History

fuse: allow idmapped mounts

Now we have everything in place and we can allow idmapped mounts by setting the FS_ALLOW_IDMAP flag. Notice that real availability of idmapped mounts will depend on the fuse daemon. Fuse daemon have to set FUSE_ALLOW_IDMAP flag in the FUSE_INIT reply. To discuss: - we enable idmapped mounts support only if "default_permissions" mode is enabled, because otherwise we would need to deal with UID/GID mappings in the userspace side OR provide the userspace with idmapped req->in.h.uid/req->in.h.gid values which is not something that we probably want to. Idmapped mounts philosophy is not about faking caller uid/gid. Some extra links and examples: - libfuse support https://github.com/mihalicyn/libfuse/commits/idmap_support - fuse-overlayfs support: https://github.com/mihalicyn/fuse-overlayfs/commits/idmap_support - cephfs-fuse conversion example https://github.com/mihalicyn/ceph/commits/fuse_idmap - glusterfs conversion example https://github.com/mihalicyn/glusterfs/commits/fuse_idmap

Alexander Mikhalitsyn committed 2 years ago

Commit 16e15031 parent 6d14b182 files · +28 −4Browse files

Showing the changes to include/uapi (1 of 2 files). Show all

Unified · Split

include/uapi/linux/fuse.h+19−1
@@ -217,6 +217,9 @@ · 216 unmodified lines
217 * - add backing_id to fuse_open_out, add FOPEN_PASSTHROUGH open flag217 * - add backing_id to fuse_open_out, add FOPEN_PASSTHROUGH open flag
218 * - add FUSE_NO_EXPORT_SUPPORT init flag218 * - add FUSE_NO_EXPORT_SUPPORT init flag
219 * - add FUSE_NOTIFY_RESEND, add FUSE_HAS_RESEND init flag219 * - add FUSE_NOTIFY_RESEND, add FUSE_HAS_RESEND init flag
220 *
221 * 7.41
222 * - add FUSE_ALLOW_IDMAP
220 */223 */
221 224
222#ifndef _LINUX_FUSE_H225#ifndef _LINUX_FUSE_H
@@ -252,7 +255,7 @@ · 29 unmodified lines
252#define FUSE_KERNEL_VERSION 7255#define FUSE_KERNEL_VERSION 7
253 256
254/** Minor version number of this interface */257/** Minor version number of this interface */
255#define FUSE_KERNEL_MINOR_VERSION 40258#define FUSE_KERNEL_MINOR_VERSION 41
256 259
257/** The node ID of the root inode */260/** The node ID of the root inode */
258#define FUSE_ROOT_ID 1261#define FUSE_ROOT_ID 1
@@ -421,6 +424,7 @@ struct fuse_file_lock { · 162 unmodified lines
421 * FUSE_NO_EXPORT_SUPPORT: explicitly disable export support424 * FUSE_NO_EXPORT_SUPPORT: explicitly disable export support
422 * FUSE_HAS_RESEND: kernel supports resending pending requests, and the high bit425 * FUSE_HAS_RESEND: kernel supports resending pending requests, and the high bit
423 * of the request ID indicates resend requests426 * of the request ID indicates resend requests
427 * FUSE_ALLOW_IDMAP: allow creation of idmapped mounts
424 */428 */
425#define FUSE_ASYNC_READ (1 << 0)429#define FUSE_ASYNC_READ (1 << 0)
426#define FUSE_POSIX_LOCKS (1 << 1)430#define FUSE_POSIX_LOCKS (1 << 1)
@@ -466,6 +470,7 @@ struct fuse_file_lock { · 39 unmodified lines
466 470
467/* Obsolete alias for FUSE_DIRECT_IO_ALLOW_MMAP */471/* Obsolete alias for FUSE_DIRECT_IO_ALLOW_MMAP */
468#define FUSE_DIRECT_IO_RELAX FUSE_DIRECT_IO_ALLOW_MMAP472#define FUSE_DIRECT_IO_RELAX FUSE_DIRECT_IO_ALLOW_MMAP
473#define FUSE_ALLOW_IDMAP (1ULL << 40)
469 474
470/**475/**
471 * CUSE INIT request/reply flags476 * CUSE INIT request/reply flags
@@ -984,6 +989,19 @@ struct fuse_fallocate_in { · 512 unmodified lines
984 */989 */
985#define FUSE_UNIQUE_RESEND (1ULL << 63)990#define FUSE_UNIQUE_RESEND (1ULL << 63)
986 991
992/**
993 * This value will be set by the kernel to
994 * (struct fuse_in_header).{uid,gid} fields in
995 * case when:
996 * - fuse daemon enabled FUSE_ALLOW_IDMAP
997 * - idmapping information is not available and uid/gid
998 * can not be mapped in accordance with an idmapping.
999 *
1000 * Note: an idmapping information always available
1001 * for inode creation operations like:
1002 * FUSE_MKNOD, FUSE_SYMLINK, FUSE_MKDIR, FUSE_TMPFILE,
1003 * FUSE_CREATE and FUSE_RENAME2 (with RENAME_WHITEOUT).
1004 */
987#define FUSE_INVALID_UIDGID ((uint32_t)(-1))1005#define FUSE_INVALID_UIDGID ((uint32_t)(-1))
988 1006
989struct fuse_in_header {1007struct fuse_in_header {