aboutsummaryrefslogtreecommitdiff
path: root/internal/fusefrontend
AgeCommit message (Collapse)Author
2019-01-20fusefrontend: ensure directories without W or X perms can be deletedJakob Unterwurzacher
This fixed the "Permission denied" bug, but still has the problem that the directory may be replaced behind our back. Mitigated by the fact that we skip the workaround when running as root with -allow_other. https://github.com/rfjakob/gocryptfs/issues/354
2019-01-20Revert "syscallcompat: drop Faccessat AT_SYMLINK_NOFOLLOW helper"Jakob Unterwurzacher
Breaks mounting on MacOS: unix.Faccessat on Darwin does NOT (yet) support AT_SYMLINK_NOFOLLOW. See d44fe89ba4f3252c5bd00c4f7730197732f2a26a . This reverts commit 0805a63df1b5f915b228727f6074c2506922d0ad.
2019-01-20syscallcompat: drop Faccessat AT_SYMLINK_NOFOLLOW helperJakob Unterwurzacher
unix.Faccessat has added support for AT_SYMLINK_NOFOLLOW in July 2018, https://github.com/golang/sys/commit/bd9dbc187b6e1dacfdd2722a87e83093c2d7bd6e#diff-341484dbbe3180cd7a31ef2ad2d679b6 which means we no longer need our own helper. Closes https://github.com/rfjakob/gocryptfs/issues/347
2019-01-16fusefrontend: Always use intFd() method instead of int(f.fd.Fd()).Sebastian Lackner
2019-01-16fusefrontend: Rework the Utimens handling on macOS.Sebastian Lackner
For Linux, everything effectively stays the same. For both path-based and fd-based Utimens() calls, we use unix.UtimesNanoAt(). To avoid introducing a separate syscall wrapper for futimens() (as done in go-fuse, for example), we instead use the /proc/self/fd - trick. On macOS, this changes quite a lot: * Path-based Utimens() calls were previously completely broken, since unix.UtimensNanoAt() ignores the passed file descriptor. Note that this cannot be fixed easily since there IS no appropriate syscall available on macOS prior to High Sierra (10.13). We emulate this case by using Fchdir() + setattrlist(). * Fd-based Utimens() calls were previously translated to f.GetAttr() (to fill any empty parameters) and syscall.Futimes(), which does not does support nanosecond precision. Both issues can be fixed by switching to fsetattrlist(). Fixes https://github.com/rfjakob/gocryptfs/issues/350
2019-01-15fusefrontend: Print 'too many open files' warning for both short and long names.Sebastian Lackner
While we're at it, also replace os.* constants with syscall.* constants.
2019-01-14syscallcompat: rework Fchmodat to FchmodatNofollowJakob Unterwurzacher
We never want Fchmodat to follow symlinks, so follow what Qemu does, and call our function FchmodatNofollow.
2019-01-13fusefrontend: drop last remaining call into loopbackFileSystemJakob Unterwurzacher
The only call forwarded to loopbackFileSystem was Statfs, which is trivial to implement. Implement it and drop loopbackFileSystem, as having it carries the risk that a coding error bypasses the usual encryption/decryption chain.
2019-01-13fusefrontend: Do not pass unsupported flags to Faccessat on macOS.Sebastian Lackner
Fixes mounting of forward mounts on macOS High Sierra.
2019-01-12fusefrontend: Preserve SUID/SGID/sticky-bits in openWriteOnlyFile and Rmdir.Sebastian Lackner
Fixes https://github.com/rfjakob/gocryptfs/issues/336 and https://github.com/rfjakob/gocryptfs/issues/337.
2019-01-12fusefrontend: -allow_other: Use SymlinkatUser in Symlink FUSE call.Sebastian Lackner
Instead of manually adjusting the user after creating the symlink, adjust effective permissions and let the kernel deal with it. Related to https://github.com/rfjakob/gocryptfs/issues/338.
2019-01-12fusefrontend: -allow_other: Use MknodatUser in Mknod FUSE call.Sebastian Lackner
Instead of manually adjusting the user and mode after creating the device file, adjust effective permissions and let the kernel deal with it. Related to https://github.com/rfjakob/gocryptfs/issues/338.
