[PATCHSET] libfuse: more random fixes for fuse service containers

[PATCHSET] libfuse: more random fixes for fuse service containers

[Darrick J. Wong]

Hi all,

Here are some miscellaneous fixes for libfuse.

With a bit of luck, this should all go splendidly.
Comments and questions are, as always, welcome.

--D
---
Commits in this patchset:
 * fsmount: don't truncate ms_flags in set_fsconfig_ms_flags
 * mount_service: don't pass the chopped buffer to apply_fsconfig_mount_opts
 * mount_service: call the new fsmount ms_flags helpers in the right order
---
 lib/mount_fsmount.c  |    4 +++-
 util/mount_service.c |   14 ++++++++++----
 2 files changed, 13 insertions(+), 5 deletions(-)

[PATCH 1/3] fsmount: don't truncate ms_flags in set_fsconfig_ms_flags

[Darrick J. Wong]

From: Darrick J. Wong <djwong@kernel.org>

The mount(2) flags (i.e. MS_*) are unsigned long.  Don't truncate them
in this function by assigning to int.

Fixes: 14cb7b93bb9688 ("Add support for the new linux mount API")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
---
 lib/mount_fsmount.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)


diff --git a/lib/mount_fsmount.c b/lib/mount_fsmount.c
index 0f64880e045ba0..83768f0b8d193b 100644
--- a/lib/mount_fsmount.c
+++ b/lib/mount_fsmount.c
@@ -95,7 +95,8 @@ void log_fsconfig_kmsg(int fd)
 
 int set_fsconfig_ms_flags(int fsfd, unsigned long *ms_flags)
 {
-	int ret, flags = *ms_flags;
+	unsigned long flags = *ms_flags;
+	int ret;
 	int i;
 
 	for (i = 0; mount_flags[i].opt != NULL && flags != 0; i++) {

[PATCH 2/3] mount_service: don't pass the chopped buffer to apply_fsconfig_mount_opts

[Darrick J. Wong]

From: Darrick J. Wong <djwong@kernel.org>

If mount_service_handle_mntopts_cmd previously looked at the mount
options to screen for allow_{other,root}, then tokstr (aka oc->value)
has been modified and not put back.  This causes truncation of the mount
options passed to fsconfig, so let's use the snapshot that we took
previously.  Codex noticed this.

Fixes: 7211953256526f ("mount_service: use the fsmount API helpers from mount_fsmount.c")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
---
 util/mount_service.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


diff --git a/util/mount_service.c b/util/mount_service.c
index adcc7a296645ff..360a78bab3bd3d 100644
--- a/util/mount_service.c
+++ b/util/mount_service.c
@@ -994,7 +994,7 @@ static int mount_service_handle_mntopts_cmd(struct mount_service *mo,
 
 #ifdef HAVE_NEW_MOUNT_API
 	if (mo->fsopenfd >= 0) {
-		int ret = apply_fsconfig_mount_opts(mo->fsopenfd, oc->value);
+		int ret = apply_fsconfig_mount_opts(mo->fsopenfd, mntopts);
 
 		if (ret < 0) {
 			free(mntopts);

[PATCH 3/3] mount_service: call the new fsmount ms_flags helpers in the right order

[Darrick J. Wong]

From: Darrick J. Wong <djwong@kernel.org>

Codex noticed a discrepancy between the new fsmount code that Bernd
wrote and my port of the even newer mount service code to use the
helpers that Bernd wrote.  Specifically, set_fsconfig_ms_flags only
clears bits from MS_FLAGS if there's no corresponding MOUNT_ATTR_ flag,
whereas ms_flags_to_mount_attrs always clears them.

In other words, set_fsconfig_ms_flags MUST be called before
ms_flags_to_mount_attrs or we can lose the 'ro' option.  Fix this.

Fixes: 7211953256526f ("mount_service: use the fsmount API helpers from mount_fsmount.c")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
---
 lib/mount_fsmount.c  |    1 +
 util/mount_service.c |   12 +++++++++---
 2 files changed, 10 insertions(+), 3 deletions(-)


diff --git a/lib/mount_fsmount.c b/lib/mount_fsmount.c
index 83768f0b8d193b..7bd772d139808e 100644
--- a/lib/mount_fsmount.c
+++ b/lib/mount_fsmount.c
@@ -35,6 +35,7 @@
 #define MOUNT_ATTR_NOSYMFOLLOW  0x00200000
 #endif
 
