hardcoresushi/libgocryptfs
1
0
Fork 0
Code Issues Pull Requests Releases Activity
1,708 Commits 2 Branches 0 Tags 6 MiB
e2dc52a965
Commit Graph

708 Commits

Author SHA1 Message Date
Jakob Unterwurzacher
e2dc52a965 v2api: -sharestorage: disable hard link tracking & add tests 
Hard link tracking was not correctly disabled
since the migration to the go-fuse v2 api.

Add a test to ensure it stays off.

Fixes https://github.com/rfjakob/gocryptfs/issues/525
 2021-03-07 17:22:29 +01:00
Jakob Unterwurzacher
eaca820e87 fusefrontend: do not encrypt ACLs 
Pass through system.posix_acl_access and system.posix_acl_default
unencrypted to fix "cp -a" problems.

"cp -a" uses "setxattr" even to set normal permissions, see
https://www.spinics.net/lists/linux-nfs/msg63986.html .

Fixes https://github.com/rfjakob/gocryptfs/issues/543
 2021-02-07 20:01:16 +01:00
Jakob Unterwurzacher
80a651a194 syscallcompat: MknodatUser: work around changed syscall.Setgroups semantics 
Since go1.16beta1 (commit d1b1145cace8b968307f9311ff611e4bb810710c ,
https://go-review.googlesource.com/c/go/+/210639 )
syscall.{Setgroups,Setregid,Setreuid} affects all threads, which
is exactly what we not want.

We now use unix.{Setgroups,Setregid,Setreuid} instead.

Workarounds https://github.com/golang/go/issues/1435 .
 2021-02-06 11:38:25 +01:00
Jakob Unterwurzacher
bed60101f4 nametransform: make gocryptfs.diriv and gocryptfs.xxx.name files world-readable 
Make `gocryptfs.diriv` and `gocryptfs.xxx.name` files world-readable to make encrypted backups easier
when mounting via fstab.

Having the files follow chmod/chown of their parent does not seem
to be worth the hassle. The content of the diriv files is not
secret, and both diriv and name files are protected by the
perms of the parent dir.

Fixes https://github.com/rfjakob/gocryptfs/issues/539
 2021-01-10 08:07:10 +01:00
Jakob Unterwurzacher
f3394ae286 nametransform: move permission constants to perms.go 
Prep for https://github.com/rfjakob/gocryptfs/issues/539
 2021-01-10 07:27:04 +01:00
gmd20
c20c7992a0 main: add "-kernel_cache" flag 
This option is similar to fuse(8) kernel_cache

Verified using vmtouch.

Without -kernel_cache:

$ dd if=/dev/zero of=foo bs=1M count=10 ; vmtouch -t foo ; vmtouch foo
10+0 records in
10+0 records out
10485760 bytes (10 MB, 10 MiB) copied, 0,0242321 s, 433 MB/s
           Files: 1
     Directories: 0
   Touched Pages: 2560 (10M)
         Elapsed: 0.011159 seconds
           Files: 1
     Directories: 0
  Resident Pages: 0/2560  0/10M  0%
         Elapsed: 0.000993 seconds

With -kernel_cache:

$ dd if=/dev/zero of=foo bs=1M count=10 ; vmtouch -t foo ; vmtouch foo
10+0 records in
10+0 records out
10485760 bytes (10 MB, 10 MiB) copied, 0,0244015 s, 430 MB/s
           Files: 1
     Directories: 0
   Touched Pages: 2560 (10M)
         Elapsed: 0.011564 seconds
           Files: 1
     Directories: 0
  Resident Pages: 2560/2560  10M/10M  100%
         Elapsed: 0.000369 seconds
 2020-12-20 09:55:04 +01:00
Jakob Unterwurzacher
1c1692c4d9 fusefrontend_reverse: fix GETATTR panic 
We don't implement Getattr(), so don't try to call it.

