-capabilities optionStefan Hajnoczi2020-01-233-0/+15
| | | | | | | | | Add the --print-capabilities option as per vhost-user.rst "Backend programs conventions". Currently there are no advertised features. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: add vhost-user.json fileStefan Hajnoczi2020-01-231-0/+5
| | | | | | | | | | Install a vhost-user.json file describing virtiofsd. This allows libvirt and other management tools to enumerate vhost-user backend programs. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: make -f (foreground) the defaultStefan Hajnoczi2020-01-231-0/+8
| | | | | | | | | | | According to vhost-user.rst "Backend program conventions", backend programs should run in the foregound by default. Follow the conventions so libvirt and other management tools can control virtiofsd in a standard way. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: add --fd=FDNUM fd passing optionStefan Hajnoczi2020-01-233-10/+38
| | | | | | | | | | | | Although --socket-path=PATH is useful for manual invocations, management tools typically create the UNIX domain socket themselves and pass it to the vhost-user device backend. This way QEMU can be launched immediately with a valid socket. No waiting for the vhost-user device backend is required when fd passing is used. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* virtiofsd: Fast path for virtio readDr. David Alan Gilbert2020-01-233-0/+171
| | | | | | | | | | Readv the data straight into the guests buffer. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> With fix by: Signed-off-by: Eryu Guan <eguan@linux.alibaba.com> Reviewed-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2025-01-09 18:58:23 +0100