From 989db66818a40b48da6ff06329ff2f5d0c866f93 Mon Sep 17 00:00:00 2001 From: Jimmy Zuber Date: Thu, 20 Aug 2026 13:01:57 +0000 Subject: fuse: allow FUSE_SYNCFS for privileged userspace servers Propagating syncfs()/sync() to a FUSE server via FUSE_SYNCFS lets the server flush its own cached or intermediate state when userspace asks the filesystem to sync. This is currently enabled only for virtiofs and fuseblk, because an untrusted server can use it to stall sync() indefinitely (see commit 2d82ab251ef0 ("virtiofs: propagate sync() to file server"), and commit d3906d8f3cee ("fuse: enable FUSE_SYNCFS for all fuseblk servers")). Both of those mount types require host privilege to set up, so the server is trusted not to abuse it. There is nothing virtiofs- or block-specific about wanting to handle syncfs(), though. A plain /dev/fuse server is just as entitled to participate in the sync() path -- so that data it has buffered reaches stable storage when the user asks for it -- provided it is equally trusted. The trust property that virtiofs and fuseblk satisfy is that neither can be mounted without CAP_SYS_ADMIN in the initial user namespace (neither sets FS_USERNS_MOUNT). A plain fuse mount does set FS_USERNS_MOUNT, so its existence guarantees no such privilege; the privilege has to be checked rather than assumed. Add an opt-in INIT flag, FUSE_HAS_SYNCFS, and honor it only when the server opened /dev/fuse with CAP_SYS_ADMIN in the initial user namespace, recorded at mount time via file_ns_capable(). This is the same privilege that mounting virtiofs or fuseblk requires, applied to the process that actually services (and could stall) the connection. Checking the device opener's capability -- rather than the mount's user namespace -- avoids treating an unprivileged server that merely happens to run in the initial user namespace (e.g. a normal sshfs mount) as trusted. The flag is only advertised to servers that pass this check, so an unprivileged server is never invited to opt in (and is ignored by fuse_syncfs_enable() if it sets the flag anyway). Signed-off-by: Jimmy Zuber Assisted-by: Claude:claude-opus-4-8 [Claude-Code] Signed-off-by: Miklos Szeredi --- include/uapi/linux/fuse.h | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) (limited to 'include/uapi') diff --git a/include/uapi/linux/fuse.h b/include/uapi/linux/fuse.h index 7435e09c87fe..10a7f31c4bdf 100644 --- a/include/uapi/linux/fuse.h +++ b/include/uapi/linux/fuse.h @@ -248,6 +248,9 @@ * - add bufpool offset field to fuse_uring_ent_in_out struct * - add FUSE_URING_ZERO_COPY, FUSE_URING_ENT_ZERO_COPY, and * FOPEN_IO_URING_ZERO_COPY flag + * + * 7.47 + * - add FUSE_HAS_SYNCFS opt-in flag for privileged userspace servers */ #ifndef _LINUX_FUSE_H @@ -283,7 +286,7 @@ #define FUSE_KERNEL_VERSION 7 /** Minor version number of this interface */ -#define FUSE_KERNEL_MINOR_VERSION 46 +#define FUSE_KERNEL_MINOR_VERSION 47 /** The node ID of the root inode */ #define FUSE_ROOT_ID 1 @@ -464,6 +467,12 @@ struct fuse_file_lock { * FUSE_REQUEST_TIMEOUT: kernel supports timing out requests. * init_out.request_timeout contains the timeout (in secs) * FUSE_HAS_IO_URING_BUFPOOL: kernel supports io-uring buffer pools + * FUSE_HAS_SYNCFS: server requests that syncfs()/sync() be propagated as + * FUSE_SYNCFS requests. Since an untrusted server can use this + * to stall sync(), it is only honored when /dev/fuse was opened + * with CAP_SYS_ADMIN in the initial user namespace (the same + * privilege that mounting virtiofs or fuseblk requires). + * Insufficiently privileged servers ignore it. */ #define FUSE_ASYNC_READ (1 << 0) #define FUSE_POSIX_LOCKS (1 << 1) @@ -512,6 +521,7 @@ struct fuse_file_lock { #define FUSE_OVER_IO_URING (1ULL << 41) #define FUSE_REQUEST_TIMEOUT (1ULL << 42) #define FUSE_HAS_IO_URING_BUFPOOL (1ULL << 43) +#define FUSE_HAS_SYNCFS (1ULL << 44) /** * CUSE INIT request/reply flags -- cgit v1.2.3