Reported at https://github.com/rfjakob/gocryptfs/issues/519#issuecomment-718790790 :

15:22:53.414101 rx 3344: READ n2565 {Fh 7 [42143744 +131072)  L 0 RDONLY,0x8000}
15:22:53.414274 rx 3342: READ n2565 {Fh 7 [42012672 +131072)  L 0 RDONLY,0x8000}
15:22:53.414787 rx 3346: READ n2565 {Fh 7 [42274816 +131072)  L 0 RDONLY,0x8000}
15:22:53.414806 tx 3336:     OK,  131072b data "\xcb\xd3<\"!-\xa7\xc4"...
15:22:53.414874 rx 3348: GETATTR n1446 {Fh 0}
panic: interface conversion: *fusefrontend_reverse.File is not fs.FileGetattrer: missing method Getattr

goroutine 451 [running]:
github.com/rfjakob/gocryptfs/internal/fusefrontend_reverse.(*Node).Getattr(0xc00034c880, 0x5620579784c0, 0xc000593e60, 0x562057939800, 0xc000218050, 0xc0000fc108, 0x0)
        github.com/rfjakob/gocryptfs/internal/fusefrontend_reverse/node.go:69 +0x273
github.com/hanwen/go-fuse/v2/fs.(*rawBridge).getattr(0xc00011e000, 0x5620579784c0, 0xc000593e60, 0xc00034c880, 0x562057939800, 0xc000218050, 0xc0000fc108, 0xbfded1ef58ba7b13)
        github.com/hanwen/go-fuse/v2@v2.0.4-0.20200908172753-0b6cbc515082/fs/bridge.go:500 +0x2d4
github.com/hanwen/go-fuse/v2/fs.(*rawBridge).GetAttr(0xc00011e000, 0xc0000e0000, 0xc0000fc198, 0xc0000fc108, 0x0)
        github.com/hanwen/go-fuse/v2@v2.0.4-0.20200908172753-0b6cbc515082/fs/bridge.go:488 +0x11c
github.com/hanwen/go-fuse/v2/fuse.doGetAttr(0xc000120000, 0xc0000fc000)
        github.com/hanwen/go-fuse/v2@v2.0.4-0.20200908172753-0b6cbc515082/fuse/opcode.go:287 +0x6f
github.com/hanwen/go-fuse/v2/fuse.(*Server).handleRequest(0xc000120000, 0xc0000fc000, 0xc000000000)
        github.com/hanwen/go-fuse/v2@v2.0.4-0.20200908172753-0b6cbc515082/fuse/server.go:472 +0x2c1
github.com/hanwen/go-fuse/v2/fuse.(*Server).loop(0xc000120000, 0xc000288001)
        github.com/hanwen/go-fuse/v2@v2.0.4-0.20200908172753-0b6cbc515082/fuse/server.go:445 +0x18c
created by github.com/hanwen/go-fuse/v2/fuse.(*Server).readRequest
        github.com/hanwen/go-fuse/v2@v2.0.4-0.20200908172753-0b6cbc515082/fuse/server.go:312 +0x419
 2020-11-10 19:37:49 +01:00
Jakob Unterwurzacher
832e58cad4 Drop two more generated files 
These were committed by mistake.
 2020-10-19 19:27:47 +02:00
Jakob Unterwurzacher
165bf6c849 Drop generated files 
These were committed by mistake.
 2020-10-19 19:25:47 +02:00
Jakob Unterwurzacher
6697ffd6e2 fusefronted: reject GETXATTR "security.capability" 
Unless we are mounted with -suid, we can reject
these requests, and gain back some lost speed.

Closes https://github.com/rfjakob/gocryptfs/issues/515
 2020-10-18 21:07:30 +02:00
Jakob Unterwurzacher
c943ed32aa syscallcompat: add getxattr fastpaths 
The allocations from Lgetxattr were #1 in the tar extract
allocation profile (caused by security.capability lookups).
No more!

$ benchstat old.txt new.txt
name         old time/op  new time/op  delta
Lgetxattr-4  15.2µs ± 0%   1.8µs ± 0%   ~     (p=1.000 n=1+1)

$ ./benchmark.bash
Testing gocryptfs at /tmp/benchmark.bash.H8p: gocryptfs v2.0-beta1-4-g95ea738-dirty; go-fuse v2.0.4-0.20200908172753-0b6cbc515082 => github.com/rfjakob/go-fuse/v2 v2.0.4-0.20201015204057-88b12c99f8af; 2020-10-18 go1.15.3 linux/amd64
/tmp/benchmark.bash.H8p.mnt is a mountpoint
WRITE: 262144000 bytes (262 MB, 250 MiB) copied, 0,520109 s, 504 MB/s
READ:  262144000 bytes (262 MB, 250 MiB) copied, 0,255672 s, 1,0 GB/s
UNTAR: 30,238
MD5:   12,721
LS:    10,038
RM:    16,536
 2020-10-18 00:25:42 +02:00
Jakob Unterwurzacher
83a324a46b syscallcompat: add Lgetxattr benchmark 2020-10-16 20:04:22 +02:00
Jakob Unterwurzacher
fcb28e4ff3 v2pai: delete fusefrontend_reverse_v1api 
Served its mission a copy-paste source but can now be deleted.
 2020-10-15 23:18:21 +02:00
Jakob Unterwurzacher
ec3eaf0b87 syscallcompat: don't retry Close() 
After Close() returns, the fd is dead, even if we
received EINTR. Don't retry, we could shoot down
an unrelated fd that received the same fd number.
 2020-10-14 13:40:12 +02:00
Jakob Unterwurzacher
af4c1fb7a3 syscallcompat: retry ops on EINTR 
Retry operations that have been shown to throw EINTR
errors on CIFS.

