bugdavfs2 - Bugs: bug #48981, Allow non-root mounting without an...

 
 

bug #48981: Allow non-root mounting without an entry in fstab

Submitter:  None
Submitted:  Fri 02 Sep 2016 06:57:27 PM UTC
   
 
Category:  None Severity:  1 - Wish
Item Group:  None Status:  Postponed
Privacy:  Public Assigned to:  _71007
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 06 Nov 2018 01:45:57 PM UTC, comment #2: 

Why have two SUID binaries when only one is enough? It's a security risk.

And if a system allows to mount FUSE filesystems by unprivileged users and a user can run his own code, then SUID-bit and internal davfs2 restrictions just don't make sense.

Alexander <aavolkov>
Sun 04 Sep 2016 03:57:42 PM UTC, comment #1: 

This is the artificial design of Unix-like operating systems like GNU/Linux. Mounting of file system is a privileged operation in Unix-like operating systems. The system call for mounting requires root priveleges.

The binary you invoke to mount a sshfs file system is not setuid root. But it calls a function from libfuse which in turn invokes fusermount which is setuid root. Remove the s-bit from /bin/fusermount and unprivileged users will no longer be able to mount any file system that uses libfuse.

There are different ways to allow unprivileged users to mount a file system. They all come with some restrictions to avoid security issues.

  • The traditionall way is to require an entry in fstab. That is what davfs2 supports.


  • fuse additionally allows users to mount a file system if they own the mount point and it will restrict access to this file system to the mounting user only. root can influence this restriction via /etc/fuse.conf.


  • Most desktop environments have some component that allows unpriveleged usrs restricted mounts. But I don't know much about this.


I am considering to add an option like fuse (restricted to mount points in the user's home directory). But I don't consider this a high priority issue.

- <_71007>
Fri 02 Sep 2016 06:57:27 PM UTC, original submission:  

davfs2 currently requires an entry in /etc/fstab in order to mount the filesystem as regular user.

This limitation must be artificial, because:
- mount.davfs is SUID
- e. g. sshfs is not SUID and does not require this

It would be nice to have an option to remove this artificial limitation.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by aavolkov (Posted a comment)
  • -email is unavailable- added by _71007 (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2016-09-04 _71007 Severity3 - Normal 1 - Wish
        StatusNone Postponed
        Assigned toNone _71007

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code