[PATCHSET v5] libfuse: run fuse servers as a contained service

Darrick J. Wong
2026-04-22T23:18:50Z

Hi all,

This patchset defines the necessary communication protocols and library
code so that users can mount fuse servers that run in unprivileged
systemd service containers. That in turn allows unprivileged untrusted
mounts, because the worst that can happen is that a malicious image
crashes the fuse server and the mount dies, instead of corrupting the
kernel's memory.

v5: Refactor socket IO into helpers, tighten the security checks in
mount_service.c, always set nosuid/nodev for unprivileged mounts,
use posix_spawnp in mount.fuse, restructure sample programs and hl
library code to avoid the need for unmounting during startup
v4.1: fix various cppcheck/codecheck complaints
v4: fix a large number of security problems that only matter when the
mount helper is being run as a setuid program; fix protocol
byteswapping problems; add CLOEXEC to all files being traded
back and forth; add an umount command; and strengthen mount socket
protocol checks.
v3: refactor the sample code to reduce duplication; fix all the
checkpatch complaints; examples actually build standalone;
fuservicemount handles utab now; cleaned up meson feature detection;
handle MS_ flags that don't translate to MOUNT_ATTR_*
v2: cleaned up error code handling and logging; add some example fuse
service; fuservicemount3 can now be a setuid program to allow
unprivileged userspace to fire up a contained filesystem driver.
This could be opening Pandora's box...
v1: detach from fuse-iomap series

If you're going to start using this code, I strongly recommend pulling
from my git trees, which are linked below.

With a bit of luck, this should all go splendidly.
Comments and questions are, as always, welcome.

--D

kernel git tree:
https://git.kernel.org/cgit/linux/kernel/git/djwong/xfs-linux.git/log/?h=fuse-service-container
---
Commits in this patchset:
* Refactor mount code / move common functions to mount_util.c
* mount_service: add systemd socket service mounting helper
* mount_service: create high level fuse helpers
* mount_service: use the new mount api for the mount service
* mount_service: update mtab after a successful mount
* util: hoist the fuse.conf parsing and setuid mode enforcement code
* util: fix checkpatch complaints in fuser_conf.[ch]
* mount_service: enable unprivileged users in a similar manner as fusermount
* mount.fuse3: integrate systemd service startup
* mount_service: allow installation as a setuid program
* example/service_ll: create a sample systemd service fuse server
* example/service: create a sample systemd service for a high-level fuse server
* nullfs: support fuse systemd service mode
---
example/single_file.h | 191 ++
include/fuse.h | 34
include/fuse_service.h | 243 +++
include/fuse_service_priv.h | 161 ++
lib/fuse_i.h | 3
lib/mount_common_i.h | 22
lib/mount_util.h | 8
lib/util.h | 35
util/fuser_conf.h | 62 +
util/mount_service.h | 49 +
.github/workflows/install-ubuntu-dependencies.sh | 4
README.md | 3
doc/fuservicemount3.8 | 32
doc/meson.build | 3
example/meson.build | 26
example/null.c | 51 +
example/null.socket.in | 15
example/null@.service | 102 +
example/service_hl.c | 224 ++
example/service_hl.socket.in | 15
example/service_hl@.service | 102 +
example/service_ll.c | 313 +++
example/service_ll.socket.in | 15
example/service_ll@.service | 102 +
example/single_file.c | 970 ++++++++++
include/meson.build | 4
lib/fuse_service.c | 1220 +++++++++++++
lib/fuse_service_stub.c | 106 +
lib/fuse_versionscript | 18
lib/helper.c | 160 ++
lib/meson.build | 17
lib/mount.c | 72 +
lib/mount_util.c | 9
meson.build | 53 +
meson_options.txt | 9
test/ci-build.sh | 14
util/fuser_conf.c | 396 ++++
util/fusermount.c | 363 ----
util/fuservicemount.c | 65 +
util/install_helper.sh | 6
util/meson.build | 24
util/mount.fuse.c | 169 ++
util/mount_service.c | 2111 ++++++++++++++++++++++
43 files changed, 7197 insertions(+), 404 deletions(-)
create mode 100644 example/single_file.h
create mode 100644 include/fuse_service.h
create mode 100644 include/fuse_service_priv.h
create mode 100644 lib/mount_common_i.h
create mode 100644 util/fuser_conf.h
create mode 100644 util/mount_service.h
create mode 100644 doc/fuservicemount3.8
create mode 100644 example/null.socket.in
create mode 100644 example/null@.service
create mode 100644 example/service_hl.c
create mode 100644 example/service_hl.socket.in
create mode 100644 example/service_hl@.service
create mode 100644 example/service_ll.c
create mode 100644 example/service_ll.socket.in
create mode 100644 example/service_ll@.service
create mode 100644 example/single_file.c
create mode 100644 lib/fuse_service.c
create mode 100644 lib/fuse_service_stub.c
create mode 100644 util/fuser_conf.c
create mode 100644 util/fuservicemount.c
create mode 100644 util/mount_service.c