Todo: Solution for this pain in the back:

	warning: unix.Getdents returned errno 2 in the middle of data
	rm: cannot remove 'linux-3.0.old3/Documentation/ABI/removed': Input/output error

Progress towards fixing https://github.com/rfjakob/gocryptfs/issues/483 .
 2020-10-14 00:35:16 +02:00
Jakob Unterwurzacher
803fdf410b syscallcompat: Openat: retry on EINTR 
Towards fixing https://github.com/rfjakob/gocryptfs/issues/507
 2020-10-11 01:31:09 +02:00
Pavol Rusnak
1e624a4cc3 Add support for FIDO2 tokens 2020-09-12 18:06:54 +02:00
Jakob Unterwurzacher
ac687d5359 v2api: add Darwin xattr support 2020-09-09 11:17:19 +02:00
Jakob Unterwurzacher
8b1df08b8a syscallcompat: add Renameat2 for Darwin 2020-09-09 11:16:29 +02:00
Jakob Unterwurzacher
598e5f385e v2api/reverse: update TODO comment on xattrs 2020-08-30 16:39:46 +02:00
Jakob Unterwurzacher
d212b246c5 v2api/reverse: implement Lseek 2020-08-16 19:58:47 +02:00
Jakob Unterwurzacher
58a2726977 v2api/reverse: implement Statfs 2020-08-16 19:41:00 +02:00
Jakob Unterwurzacher
6f3cca2cdd v2api: clean up api TODOs 2020-08-16 13:52:27 +02:00
Jakob Unterwurzacher
ee5ab1cc29 v2api: rename "File2" to just "File" 
Rename the symbols and the files.
 2020-08-16 12:50:33 +02:00
Jakob Unterwurzacher
94e8fc12ea v2api/reverse: finish -exclude 
Tests pass now.
 2020-08-15 17:31:45 +02:00
Jakob Unterwurzacher
15b0b4a5fd v2api/reverse: start wiring up -exclude functionality 
Exclude in readdir is missing.
 2020-08-15 16:08:16 +02:00
Jakob Unterwurzacher
1ea1b179c2 v2api/reverse: fix two fd leaks 2020-08-15 15:28:40 +02:00
Jakob Unterwurzacher
35055030a1 v2api/reverse: implement ctlsocksrv.Interface 2020-08-15 15:08:28 +02:00
Jakob Unterwurzacher
b6580a87e5 v2api/reverse: implement gocryptfs.conf mapping with -plaintextnames 2020-08-15 15:05:25 +02:00
Jakob Unterwurzacher
6d4f1a6888 v2api/reverse: implement Read 2020-08-09 22:11:46 +02:00
Jakob Unterwurzacher
5276092663 v2api/reverse: implement Readlink 2020-08-08 18:45:47 +02:00
Jakob Unterwurzacher
84ed139cd2 v2api/reverse: implement Lookup for longname 2020-08-02 19:33:12 +02:00
Jakob Unterwurzacher
4674bac838 v2api/reverse: implement Lookup for gocryptfs.conf & gocryptfs.diriv 2020-08-02 13:25:53 +02:00
Jakob Unterwurzacher
47d8f56b7f v2api/reverse: add missing decryptPath call openBackingDir 2020-08-01 23:06:35 +02:00
Jakob Unterwurzacher
6c26cda531 v2api/reverse: implement Readdir 2020-08-01 22:28:25 +02:00
Jakob Unterwurzacher
f54d21c384 v2api/reverse: implement Lookup & Getattr 2020-08-01 21:14:33 +02:00
Jakob Unterwurzacher
18b3bdb158 v2api/reverse: start fusefrontend_reverse v2 API implementation 2020-08-01 21:14:17 +02:00
Jakob Unterwurzacher
13dc7657ba v2api/reverse: move old fusefrontend_reverse out of the way 
fusefrontend_reverse -> fusefrontend_reverse_v1api
 2020-08-01 21:14:10 +02:00
Jakob Unterwurzacher
dd3d8c100b fusefrontend_reverse: collapse getFileType 2020-08-01 20:28:06 +02:00
Jakob Unterwurzacher
1867fdaef4 v2api: move helpers from node.go to node_helpers.go 2020-08-01 19:26:42 +02:00
Jakob Unterwurzacher
4572cd2103 v2api: fix missing size translation in Lookup 2020-07-26 19:49:26 +02:00
Jakob Unterwurzacher
777b95f82f v2api: delete (most) fusefrontend v1 files 
All the functionality in these files has been reimplemented
for the v2 api. Drop the old files.
 2020-07-26 18:35:12 +02:00
Jakob Unterwurzacher
9cd24d79a2 v2api: implement Lseek 
This also fixes the last remaining tests/fsck failure.
 2020-07-23 22:55:07 +02:00
Jakob Unterwurzacher
49fc3abcb4 v2api: Lookup: use newChild() helper 2020-07-19 13:15:18 +02:00
Jakob Unterwurzacher
6b7ff09373 v2api: Node: make Path() public 
Helpful for fsck.
 2020-07-18 23:40:54 +02:00
Jakob Unterwurzacher
7eae35e2d3 v2api: implement ctlsocksrv.Interface 2020-07-17 22:14:40 +02:00
Jakob Unterwurzacher
57d572dbc1 v2api: implement Getxattr, Setxattr, Removexattr, Listxattr 
gocryptfs/tests/xattr passes.
 2020-07-14 19:55:20 +02:00
Jakob Unterwurzacher
4a0966e79e v2api: Setattr: fill out structure 2020-07-12 21:17:52 +02:00
Jakob Unterwurzacher
ca5acae6f0 v2api: fix Mkfifo 2020-07-12 20:19:29 +02:00
Jakob Unterwurzacher
0fa824933c v2api: properly implement Node.Setattr 
We used to always open a *File2 and letting the *File2
handle Setattr. This does not work it we cannot open the file!