+/* Must be called after set_fsconfig_ms_flags */
 unsigned long ms_flags_to_mount_attrs(unsigned long ms_flags,
 				      unsigned int *mount_attrs)
 {
diff --git a/util/mount_service.c b/util/mount_service.c
index 360a78bab3bd3d..f1b61ace526275 100644
--- a/util/mount_service.c
+++ b/util/mount_service.c
@@ -1410,14 +1410,12 @@ static int mount_service_fsopen_mount(struct mount_service *mo,
 				      const struct stat *stbuf)
 {
 	char tmp[64];
-	unsigned long ms_flags;
+	unsigned long ms_flags = ntohl(oc->ms_flags);
 	unsigned int attr_flags;
 	int mfd;
 	int error;
 	int ret;
 
-	ms_flags = ms_flags_to_mount_attrs(ntohl(oc->ms_flags), &attr_flags);
-
 	ret = set_fsconfig_ms_flags(mo->fsopenfd, &ms_flags);
 	if (ret) {
 		error = errno;
@@ -1478,6 +1476,14 @@ static int mount_service_fsopen_mount(struct mount_service *mo,
 		goto fail_fsconfig;
 	}
 
+	ms_flags = ms_flags_to_mount_attrs(ms_flags, &attr_flags);
+	if (ms_flags != 0) {
+		error = ENOTSUP;
+		fprintf(stderr, "%s: unsupported mount flags encountered\n",
+			mo->msgtag);
+		goto fail_fsconfig;
+	}
+
 	mfd = fsmount(mo->fsopenfd, FSMOUNT_CLOEXEC, attr_flags);
 	if (mfd < 0) {
 		error = errno;

Re: [PATCH 3/3] mount_service: call the new fsmount ms_flags helpers in the right order

[Darrick J. Wong]

On Mon, Jun 01, 2026 at 06:53:25PM -0700, Darrick J. Wong wrote:
> From: Darrick J. Wong <djwong@kernel.org>
> 
> Codex noticed a discrepancy between the new fsmount code that Bernd
> wrote and my port of the even newer mount service code to use the
> helpers that Bernd wrote.  Specifically, set_fsconfig_ms_flags only
> clears bits from MS_FLAGS if there's no corresponding MOUNT_ATTR_ flag,
> whereas ms_flags_to_mount_attrs always clears them.
> 
> In other words, set_fsconfig_ms_flags MUST be called before
> ms_flags_to_mount_attrs or we can lose the 'ro' option.  Fix this.
> 
> Fixes: 7211953256526f ("mount_service: use the fsmount API helpers from mount_fsmount.c")
> Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
> ---
>  lib/mount_fsmount.c  |    1 +
>  util/mount_service.c |   12 +++++++++---
>  2 files changed, 10 insertions(+), 3 deletions(-)
> 
> 
> diff --git a/lib/mount_fsmount.c b/lib/mount_fsmount.c
> index 83768f0b8d193b..7bd772d139808e 100644
> --- a/lib/mount_fsmount.c
> +++ b/lib/mount_fsmount.c
> @@ -35,6 +35,7 @@
>  #define MOUNT_ATTR_NOSYMFOLLOW  0x00200000
>  #endif
>  
> +/* Must be called after set_fsconfig_ms_flags */
>  unsigned long ms_flags_to_mount_attrs(unsigned long ms_flags,
>  				      unsigned int *mount_attrs)
>  {
> diff --git a/util/mount_service.c b/util/mount_service.c
> index 360a78bab3bd3d..f1b61ace526275 100644
> --- a/util/mount_service.c
> +++ b/util/mount_service.c
> @@ -1410,14 +1410,12 @@ static int mount_service_fsopen_mount(struct mount_service *mo,
>  				      const struct stat *stbuf)
>  {
>  	char tmp[64];
> -	unsigned long ms_flags;
> +	unsigned long ms_flags = ntohl(oc->ms_flags);
>  	unsigned int attr_flags;
>  	int mfd;
>  	int error;
>  	int ret;
>  
> -	ms_flags = ms_flags_to_mount_attrs(ntohl(oc->ms_flags), &attr_flags);
> -
>  	ret = set_fsconfig_ms_flags(mo->fsopenfd, &ms_flags);
>  	if (ret) {
>  		error = errno;
> @@ -1478,6 +1476,14 @@ static int mount_service_fsopen_mount(struct mount_service *mo,
>  		goto fail_fsconfig;
>  	}
>  
> +	ms_flags = ms_flags_to_mount_attrs(ms_flags, &attr_flags);

NAK, this call should have been moved only to the other side of
set_fsconfig_ms_flags, otherwise the fallback is triggered for any MS_*
flags that could easily be translated into MOUNT_ATTR_* flags.

--D

> +	if (ms_flags != 0) {
> +		error = ENOTSUP;
> +		fprintf(stderr, "%s: unsupported mount flags encountered\n",
> +			mo->msgtag);
> +		goto fail_fsconfig;
> +	}
> +
>  	mfd = fsmount(mo->fsopenfd, FSMOUNT_CLOEXEC, attr_flags);
>  	if (mfd < 0) {
>  		error = errno;
> 
>