* libfuse accepts subtypes with slashes in them??
@ 2026-04-22 6:35 Darrick J. Wong
2026-04-23 7:34 ` Miklos Szeredi
0 siblings, 1 reply; 2+ messages in thread
From: Darrick J. Wong @ 2026-04-22 6:35 UTC (permalink / raw)
To: fuse-devel; +Cc: linux-fsdevel, Bernd Schubert
Hey everyone,
So today I noticed that this happens on Debian 13:
$ mount -t fuse./bin/ls /root/ /etc/shadow
ls: cannot access 'rw,dev,suid': No such file or directory
-rw-r----- 1 root 1345 Nov 18 10:38 /etc/shadow
ls: cannot open directory '/root': Permission denied
Uh... is that intentional? It looks as though mount does:
execve("/sbin/mount.fuse", ["/sbin/mount.fuse", "/root", "/etc/shadow", "-o", "rw", "-t", "fuse./bin/ls"]...)
and then mount.fuse just trims off everything after the "fuse." and
does:
execve("/bin/sh", ["/bin/sh", "-c", "'/bin/ls' '/root' '/etc/shadow' '-o' 'rw,dev,suid'"]...)
with the odd output that you see above. Is that supposed to happen?
Or should libfuse reject subtypes with path separators?
--D
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: libfuse accepts subtypes with slashes in them??
2026-04-22 6:35 libfuse accepts subtypes with slashes in them?? Darrick J. Wong
@ 2026-04-23 7:34 ` Miklos Szeredi
0 siblings, 0 replies; 2+ messages in thread
From: Miklos Szeredi @ 2026-04-23 7:34 UTC (permalink / raw)
To: Darrick J. Wong; +Cc: fuse-devel, linux-fsdevel, Bernd Schubert
On Wed, 22 Apr 2026 at 08:35, Darrick J. Wong <djwong@kernel.org> wrote:
>
> Hey everyone,
>
> So today I noticed that this happens on Debian 13:
>
> $ mount -t fuse./bin/ls /root/ /etc/shadow
> ls: cannot access 'rw,dev,suid': No such file or directory
> -rw-r----- 1 root 1345 Nov 18 10:38 /etc/shadow
>
> ls: cannot open directory '/root': Permission denied
>
> Uh... is that intentional? It looks as though mount does:
>
> execve("/sbin/mount.fuse", ["/sbin/mount.fuse", "/root", "/etc/shadow", "-o", "rw", "-t", "fuse./bin/ls"]...)
>
> and then mount.fuse just trims off everything after the "fuse." and
> does:
>
> execve("/bin/sh", ["/bin/sh", "-c", "'/bin/ls' '/root' '/etc/shadow' '-o' 'rw,dev,suid'"]...)
>
> with the odd output that you see above. Is that supposed to happen?
> Or should libfuse reject subtypes with path separators?
Probably should have done that. But now this is probably abused and
would cause breakage if changed.
Thanks,
Miklos
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-04-23 7:34 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-04-22 6:35 libfuse accepts subtypes with slashes in them?? Darrick J. Wong
2026-04-23 7:34 ` Miklos Szeredi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox