aboutsummaryrefslogtreecommitdiff
path: root/tools/virtiofsd/helper.c
AgeCommit message (Collapse)Author
2020-05-01virtiofsd: stay below fs.file-max sysctl value (CVE-2020-10717)Stefan Hajnoczi
The system-wide fs.file-max sysctl value determines how many files can be open. It defaults to a value calculated based on the machine's RAM size. Previously virtiofsd would try to set RLIMIT_NOFILE to 1,000,000 and this allowed the FUSE client to exhaust the number of open files system-wide on Linux hosts with less than 10 GB of RAM! Take fs.file-max into account when choosing the default RLIMIT_NOFILE value. Fixes: CVE-2020-10717 Reported-by: Yuval Avrahami <yavrahami@paloaltonetworks.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20200501140644.220940-3-stefanha@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2020-05-01virtiofsd: add --rlimit-nofile=NUM optionStefan Hajnoczi
Make it possible to specify the RLIMIT_NOFILE on the command-line. Users running multiple virtiofsd processes should allocate a certain number to each process so that the system-wide limit can never be exhausted. When this option is set to 0 the rlimit is left at its current value. This is useful when a management tool wants to configure the rlimit itself. The default behavior remains unchanged: try to set the limit to 1,000,000 file descriptors if the current rlimit is lower. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20200501140644.220940-2-stefanha@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2020-02-21virtiofsd: Help message fix for 'seconds'Dr. David Alan Gilbert
second should be seconds. Reported-by: Christophe de Dinechin <dinechin@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2020-01-23virtiofsd: add some options to the help messageMasayoshi Mizuma
Add following options to the help message: - cache - flock|no_flock - norace - posix_lock|no_posix_lock - readdirplus|no_readdirplus - timeout - writeback|no_writeback - xattr|no_xattr Signed-off-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com> dgilbert: Split cache, norace, posix_lock, readdirplus off into our own earlier patches that added the options Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2020-01-23virtiofsd: convert more fprintf and perror to use fuse log infraEryu Guan
Signed-off-by: Eryu Guan <eguan@linux.alibaba.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2020-01-23virtiofsd: Support remote posix locksVivek Goyal
Doing posix locks with-in guest kernel are not sufficient if a file/dir is being shared by multiple guests. So we need the notion of daemon doing the locks which are visible to rest of the guests. Given posix locks are per process, one can not call posix lock API on host, otherwise bunch of basic posix locks properties are broken. For example, If two processes (A and B) in guest open the file and take locks on different sections of file, if one of the processes closes the fd, it will close fd on virtiofsd and all posix locks on file will go away. This means if process A closes the fd, then locks of process B will go away too. Similar other problems exist too. This patch set tries to emulate posix locks while using open file description locks provided on Linux. Daemon provides two options (-o posix_lock, -o no_posix_lock) to enable or disable posix locking in daemon. By default it is enabled. There are few issues though. - GETLK() returns pid of process holding lock. As we are emulating locks using OFD, and these locks are not per process and don't return pid of process, so GETLK() in guest does not reuturn process pid. - As of now only F_SETLK is supported and not F_SETLKW. We can't block the thread in virtiofsd for arbitrary long duration as there is only one thread serving the queue. That means unlock request will not make it to daemon and F_SETLKW will block infinitely and bring virtio-fs to a halt. This is a solvable problem though and will require significant changes in virtiofsd and kernel. Left as a TODO item for now. Signed-off-by: Vivek Goyal <vgoyal@redhat.com> Reviewed-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2020-01-23virtiofsd: passthrough_ll: clean up cache related optionsMiklos Szeredi
- Rename "cache=never" to "cache=none" to match 9p's similar option. - Rename CACHE_NORMAL constant to CACHE_AUTO to match the "cache=auto" option. Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2020-01-23virtiofsd: passthrough_ll: control readdirplusMiklos Szeredi
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Reviewed-by: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2020-01-23virtiofsd: print log only when priority is high enoughEryu Guan
Introduce "-o log_level=" command line option to specify current log level (priority), valid values are "debug info warn err", e.g. ./virtiofsd -o log_level=debug ... So only log priority higher than "debug" will be printed to stderr/syslog. And the default level is info. The "-o debug"/"-d" options are kept, and imply debug log level. Signed-off-by: Eryu Guan <eguan@linux.alibaba.com> dgilbert: Reworked for libfuse's log_func Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> with fix by: Signed-off-by: Xiao Yang <yangx.jy@cn.fujitsu.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2020-01-23virtiofsd: add --syslog command-line optionStefan Hajnoczi
Sometimes collecting output from stderr is inconvenient or does not fit within the overall logging architecture. Add syslog(3) support for cases where stderr cannot be used. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> dgilbert: Reworked as a logging function Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2020-01-23virtiofsd: passthrough_ll: add fallback for racy opsMiklos Szeredi
