22 #include <sys/prctl.h> 23 #include <sys/syscall.h> 24 #include <linux/capability.h> 25 #include <linux/securebits.h> 27 #if !defined(SECBIT_KEEP_CAPS) && defined(SECURE_KEEP_CAPS) 28 #define SECBIT_KEEP_CAPS (issecure_mask(SECURE_KEEP_CAPS)) 30 #if !defined(SECBIT_KEEP_CAPS_LOCKED) && defined(SECURE_KEEP_CAPS_LOCKED) 31 #define SECBIT_KEEP_CAPS_LOCKED (issecure_mask(SECURE_KEEP_CAPS_LOCKED)) 33 #if !defined(SECBIT_NO_SETUID_FIXUP) && defined(SECURE_NO_SETUID_FIXUP) 34 #define SECBIT_NO_SETUID_FIXUP (issecure_mask(SECURE_NO_SETUID_FIXUP)) 36 #if !defined(SECBIT_NO_SETUID_FIXUP_LOCKED) && defined(SECURE_NO_SETUID_FIXUP_LOCKED) 37 #define SECBIT_NO_SETUID_FIXUP_LOCKED (issecure_mask(SECURE_NO_SETUID_FIXUP_LOCKED)) 39 #if !defined(SECBIT_NOROOT) && defined(SECURE_NOROOT) 40 #define SECBIT_NOROOT (issecure_mask(SECURE_NOROOT)) 42 #if !defined(SECBIT_NOROOT_LOCKED) && defined(SECURE_NOROOT_LOCKED) 43 #define SECBIT_NOROOT_LOCKED (issecure_mask(SECURE_NOROOT_LOCKED)) 49 static char *progname;
51 static char *xstrdup(
const char *s)
55 fprintf(stderr,
"%s: failed to allocate memory\n", progname);
61 static void *xrealloc(
void *oldptr,
size_t size)
63 void *ptr = realloc(oldptr, size);
65 fprintf(stderr,
"%s: failed to allocate memory\n", progname);
71 static void add_arg(
char **cmdp,
const char *opt)
73 size_t optlen = strlen(opt);
74 size_t cmdlen = *cmdp ? strlen(*cmdp) : 0;
75 if (optlen >= (SIZE_MAX - cmdlen - 4)/4) {
76 fprintf(stderr,
"%s: argument too long\n", progname);
79 char *cmd = xrealloc(*cmdp, cmdlen + optlen * 4 + 4);
100 static char *add_option(
const char *opt,
char *options)
102 int oldlen = options ? strlen(options) : 0;
104 options = xrealloc(options, oldlen + 1 + strlen(opt) + 1);
106 strcpy(options, opt);
108 strcat(options,
",");
109 strcat(options, opt);
114 static int prepare_fuse_fd(
const char *mountpoint,
const char* subtype,
119 int subtype_len = strlen(subtype) + 9;
120 char* options_copy = xrealloc(NULL, subtype_len);
122 snprintf(options_copy, subtype_len,
"subtype=%s", subtype);
123 options_copy = add_option(options, options_copy);
129 flags = fcntl(fuse_fd, F_GETFD);
130 if (flags == -1 || fcntl(fuse_fd, F_SETFD, flags & ~FD_CLOEXEC) == 1) {
131 fprintf(stderr,
"%s: Failed to clear CLOEXEC: %s\n",
132 progname, strerror(errno));
140 static uint64_t get_capabilities(
void)
146 struct __user_cap_header_struct header = {
147 .version = _LINUX_CAPABILITY_VERSION_3,
150 struct __user_cap_data_struct data[2];
151 memset(data, 0,
sizeof(data));
152 if (syscall(SYS_capget, &header, data) == -1) {
153 fprintf(stderr,
"%s: Failed to get capabilities: %s\n",
154 progname, strerror(errno));
158 return data[0].effective | ((uint64_t) data[1].effective << 32);
161 static void set_capabilities(uint64_t caps)
167 struct __user_cap_header_struct header = {
168 .version = _LINUX_CAPABILITY_VERSION_3,
171 struct __user_cap_data_struct data[2];
172 memset(data, 0,
sizeof(data));
173 data[0].effective = data[0].permitted = caps;
174 data[1].effective = data[1].permitted = caps >> 32;
175 if (syscall(SYS_capset, &header, data) == -1) {
176 fprintf(stderr,
"%s: Failed to set capabilities: %s\n",
177 progname, strerror(errno));
182 static void drop_and_lock_capabilities(
void)
185 if (prctl(PR_SET_SECUREBITS,
186 SECBIT_KEEP_CAPS_LOCKED |
187 SECBIT_NO_SETUID_FIXUP |
188 SECBIT_NO_SETUID_FIXUP_LOCKED |
190 SECBIT_NOROOT_LOCKED) == -1) {
191 fprintf(stderr,
"%s: Failed to set securebits %s\n",
192 progname, strerror(errno));
198 for (cap = 0; ; cap++) {
199 int cap_status = prctl(PR_CAPBSET_READ, cap);
200 if (cap_status == 0) {
203 if (cap_status == -1 && errno == EINVAL) {
207 if (cap_status != 1) {
209 "%s: Failed to get capability %u: %s\n",
210 progname, cap, strerror(errno));
213 if (prctl(PR_CAPBSET_DROP, cap) == -1) {
215 "%s: Failed to drop capability %u: %s\n",
216 progname, cap, strerror(errno));
224 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1) {
225 fprintf(stderr,
"%s: Failed to set no_new_privs: %s\n",
226 progname, strerror(errno));
232 int main(
int argc,
char *argv[])
236 const char *mountpoint;
238 char *options = NULL;
239 char *command = NULL;
240 char *setuid_name = NULL;
244 int pass_fuse_fd = 0;
245 int drop_privileges = 0;
248 basename = strrchr(argv[0],
'/');
254 if (strncmp(basename,
"mount.fuse.", 11) == 0)
255 type = basename + 11;
256 if (strncmp(basename,
"mount.fuseblk.", 14) == 0)
257 type = basename + 14;
259 if (type && !type[0])
264 "usage: %s %s destination [-t type] [-o opt[,opts...]]\n",
265 progname, type ?