2019-01-12fusefrontend: -allow_other: Use MkdiratUser in Mkdir FUSE call.Sebastian Lackner
Revert commit fcaca5fc94d981aa637beb752edc8cb3c2265e96. Instead of manually adjusting the user and mode after creating the directory, adjust effective permissions and let the kernel deal with it. Related to https://github.com/rfjakob/gocryptfs/issues/338.
2019-01-12fusefrontend: -allow_other: Use OpenatUser in Create FUSE call.Sebastian Lackner
Revert commit b22cc03c7516b2003880db8375d26c76d6dff093. Instead of manually adjusting the user and mode after creating the file, adjust effective permissions and let the kernel deal with it. Related to https://github.com/rfjakob/gocryptfs/issues/338.
2019-01-12fusefrontend: Don't chown gocryptfs.diriv files.Sebastian Lackner
The current code has a risk of race-conditions, since we pass a path containing "/" to Fchownat. We could fix this by opening a file descriptor, however, this does not seem worth the effort. We also don't chown *.name files.
2019-01-09fusefrontend: -allow_other: set file mode after chown in Mkdir().Sebastian Lackner
Make sure that the directory belongs to the correct owner before users can access it. For directories with SUID/SGID mode, there is a risk of race-conditions when files are created before the correct owner is set. They will then inherit the wrong user and/or group. See https://github.com/rfjakob/gocryptfs/issues/327 for more details.
2019-01-08fusefrontend: -allow_other: set file mode *after* chown in Create()Jakob Unterwurzacher
Reported by @slackner at https://github.com/rfjakob/gocryptfs/issues/327 : Possible race-conditions between file creation and Fchownat * Assume a system contains a gocryptfs mount as root user with -allow_other * As a regular user create a new file with mode containing the SUID flag and write access for other users * Before gocryptfs executes the Fchownat call, try to open the file again, write some exploit code to it, and try to run it. For a short time, the file is owned by root and has the SUID flag, so this is pretty dangerous.
2019-01-07fusefrontend: Clarify access mode check related to O_WRONLY handling.Sebastian Lackner
Use O_ACCMODE mask in openWriteOnlyFile for improved readability.
2019-01-07fusefrontend: Filter O_CREAT in mangleOpenFlags.Sebastian Lackner
2019-01-06fusefrontend: Check result of Fchmod syscall.Sebastian Lackner
Fixes https://github.com/rfjakob/gocryptfs/issues/328
2019-01-06fusefrontend: Fix computation of cipherSz in Allocate FUSE call.Sebastian Lackner
Do not use PlainSizeToCipherSize() since this adds the 18 bytes file header. Partially fixes https://github.com/rfjakob/gocryptfs/issues/311
2019-01-06fusefrontend: Properly convert plaintext <-> ciphertext offsets in SeekData().Sebastian Lackner
Fixes https://github.com/rfjakob/gocryptfs/issues/304
2019-01-05main: Run 'ensure fds' code early during the program startup.Sebastian Lackner
The files are apparently processed in alphabetic order, so cli_args.go is processed before main.go. In order to run before the go-fuse imports, put the 'ensure fds' code in a separate package. Debug messages are omitted to avoid additional imports (that might contain other code messing up our file descriptors).
2019-01-05fusefrontend: Allow to set/remove xattr on directory without read permission.Sebastian Lackner
Setting/removing extended attributes on directories was partially fixed with commit eff35e60b63331e3e10f921792baa10b236a721d. However, on most file systems it is also possible to do these operations without read access (see tests). Since we cannot open a write-access fd to a directory, we have to use the /proc/self/fd trick (already used for ListXAttr) for the other operations aswell. For simplicity, let's separate the Linux and Darwin code again (basically revert commit f320b76fd189a363a34bffe981aa67ab97df3362), and always use the /proc/self/fd trick on Linux. On Darwin we use the best-effort approach with openBackingFile() as a fallback. More discussion about the available options is available in https://github.com/rfjakob/gocryptfs/issues/308.
2019-01-05A few more spelling fixes.Sebastian Lackner
2019-01-04tests: bump maxCacheFds to 3Jakob Unterwurzacher
As the dirCache now has 3 entries, the tests should accept up to 3 extra fds without declaring an fd leak.
2019-01-04fusefrontend: fix fd leak in dirCacheJakob Unterwurzacher
The missing break meant that we may find a second hit in the cache, Dup() a second fd, and leak the first one. Thanks @slackner for finding this.
