bugdavfs2 - Bugs: bug #48981, Allow non-root mounting without an...

 
 

bug #48981: Allow non-root mounting without an entry in fstab

Submitted by:  None
Submitted on:  Fri 02 Sep 2016 06:57:27 PM UTC  
 
Category: NoneSeverity: 1 - Wish
Item Group: NoneStatus: Postponed
Privacy: PublicAssigned to: Werner Baumann <wbaumann>
Open/Closed: Open

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 04 Sep 2016 03:57:42 PM UTC, comment #1:

This is the artificial design of Unix-like operating systems like GNU/Linux. Mounting of file system is a privileged operation in Unix-like operating systems. The system call for mounting requires root priveleges.

The binary you invoke to mount a sshfs file system is not setuid root. But it calls a function from libfuse which in turn invokes fusermount which is setuid root. Remove the s-bit from /bin/fusermount and unprivileged users will no longer be able to mount any file system that uses libfuse.

There are different ways to allow unprivileged users to mount a file system. They all come with some restrictions to avoid security issues.

  • The traditionall way is to require an entry in fstab. That is what davfs2 supports.
  • fuse additionally allows users to mount a file system if they own the mount point and it will restrict access to this file system to the mounting user only. root can influence this restriction via /etc/fuse.conf.
  • Most desktop environments have some component that allows unpriveleged usrs restricted mounts. But I don't know much about this.

I am considering to add an option like fuse (restricted to mount points in the user's home directory). But I don't consider this a high priority issue.

Werner Baumann <wbaumann>
Project AdministratorIn charge of this item.
Fri 02 Sep 2016 06:57:27 PM UTC, original submission:

davfs2 currently requires an entry in /etc/fstab in order to mount the filesystem as regular user.

This limitation must be artificial, because:
- mount.davfs is SUID
- e. g. sshfs is not SUID and does not require this

It would be nice to have an option to remove this artificial limitation.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wbaumann (Posted a comment)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 04 Sep 2016 03:57:42 PM UTCwbaumannSeverity3 - Normal=>1 - Wish
      StatusNone=>Postponed
      Assigned toNone=>wbaumann

    Back to the top


    Powered by Savane 3.1-cleanup1