Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] Missing capability check allows unprivileged FUSE servers to negotiate famfs (devdax) maps. --
--- Patch [2]: [PATCH V11 2/9] famfs_fuse: Basic fuse kernel ABI enablement for famfs --- commit 4d97f5030fb15081e23a077a520a8dbf87b728ec Author: John Groves <[email protected]> famfs_fuse: Basic fuse kernel ABI enablement for famfs This commit adds the initial FUSE plumbing to support famfs (fabric-attached memory file system). It introduces the FUSE_FAMFS_DAX Kconfig option, the FUSE_DAX_FMAP capability flag for INIT negotiation, and a famfs_iomap flag in the fuse connection. > diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c > index 77c21b28b6fa7..c347471d04b6b 100644 > --- a/fs/fuse/inode.c > +++ b/fs/fuse/inode.c > @@ -1406,6 +1406,10 @@ static void process_init_reply(struct fuse_args *args, > int error) > > if (flags & FUSE_REQUEST_TIMEOUT) > timeout = arg->request_timeout; > + > + if (IS_ENABLED(CONFIG_FUSE_FAMFS_DAX) && > + flags & FUSE_DAX_FMAP) > + fc->famfs_iomap = 1; [Severity: High] Does this allow an unprivileged FUSE server to negotiate famfs maps? Since unprivileged users can mount FUSE filesystems in user namespaces, could a malicious server reply with FUSE_DAX_FMAP and enable fc->famfs_iomap without the kernel ever verifying if the mount issuer has privileges like capable(CAP_SYS_RAWIO)? > } else { > ra_pages = fc->max_read / PAGE_SIZE; > fc->no_lock = 1; [ ... ] > @@ -1473,6 +1477,8 @@ static struct fuse_init_args *fuse_new_init(struct > fuse_mount *fm) > flags |= FUSE_SUBMOUNTS; > if (IS_ENABLED(CONFIG_FUSE_PASSTHROUGH)) > flags |= FUSE_PASSTHROUGH; > + if (IS_ENABLED(CONFIG_FUSE_FAMFS_DAX)) > + flags |= FUSE_DAX_FMAP; [Severity: High] Should this flag negotiation be restricted to callers with CAP_SYS_RAWIO? Without a capability check here in fuse_new_init(), FUSE_DAX_FMAP is sent to the server unconditionally if CONFIG_FUSE_FAMFS_DAX is enabled, which might allow unprivileged users to negotiate access to devdax memory mapping. > > /* > * This is just an information flag for fuse server. No need to check -- Sashiko AI review ยท https://sashiko.dev/#/patchset/0100019f7d9fbe81-6cb16662-2522-47ea-a152-fab0ee3d9b35-000...@email.amazonses.com?part=2