"source" :
"type#[source]");
273 mountpoint = argv[2];
275 for (i = 3; i < argc; i++) {
276 if (strcmp(argv[i],
"-v") == 0) {
278 }
else if (strcmp(argv[i],
"-t") == 0) {
283 "%s: missing argument to option '-t'\n",
288 if (strncmp(type,
"fuse.", 5) == 0)
290 else if (strncmp(type,
"fuseblk.", 8) == 0)
295 "%s: empty type given as argument to option '-t'\n",
299 }
else if (strcmp(argv[i],
"-o") == 0) {
306 opts = xstrdup(argv[i]);
307 opt = strtok(opts,
",");
311 const char *ignore_opts[] = {
"",
320 if (strncmp(opt,
"setuid=", 7) == 0) {
321 setuid_name = xstrdup(opt + 7);
323 }
else if (strcmp(opt,
324 "drop_privileges") == 0) {
329 for (j = 0; ignore_opts[j]; j++)
330 if (strcmp(opt, ignore_opts[j]) == 0)
334 if (strcmp(opt,
"nodev") == 0)
336 else if (strcmp(opt,
"nosuid") == 0)
339 options = add_option(opt, options);
341 opt = strtok(NULL,
",");
346 if (drop_privileges) {
347 uint64_t required_caps = CAP_TO_MASK(CAP_SETPCAP) |
348 CAP_TO_MASK(CAP_SYS_ADMIN);
349 if ((get_capabilities() & required_caps) != required_caps) {
350 fprintf(stderr,
"%s: drop_privileges was requested, which launches the FUSE file system fully unprivileged. In order to do so %s must be run with privileges, please invoke with CAP_SYS_ADMIN and CAP_SETPCAP (e.g. as root).\n",
357 options = add_option(
"dev", options);
359 options = add_option(
"suid", options);
363 type = xstrdup(source);
364 source = strchr(type,
'#');
368 fprintf(stderr,
"%s: empty filesystem type\n",
373 fprintf(stderr,
"%s: empty source\n", progname);
378 if (setuid_name && setuid_name[0]) {
380 if (drop_privileges) {
389 if (prctl(PR_SET_SECUREBITS,
391 SECBIT_NO_SETUID_FIXUP) == -1) {
393 "%s: Failed to set securebits %s\n",
394 progname, strerror(errno));
400 struct passwd *pwd = getpwnam(setuid_name);
401 if (setgid(pwd->pw_gid) == -1 || setuid(pwd->pw_uid) == -1) {
402 fprintf(stderr,
"%s: Failed to setuid to %s: %s\n",
403 progname, setuid_name, strerror(errno));
406 }
else if (!getenv(
"HOME")) {
408 setenv(
"HOME",
"/root", 0);
412 int fuse_fd = prepare_fuse_fd(mountpoint, type, options);
413 char *dev_fd_mountpoint = xrealloc(NULL, 20);
414 snprintf(dev_fd_mountpoint, 20,
"/dev/fd/%u", fuse_fd);
415 mountpoint = dev_fd_mountpoint;
419 if (drop_privileges) {
420 drop_and_lock_capabilities();
423 add_arg(&command, type);
425 add_arg(&command, source);
426 add_arg(&command, mountpoint);
428 add_arg(&command,
"-o");
429 add_arg(&command, options);
432 execl(
"/bin/sh",
"/bin/sh",
"-c", command, NULL);
433 fprintf(stderr,
"%s: failed to execute /bin/sh: %s\n", progname,
int fuse_open_channel(const char *mountpoint, const char *options)