FORTIFY_SOURCE feature of libssp, thus checking the size of arguments to
various string and memory copy and set functions (as well as a few system
calls and other miscellany) where known at function entry. RedHat has
evidently built all "core system packages" with this option for some time.
This option should be used at the top of Makefiles (or Makefile.inc where
this is used for subdirectories) but after any setting of LIB.
This is only useful for userland code, and cannot be used in libc or in
any code which includes the libc internals, because it overrides certain
libc functions with macros. Some effort has been made to make USE_FORT=yes
work correctly for a full-system build by having the bsd.sys.mk logic
disable the feature where it should not be used (libc, libssp iteself,
the kernel) but no attempt has been made to build the entire system with
USE_FORT and doing so will doubtless expose numerous bugs and misfeatures.
Adjust the system build so that all programs and libraries that are setuid,
directly handle network data (including serial comm data), perform
authentication, or appear likely to have (or have a history of having)
data-driven bugs (e.g. file(1)) are built with USE_FORT=yes by default,
with the exception of libc, which cannot use USE_FORT and thus uses
only USE_SSP by default. Tested on i386 with no ill results; USE_FORT=no
per-directory or in a system build will disable if desired.
shouldn't release resources. As a quick hack to prevent double
frees etc, introduce "dead" variable into fuse channel to signal
if the backing puffs resource was already freed. XXX: the check
is only in exit/unmount currently.
Proper fix really depends on some puffs features I still haven't
gotten around to doing.
- make sure that the args array is NULL terminated.
- make sure argc is initialized and argv is set to NULL after freeing.
- make the deep copy function an opt interface function.
up.
- Use malloc and free instead of macros, delete macros.
- Merge the two copies of deep copy and free args that were slightly buggy
into one and use that one.
XXX: Lots of ints should be size_t.
XXX: Bailing on error is not a good thing for a library.
XXX: Defs.h should be eliminated completely. Not all files need all the headers.
determines the API.
Provide a default for FUSE_USE_VERSION if it's not set, and use this
value to determine the number of arguments given to fuse_main().
the end of the argument vector for an argument that doesn't begin with '-',
and use it - this improves upon the previous naive approach of using the
last argument, which could have been placed there by one of the argument
appending functions.
Be consistent with the mount name processing, and always do the
puffs:refuse:filesystem substitution once and once only.
% priv mount.ntfs-3g ntfs-refuse.img /mnt
% df /mnt
Filesystem 1K-blocks Used Avail Capacity Mounted on
puffs:refuse:ntfs-3g 1000943 66309 934634 6% /mnt
% priv umount /mnt
% priv /usr/src/share/examples/refuse/id3fs/id3fs /mnt &
% df /mnt
Filesystem 1K-blocks Used Avail Capacity Mounted on
puffs:refuse:id3fs 0 0 0 100% /mnt
% priv umount /mnt
%
Refuse doessn't have a fuse_common.h, so include fuse_opt.h explicitly
from fuse.h. To avoid circular dependencies, don't include fuse.h
from fuse_opt.h.
This means that we no longer have to modify packages which use the argument
and option parsing routines to include fuse_opt.h.
+ put some meat into the add_arg and insert_arg functions
+ implement the free_args function
+ use 0 and 1 return values, instead of EXIT_SUCCESS and EXIT_FAILURE, in
internal functions (they bear no relation to shell exit values)
+ deep copy argument structures in refuse.c - we need to do this because
some FUSE file systems attempt to obliterate^Wcloak the argument vector
"for security reasons"
+ a side benefit of this is that we get the specific refuse file system
name back again:
[10:48:43] agc@inspiron1300 ...src/lib/librefuse 38 > df
Filesystem 1K-blocks Used Avail Capacity Mounted on
/dev/dk0 28101396 19318530 7377798 72% /
kernfs 1 1 0 100% /kern
procfs 4 4 0 100% /proc
ptyfs 1 1 0 100% /dev/pts
puffs:refuse:id3fs 0 0 0 100% /mnt
[10:48:51] agc@inspiron1300 ...src/lib/librefuse 39 >
only take the bare essentials, which currently means removing
"maxreqlen" from the argument list (all current callers I'm aware
of set it as 0 anyway). Introduce puffs_init(), which provides a
context for setting various parameters and puffs_domount(), which
can be used to mount the file system. Keep puffs_mount() as a
shortcut for the above two for simple file systems.
Bump development ABI version to 13. After all, it's Friday the 13th.
