[PATCH 1/2] fuse2fs: fix normal (non-kernel) permissions checking

Commit 9f69dfc4e275 ("fuse2fs: implement O_APPEND correctly") defined
a new flag, A_OK, to add support for testing whether the file is valid
for append operations.  This is relevant for the check_iflags_access()
function, but when are later testing operations mask against the inode
permissions, this new flag gets in the way and causes non-root users
attempting to create new inodes in a directory to fail.  Fix this by
masking off A_OK before doing these tests.

Fixes: 9f69dfc4e275 ("fuse2fs: implement O_APPEND correctly")
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
---
 misc/fuse2fs.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/misc/fuse2fs.c b/misc/fuse2fs.c
index bb75d9421..d209bc790 100644
--- a/misc/fuse2fs.c
+++ b/misc/fuse2fs.c

@@ -687,6 +687,9 @@ static int check_inum_access(struct fuse2fs *ff, ext2_ino_t ino, int mask)
 		return -EACCES;
 	}
 
+	/* Remove the O_APPEND flag before testing permissions */
+	mask &= ~A_OK;
+
 	/* allow owner, if perms match */
 	if (inode_uid(inode) == ctxt->uid) {
 		if ((mask & (perms >> 6)) == mask)

-- 
2.47.2

Signed-off-by: Theodore Ts'o <tytso@mit.edu>
---
 misc/fuse2fs.1.in | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/misc/fuse2fs.1.in b/misc/fuse2fs.1.in
index d485ccbdc..21f576074 100644
--- a/misc/fuse2fs.1.in
+++ b/misc/fuse2fs.1.in

@@ -54,7 +54,7 @@ do not replay the journal and mount the file system read-only
 \fB-o\fR fuse2fs_debug
 enable fuse2fs debugging
 .TP
-.BR -o kernel
+\fB-o\fR kernel
 Behave more like the kernel ext4 driver in the following ways:
 Allows processes owned by other users to access the filesystem.
 Uses the kernel's permissions checking logic instead of fuse2fs's.

@@ -63,10 +63,10 @@ Note that these options can still be overridden (e.g.
 .I nosuid
 ) later.
 .TP
-.BR -o direct
+\fB-o\fR direct
 Use O_DIRECT to access the block device.
 .TP
-.BR -o cache_size
+\fB-o\fR cache_size
 Set the disk cache size to this quantity.
 The quantity may contain the suffixes k, m, or g.
 By default, the size is 32MB.

-- 
2.47.2

On Tue, Jul 01, 2025 at 11:50:43PM -0400, Theodore Ts'o wrote:

Commit 9f69dfc4e275 ("fuse2fs: implement O_APPEND correctly") defined
a new flag, A_OK, to add support for testing whether the file is valid
for append operations.  This is relevant for the check_iflags_access()
function, but when are later testing operations mask against the inode
permissions, this new flag gets in the way and causes non-root users
attempting to create new inodes in a directory to fail.  Fix this by
masking off A_OK before doing these tests.

Fixes: 9f69dfc4e275 ("fuse2fs: implement O_APPEND correctly")
Signed-off-by: Theodore Ts'o <tytso@mit.edu>

Looks correct to me,
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>

--D

On Tue, Jul 01, 2025 at 11:50:44PM -0400, Theodore Ts'o wrote:

Signed-off-by: Theodore Ts'o <tytso@mit.edu>

Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>

--D