2019-01-04fusefrontend: print warning when Create() runs out of file descriptorsJakob Unterwurzacher
We alread have this warning in Open(), but xfstests generic/488 causes "too many open files" via Create. Add the same message so the user sees what is going on.
2019-01-04fusefrontend: fix setting xattrs on directoriesJakob Unterwurzacher
Directories cannot be opened read-write. Retry with RDONLY.
2019-01-04fusefrontend: disable dirCache stats printingJakob Unterwurzacher
This was inadvertedly kept enabled after benchmarking.
2019-01-04fusefrontend: upgrade to three-entry dirCachev1.7-rc1Jakob Unterwurzacher
3 entries should work well for up to three parallel users. It works well for extractloop.bash (two parallel tar extracts).
2019-01-04fusefrontend: Allow to create sparse file of size 4096.Sebastian Lackner
When the old size is zero, there are no existing blocks to merge the new data with. Directly use Ftruncate if the size is block-aligned. Fixes https://github.com/rfjakob/gocryptfs/issues/305
2019-01-04A few more spelling fixes.Sebastian Lackner
Found with the 'codespell' utility.
2019-01-03Omit syscall.O_RDONLY flag when passing O_PATH.Sebastian Lackner
When O_PATH is specified in flags, flag bits other than O_CLOEXEC, O_DIRECTORY, and O_NOFOLLOW are ignored.
2019-01-03fusefrontend: Use appropriate flags in decryptPathAt.Sebastian Lackner
2019-01-03fusefrontend: Open directory with syscall.O_DIRECTORY in OpenDir.Sebastian Lackner
2019-01-03fusefrontend: Open directory with syscall.O_DIRECTORY in Rmdir.Sebastian Lackner
2019-01-03fusefrontend: Do not Clear cache at end of Rmdir function.Sebastian Lackner
We already do 'defer fs.dirCache.Clear()', so this is no longer required.
2019-01-03fusefrontend: Remove debug code.Sebastian Lackner
This code was accidentially added in 4f66d66755da63c78b09201c6c72353009251cf2.
2019-01-03fusefronted: dirCache: fix bug handling ""Jakob Unterwurzacher
Bug looked like this: $ ls -l . total 0 drwxrwxr-x. 2 jakob jakob 60 Jan 3 15:42 foo -rw-rw-r--. 1 jakob jakob 0 Jan 3 15:46 x $ ls -l . ls: cannot access '.': No such file or directory (only happened when "" was in the dirCache)
2019-01-03fusefrontend: add dirCacheJakob Unterwurzacher
2019-01-03nametransform: simplify WriteDirIV to WriteDirIVAtJakob Unterwurzacher
Un-spaghettify the function and let the callers open the directory.
2019-01-02fusefrontend: use O_RDONLY in the ListXAttr fallback pathJakob Unterwurzacher
Copy-paste error. https://github.com/rfjakob/gocryptfs/issues/308
2019-01-02fusefrontend: move openBackingDir into its own fileJakob Unterwurzacher
This function is in all fastpaths, will get a cache, and needs its own file. renamed: internal/fusefrontend/names.go -> internal/fusefrontend/openbackingdir.go renamed: internal/fusefrontend/names_test.go -> internal/fusefrontend/openbackingdir_test.go
2019-01-02fusefronted: make EncryptPath symlink-safeJakob Unterwurzacher
Finally allows us to delete EncryptPathDirIV.
2019-01-02fusefrontend: xattr: fix operations on files without read permissionsJakob Unterwurzacher
* listxattr is fixed via the /proc/self/fd trick * setxattr,removexattr are fixed by opening the file O_WRONLY Fixes https://github.com/rfjakob/gocryptfs/issues/308
2019-01-02fusefrontend: don't downgrade type needlesslyJakob Unterwurzacher
2019-01-02fusefrontend: use Fsetxattr/Fgetxattr/etc on all platformsJakob Unterwurzacher
Darwin now also has these functions, use them. Simplifies the code and makes it symlink-safe on Darwin as well.
2019-01-02fusefrontend: openBackingDir: fix fd leak in error pathJakob Unterwurzacher
Reported by @slackner at https://github.com/rfjakob/gocryptfs/commit/932efbd4593fe6be6c86f0dafeaea32910b7c246#r31813373 thanks!
2019-01-01fusefrontend: fix fd leak in error pathJakob Unterwurzacher
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-02 21:55:42 +0000