Before:

    $ go test
    2020/07/12 20:14:57 writer: Write/Writev failed, err: 2=no such file or directory. opcode: INTERRUPT
    2020/07/12 20:14:57 writer: Write/Writev failed, err: 2=no such file or directory. opcode: INTERRUPT
    --- FAIL: TestLchown (0.00s)
        matrix_test.go:634: lchown /tmp/gocryptfs-test-parent-1026/014500839/default-plain/symlink: too many levels of symbolic links
    touch: setting times of '/tmp/gocryptfs-test-parent-1026/014500839/default-plain/utimesnano_symlink': Too many levels of symbolic links
    --- FAIL: TestUtimesNanoSymlink (0.00s)
        matrix_test.go:655: exit status 1
    --- FAIL: TestMkfifo (0.00s)
        matrix_test.go:755: file exists
    --- FAIL: TestMagicNames (0.00s)
        matrix_test.go:773: Testing n="gocryptfs.longname.QhUr5d9FHerwEs--muUs6_80cy6JRp89c1otLwp92Cs"
        matrix_test.go:773: Testing n="gocryptfs.diriv"
        matrix_test.go:815: open /tmp/gocryptfs-test-parent-1026/014500839/default-plain/linktarget: permission denied
    --- FAIL: TestChmod (0.00s)
        matrix_test.go:840: chmod 444 -> 000 failed: permission denied
        matrix_test.go:840: chmod 444 -> 111 failed: permission denied
        matrix_test.go:840: chmod 444 -> 123 failed: permission denied
        matrix_test.go:840: chmod 444 -> 321 failed: permission denied
    FAIL
    exit status 1
    FAIL	github.com/rfjakob/gocryptfs/tests/matrix	0.790s

After:

    $ go test
    --- FAIL: TestMkfifo (0.00s)
        matrix_test.go:755: file exists
    --- FAIL: TestMagicNames (0.00s)
        matrix_test.go:773: Testing n="gocryptfs.longname.QhUr5d9FHerwEs--muUs6_80cy6JRp89c1otLwp92Cs"
        matrix_test.go:773: Testing n="gocryptfs.diriv"
        matrix_test.go:815: open /tmp/gocryptfs-test-parent-1026/501766059/default-plain/linktarget: permission denied
    --- FAIL: TestChmod (0.00s)
        matrix_test.go:849: modeHave 0644 != modeWant 0
    FAIL
    exit status 1
    FAIL    github.com/rfjakob/gocryptfs/tests/matrix   0.787s
 2020-07-12 20:17:15 +02:00