We have two operations that cannot be done race-free on a symlink in certain cases: utimes and link. Add racy fallback for these if the race-free method doesn't work. We do our best to avoid races even in this case: - get absolute path by reading /proc/self/fd/NN symlink - lookup parent directory: after this we are safe against renames in ancestors - lookup name in parent directory, and verify that we got to the original inode, if not retry the whole thing Both utimes(2) and link(2) hold i_lock on the inode across the operation, so a racing rename/delete by this fuse instance is not possible, only from other entities changing the filesystem. If the "norace" option is given, then disable the racy fallbacks. Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Reviewed-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2020-01-23virtiofsd: add --print-capabilities optionStefan Hajnoczi
Add the --print-capabilities option as per vhost-user.rst "Backend programs conventions". Currently there are no advertised features. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2020-01-23virtiofsd: make -f (foreground) the defaultStefan Hajnoczi
According to vhost-user.rst "Backend program conventions", backend programs should run in the foregound by default. Follow the conventions so libvirt and other management tools can control virtiofsd in a standard way. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2020-01-23virtiofsd: Add options for virtioDr. David Alan Gilbert
Add options to specify parameters for virtio-fs paths, i.e. ./virtiofsd -o vhost_user_socket=/tmp/vhostqemu Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2020-01-23virtiofsd: Fix common header and define for QEMU buildsDr. David Alan Gilbert
All of the fuse files include config.h and define GNU_SOURCE where we don't have either under our build - remove them. Fixup path to the kernel's fuse.h in the QEMUs world. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2020-01-23virtiofsd: Fix fuse_daemonize ignored return valuesDr. David Alan Gilbert
QEMU's compiler enables warnings/errors for ignored values and the (void) trick used in the fuse code isn't enough. Turn all the return values into a return value on the function. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2020-01-23virtiofsd: remove mountpoint dummy argumentStefan Hajnoczi
Classic FUSE file system daemons take a mountpoint argument but virtiofsd exposes a vhost-user UNIX domain socket instead. The mountpoint argument is not used by virtiofsd but the user is still required to pass a dummy argument on the command-line. Remove the mountpoint argument to clean up the command-line. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2020-01-23virtiofsd: Format imported files to qemu styleDr. David Alan Gilbert
Mostly using a set like: indent -nut -i 4 -nlp -br -cs -ce --no-space-after-function-call-names file clang-format -style=file -i -- file clang-tidy -fix-errors -checks=readability-braces-around-statements file clang-format -style=file -i -- file With manual cleanups. The .clang-format used is below. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed by: Aleksandar Markovic <amarkovic@wavecomp.com> Language: Cpp AlignAfterOpenBracket: Align AlignConsecutiveAssignments: false # although we like it, it creates churn AlignConsecutiveDeclarations: false AlignEscapedNewlinesLeft: true AlignOperands: true AlignTrailingComments: false # churn AllowAllParametersOfDeclarationOnNextLine: true AllowShortBlocksOnASingleLine: false AllowShortCaseLabelsOnASingleLine: false AllowShortFunctionsOnASingleLine: None AllowShortIfStatementsOnASingleLine: false AllowShortLoopsOnASingleLine: false AlwaysBreakAfterReturnType: None # AlwaysBreakAfterDefinitionReturnType is taken into account AlwaysBreakBeforeMultilineStrings: false BinPackArguments: true BinPackParameters: true BraceWrapping: AfterControlStatement: false AfterEnum: false AfterFunction: true AfterStruct: false AfterUnion: false BeforeElse: false IndentBraces: false BreakBeforeBinaryOperators: None BreakBeforeBraces: Custom BreakBeforeTernaryOperators: false BreakStringLiterals: true ColumnLimit: 80 ContinuationIndentWidth: 4 Cpp11BracedListStyle: false DerivePointerAlignment: false DisableFormat: false ForEachMacros: [ 'CPU_FOREACH', 'CPU_FOREACH_REVERSE', 'CPU_FOREACH_SAFE', 'IOMMU_NOTIFIER_FOREACH', 'QLIST_FOREACH', 'QLIST_FOREACH_ENTRY', 'QLIST_FOREACH_RCU', 'QLIST_FOREACH_SAFE', 'QLIST_FOREACH_SAFE_RCU', 'QSIMPLEQ_FOREACH', 'QSIMPLEQ_FOREACH_SAFE', 'QSLIST_FOREACH', 'QSLIST_FOREACH_SAFE', 'QTAILQ_FOREACH', 'QTAILQ_FOREACH_REVERSE', 'QTAILQ_FOREACH_SAFE', 'QTAILQ_RAW_FOREACH', 'RAMBLOCK_FOREACH' ] IncludeCategories: - Regex: '^"qemu/osdep.h' Priority: -3 - Regex: '^"(block|chardev|crypto|disas|exec|fpu|hw|io|libdecnumber|migration|monitor|net|qapi|qemu|qom|standard-headers|sysemu|ui)/' Priority: -2 - Regex: '^"(elf.h|qemu-common.h|glib-compat.h|qemu-io.h|trace-tcg.h)' Priority: -1 - Regex: '.*' Priority: 1 IncludeIsMainRegex: '$' IndentCaseLabels: false IndentWidth: 4 IndentWrappedFunctionNames: false KeepEmptyLinesAtTheStartOfBlocks: false MacroBlockBegin: '.*_BEGIN$' # only PREC_BEGIN ? MacroBlockEnd: '.*_END$' MaxEmptyLinesToKeep: 2 PointerAlignment: Right ReflowComments: true SortIncludes: true SpaceAfterCStyleCast: false SpaceBeforeAssignmentOperators: true SpaceBeforeParens: ControlStatements SpaceInEmptyParentheses: false SpacesBeforeTrailingComments: 1 SpacesInContainerLiterals: true SpacesInParentheses: false SpacesInSquareBrackets: false Standard: Auto UseTab: Never ... Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2020-01-23virtiofsd: Trim down imported filesDr. David Alan Gilbert
There's a lot of the original fuse code we don't need; trim them down. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> with additional trimming by: Signed-off-by: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Xiao Yang <yangx.jy@cn.fujitsu.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2020-01-23virtiofsd: Add auxiliary .c'sDr. David Alan Gilbert
Add most of the non-main .c files we need from upstream fuse-3.8.0 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-01-08 00:58:07 +0000