[PATCH 6/9] fuse: let the kernel handle KILL_SUID/KILL_SGID for iomap filesystems

Darrick J. Wong
2025-09-16T00:37:37Z

Let the kernel handle killing the suid/sgid bits because the
write/falloc/truncate/chown code already does this, and we don't have to
worry about external modifications that are only visible to the fuse
server (i.e. we're not a cluster fs).

Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
---
fs/fuse/dir.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 8247e5196fd0b2..2e1837b2363e83 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -2268,6 +2268,7 @@ static int fuse_setattr(struct mnt_idmap *idmap, struct dentry *entry,
struct inode *inode = d_inode(entry);
struct fuse_conn *fc = get_fuse_conn(inode);
struct file *file = (attr->ia_valid & ATTR_FILE) ? attr->ia_file : NULL;
+ const bool is_iomap = fuse_inode_has_iomap(inode);
int ret;

if (fuse_is_bad(inode))
@@ -2276,15 +2277,19 @@ static int fuse_setattr(struct mnt_idmap *idmap, struct dentry *entry,
if (!fuse_allow_current_process(get_fuse_conn(inode)))
return -EACCES;

- if (attr->ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID)) {
+ if (!is_iomap &&
+ (attr->ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID))) {
attr->ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID |
ATTR_MODE);

/*
* The only sane way to reliably kill suid/sgid is to do it in
- * the userspace filesystem
+ * the userspace filesystem if this isn't an iomap file. For
+ * iomap filesystems we let the kernel kill the setuid/setgid
+ * bits.
*
- * This should be done on write(), truncate() and chown().
+ * This should be done on write(), truncate(), chown(), and
+ * fallocate().
*/
if (!fc->handle_killpriv && !fc->handle_killpriv_v2) {
/*