Re: [PATCH V11 2/9] famfs_fuse: Basic fuse kernel ABI enablement for famfs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Missing capability check allows unprivileged FUSE servers to negotiate famfs (devdax) maps.
--

--- Patch [2]: [PATCH V11 2/9] famfs_fuse: Basic fuse kernel ABI enablement for famfs ---
commit 4d97f5030fb15081e23a077a520a8dbf87b728ec
Author: John Groves <john@groves.net>

famfs_fuse: Basic fuse kernel ABI enablement for famfs

This commit adds the initial FUSE plumbing to support famfs (fabric-attached
memory file system). It introduces the FUSE_FAMFS_DAX Kconfig option, the
FUSE_DAX_FMAP capability flag for INIT negotiation, and a famfs_iomap flag
in the fuse connection.

> diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
> index 77c21b28b6fa7..c347471d04b6b 100644
> --- a/fs/fuse/inode.c
> +++ b/fs/fuse/inode.c
> @@ -1406,6 +1406,10 @@ static void process_init_reply(struct fuse_args *args, int error)
>  
>  			if (flags & FUSE_REQUEST_TIMEOUT)
>  				timeout = arg->request_timeout;
> +
> +			if (IS_ENABLED(CONFIG_FUSE_FAMFS_DAX) &&
> +			    flags & FUSE_DAX_FMAP)
> +				fc->famfs_iomap = 1;

[Severity: High]
Does this allow an unprivileged FUSE server to negotiate famfs maps?

Since unprivileged users can mount FUSE filesystems in user namespaces,
could a malicious server reply with FUSE_DAX_FMAP and enable
fc->famfs_iomap without the kernel ever verifying if the mount issuer
has privileges like capable(CAP_SYS_RAWIO)?

>  		} else {
>  			ra_pages = fc->max_read / PAGE_SIZE;
>  			fc->no_lock = 1;

[ ... ]

> @@ -1473,6 +1477,8 @@ static struct fuse_init_args *fuse_new_init(struct fuse_mount *fm)
>  		flags |= FUSE_SUBMOUNTS;
>  	if (IS_ENABLED(CONFIG_FUSE_PASSTHROUGH))
>  		flags |= FUSE_PASSTHROUGH;
> +	if (IS_ENABLED(CONFIG_FUSE_FAMFS_DAX))
> +		flags |= FUSE_DAX_FMAP;

[Severity: High]
Should this flag negotiation be restricted to callers with CAP_SYS_RAWIO?

Without a capability check here in fuse_new_init(), FUSE_DAX_FMAP is
sent to the server unconditionally if CONFIG_FUSE_FAMFS_DAX is enabled,
which might allow unprivileged users to negotiate access to devdax
memory mapping.

>  
>  	/*
>  	 * This is just an information flag for fuse server. No need to check

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/0100019f7d9fbe81-6cb16662-2522-47ea-a152-fab0ee3d9b35-000000@email.amazonses.com?part=2