Now we have everything in place and we can allow idmapped mounts by setting the FS_ALLOW_IDMAP flag. Notice that real availability of idmapped mounts will depend on the fuse daemon. Fuse daemon have to set FUSE_ALLOW_IDMAP flag in the FUSE_INIT reply. To discuss: - we enable idmapped mounts support only if "default_permissions" mode is enabled, because otherwise we would need to deal with UID/GID mappings in the userspace side OR provide the userspace with idmapped req->in.h.uid/req->in.h.gid values which is not something that we probably want to. Idmapped mounts philosophy is not about faking caller uid/gid. Some extra links and examples: - libfuse support https://github.com/mihalicyn/libfuse/commits/idmap_support - fuse-overlayfs support: https://github.com/mihalicyn/fuse-overlayfs/commits/idmap_support - cephfs-fuse conversion example https://github.com/mihalicyn/ceph/commits/fuse_idmap - glusterfs conversion example https://github.com/mihalicyn/glusterfs/commits/fuse_idmap
Showing the changes to include/uapi (1 of 2 files). Show all
Unified · Split
| @@ -217,6 +217,9 @@ · 216 unmodified lines | ||
| 217 | 217 | * - add backing_id to fuse_open_out, add FOPEN_PASSTHROUGH open flag |
| 218 | 218 | * - add FUSE_NO_EXPORT_SUPPORT init flag |
| 219 | 219 | * - add FUSE_NOTIFY_RESEND, add FUSE_HAS_RESEND init flag |
| 220 | + * | |
| 221 | + * 7.41 | |
| 222 | + * - add FUSE_ALLOW_IDMAP | |
| 220 | 223 | */ |
| 221 | 224 | |
| 222 | 225 | #ifndef _LINUX_FUSE_H |
| @@ -252,7 +255,7 @@ · 29 unmodified lines | ||
| 252 | 255 | #define FUSE_KERNEL_VERSION 7 |
| 253 | 256 | |
| 254 | 257 | /** Minor version number of this interface */ |
| 255 | −#define FUSE_KERNEL_MINOR_VERSION 40 | |
| 258 | +#define FUSE_KERNEL_MINOR_VERSION 41 | |
| 256 | 259 | |
| 257 | 260 | /** The node ID of the root inode */ |
| 258 | 261 | #define FUSE_ROOT_ID 1 |
| @@ -421,6 +424,7 @@ struct fuse_file_lock { · 162 unmodified lines | ||
| 421 | 424 | * FUSE_NO_EXPORT_SUPPORT: explicitly disable export support |
| 422 | 425 | * FUSE_HAS_RESEND: kernel supports resending pending requests, and the high bit |
| 423 | 426 | * of the request ID indicates resend requests |
| 427 | + * FUSE_ALLOW_IDMAP: allow creation of idmapped mounts | |
| 424 | 428 | */ |
| 425 | 429 | #define FUSE_ASYNC_READ (1 << 0) |
| 426 | 430 | #define FUSE_POSIX_LOCKS (1 << 1) |
| @@ -466,6 +470,7 @@ struct fuse_file_lock { · 39 unmodified lines | ||
| 466 | 470 | |
| 467 | 471 | /* Obsolete alias for FUSE_DIRECT_IO_ALLOW_MMAP */ |
| 468 | 472 | #define FUSE_DIRECT_IO_RELAX FUSE_DIRECT_IO_ALLOW_MMAP |
| 473 | +#define FUSE_ALLOW_IDMAP (1ULL << 40) | |
| 469 | 474 | |
| 470 | 475 | /** |
| 471 | 476 | * CUSE INIT request/reply flags |
| @@ -984,6 +989,19 @@ struct fuse_fallocate_in { · 512 unmodified lines | ||
| 984 | 989 | */ |
| 985 | 990 | #define FUSE_UNIQUE_RESEND (1ULL << 63) |
| 986 | 991 | |
| 992 | +/** | |
| 993 | + * This value will be set by the kernel to | |
| 994 | + * (struct fuse_in_header).{uid,gid} fields in | |
| 995 | + * case when: | |
| 996 | + * - fuse daemon enabled FUSE_ALLOW_IDMAP | |
| 997 | + * - idmapping information is not available and uid/gid | |
| 998 | + * can not be mapped in accordance with an idmapping. | |
| 999 | + * | |
| 1000 | + * Note: an idmapping information always available | |
| 1001 | + * for inode creation operations like: | |
| 1002 | + * FUSE_MKNOD, FUSE_SYMLINK, FUSE_MKDIR, FUSE_TMPFILE, | |
| 1003 | + * FUSE_CREATE and FUSE_RENAME2 (with RENAME_WHITEOUT). | |
| 1004 | + */ | |
| 987 | 1005 | #define FUSE_INVALID_UIDGID ((uint32_t)(-1)) |
| 988 | 1006 | |
| 989 | 1007 | struct fuse_in_header { |