Watch out! Bad things can happen on Friday the 13th. --No carrier--
accessors for interesting data in it. Namely, you can now get
pu->pu_privdata with puffs_getspecific(), pu->pu_pn_root with
puffs_set/getroot() and pu->pu_maxreqlen with puffs_getmaxreqlen().
shell in the fuse_opt functions
+ add new debugging functions:
+ __fuse_debug(), which is used to set and retrieve the
debugging level, so that debugging information can be turned
on and off from the user-level filesystem, and
+ __fuse_pargs(), which prints out an argv vector
+ put the comment about pu_privdata back with the code it references
+ put the code to place the refuse name back into the fuse_new()
function - we have access to all the arguments there.
+ specifically include <fuse_opt.h> in <fuse.h> - this would seem to
be what FUSE itself does, judging by the number of fuse-based
filesystems I've patched to include <fuse_opt.h> specifically
+ do away with the forward reference to struct fuse_args in fuse.h,
since it is defined just after the forward reference without being
referenced in between
+ fill in the missing refuse_opt args functionality - add an arg to the
args structure in fuse_opt_add_arg() and fuse_opt_insert_arg(), and
free allocated memory in fuse_opt_free_args().
+ get rid of spurious forward declarations and prototypes.
+ if REFUSE_INHERIT_FS_CHARACTERISTICS is defined when refuse is built,
file systems inherit the vfs characteristics of their mountpoints. The
default value is NOT to inherit the vfs characteristics.
+ perform a deep copy of the fuse_args structure in fuse_mount() -
this is so that existing FUSE filesystems still DTRT when arguments
are zeroed out.
* Move fuse_opt* funcs from refuse.c into refuse_opt.c.
Implement fuse_opt_parse() and fuse_opt_match(). And make the other
functions just dummy, always returning 0 (I added debugging printfs
to see what the application is trying to do).
For now there are two things that do not work in fuse_opt:
* options accepting arguments, i.e -otimeout=%u or -ofile=%s.
* options without arguments are not enabled, just parsed.
At least now curlftpfs works, even with verbose mode! :-)
Ok'ed by pooka.
is implemented as a very dummy version (i.e. totally unimplemented),
so some effort is still needed there.
After this change it is possible to compile and run ntfs-3g. It
works read/write for ntfs images and shows no faults at least with
superficial testing. I did not test it against a block device,
only an image.
Thanks to Tracy and Jason for help with the test image.
fuse does it: read directory completely into refuse buffers if starting
from read offset 0 and for later calls trickle results from the buffers
to the kernel without consulting the fuse file system.
through fuse_file_info to the fuse open operation.
* reference count opens for each node and do release once the count
drops to zero (instead of waiting for inactive). I'm still not sure
if this exactly matches linux/fuse behaviour, but at least we do
open when a new file descriptor is opened for each node and a do
a release when the reference to the last file descriptor for a
node is closed, so it ought to be pretty close
cryptofs works after these changes
* make set/getattr easily callable from interface functions and sprinkle
calls to locations which require them
* use libpuffs routine for stat->vattr translation instead of homegrown one
* I have concluded that we really want to do release/releasedir in
inactive instead of reclaim. make it so. we'll tweak it for the next
file system which decides it doesn't want to work
after these changes lzofs works, at least for most parts
(I'd assume the non-working parts to fail also on fuse/linux)
ops specified in the fuse op vector (or, if they're missing,
we're SOL)
* great return value overhaul: return -ret to get linuxy -errno
right for the kernel
based on top of libpuffs. This version is still barebones and
incomplete, but will benefit from others working on it, rather than
just me.
The option code has still to be implemented, but this gets far enough
to run hellofs (from the fuse web page):
% priv ./hellofs ~/hellofs/mnt &
% l ~/hellofs/mnt
total 2
drwxr-xr-x 2 root wheel 0 Jan 1 1970 .
drwxr-xr-x 4 agc agc 512 Feb 9 18:05 ..
-r--r--r-- 1 root wheel 13 Jan 1 1970 hello
% cat ~/hellofs/mnt/hello
Hello World!
% df ~/hellofs/mnt
Filesystem 1K-blocks Used Avail Capacity Mounted on
/dev/dk0 28101396 18946682 7749646 70% /
kernfs 1 1 0 100% /kern
procfs 4 4 0 100% /proc
ptyfs 1 1 0 100% /dev/pts
puffs:refuse:hellofs 28101396 18946682 7749646 70% /home/agc/hellofs/mnt
% mount -v -v
...
mount: mount_puffs not found for /home/agc/hellofs/mnt
puffs:refuse:hellofs on /home/agc/hellofs/mnt type puffs (nosuid, nodev, fsid: 0xcb01/0x6acb, reads: sync 0 async 0, writes: sync 0 async 0)
%
This code is not enabled by default. Yet.
