Re: [PATCHSET v5] libfuse: run fuse servers as a contained service

Bernd Schubert
2026-04-26T16:35:15Z

On 4/23/26 01:18, Darrick J. Wong wrote:
> Hi all,
>
> This patchset defines the necessary communication protocols and library
> code so that users can mount fuse servers that run in unprivileged
> systemd service containers. That in turn allows unprivileged untrusted
> mounts, because the worst that can happen is that a malicious image
> crashes the fuse server and the mount dies, instead of corrupting the
> kernel's memory.
>
> v5: Refactor socket IO into helpers, tighten the security checks in
> mount_service.c, always set nosuid/nodev for unprivileged mounts,
> use posix_spawnp in mount.fuse, restructure sample programs and hl
> library code to avoid the need for unmounting during startup
> v4.1: fix various cppcheck/codecheck complaints
> v4: fix a large number of security problems that only matter when the
> mount helper is being run as a setuid program; fix protocol
> byteswapping problems; add CLOEXEC to all files being traded
> back and forth; add an umount command; and strengthen mount socket
> protocol checks.
> v3: refactor the sample code to reduce duplication; fix all the
> checkpatch complaints; examples actually build standalone;
> fuservicemount handles utab now; cleaned up meson feature detection;
> handle MS_ flags that don't translate to MOUNT_ATTR_*
> v2: cleaned up error code handling and logging; add some example fuse
> service; fuservicemount3 can now be a setuid program to allow
> unprivileged userspace to fire up a contained filesystem driver.
> This could be opening Pandora's box...
> v1: detach from fuse-iomap series
>
> If you're going to start using this code, I strongly recommend pulling
> from my git trees, which are linked below.
>
> With a bit of luck, this should all go splendidly.
> Comments and questions are, as always, welcome.
>
> --D
>
> kernel git tree:
> https://git.kernel.org/cgit/linux/kernel/git/djwong/xfs-linux.git/log/?h=fuse-service-container

Hi Darrick,

going to look for your previous pull request - kernel tree doesn't help
me for libfuse ;)

Bernd

> ---
> Commits in this patchset:
> * Refactor mount code / move common functions to mount_util.c
> * mount_service: add systemd socket service mounting helper
> * mount_service: create high level fuse helpers
> * mount_service: use the new mount api for the mount service
> * mount_service: update mtab after a successful mount
> * util: hoist the fuse.conf parsing and setuid mode enforcement code
> * util: fix checkpatch complaints in fuser_conf.[ch]
> * mount_service: enable unprivileged users in a similar manner as fusermount
> * mount.fuse3: integrate systemd service startup
> * mount_service: allow installation as a setuid program
> * example/service_ll: create a sample systemd service fuse server
> * example/service: create a sample systemd service for a high-level fuse server
> * nullfs: support fuse systemd service mode
> ---
> example/single_file.h | 191 ++
> include/fuse.h | 34
> include/fuse_service.h | 243 +++
> include/fuse_service_priv.h | 161 ++
> lib/fuse_i.h | 3
> lib/mount_common_i.h | 22
> lib/mount_util.h | 8
> lib/util.h | 35
> util/fuser_conf.h | 62 +
> util/mount_service.h | 49 +
> .github/workflows/install-ubuntu-dependencies.sh | 4
> README.md | 3
> doc/fuservicemount3.8 | 32
> doc/meson.build | 3
> example/meson.build | 26
> example/null.c | 51 +
> example/null.socket.in | 15
> example/null@.service | 102 +
> example/service_hl.c | 224 ++
> example/service_hl.socket.in | 15
> example/service_hl@.service | 102 +
> example/service_ll.c | 313 +++
> example/service_ll.socket.in | 15
> example/service_ll@.service | 102 +
> example/single_file.c | 970 ++++++++++
> include/meson.build | 4
> lib/fuse_service.c | 1220 +++++++++++++
> lib/fuse_service_stub.c | 106 +
> lib/fuse_versionscript | 18
> lib/helper.c | 160 ++
> lib/meson.build | 17
> lib/mount.c | 72 +
> lib/mount_util.c | 9
> meson.build | 53 +
> meson_options.txt | 9
> test/ci-build.sh | 14
> util/fuser_conf.c | 396 ++++
> util/fusermount.c | 363 ----
> util/fuservicemount.c | 65 +
> util/install_helper.sh | 6
> util/meson.build | 24
> util/mount.fuse.c | 169 ++
> util/mount_service.c | 2111 ++++++++++++++++++++++
> 43 files changed, 7197 insertions(+), 404 deletions(-)
> create mode 100644 example/single_file.h
> create mode 100644 include/fuse_service.h
> create mode 100644 include/fuse_service_priv.h
> create mode 100644 lib/mount_common_i.h
> create mode 100644 util/fuser_conf.h
> create mode 100644 util/mount_service.h
> create mode 100644 doc/fuservicemount3.8
> create mode 100644 example/null.socket.in
> create mode 100644 example/null@.service
> create mode 100644 example/service_hl.c
> create mode 100644 example/service_hl.socket.in
> create mode 100644 example/service_hl@.service
> create mode 100644 example/service_ll.c
> create mode 100644 example/service_ll.socket.in
> create mode 100644 example/service_ll@.service
> create mode 100644 example/single_file.c
> create mode 100644 lib/fuse_service.c
> create mode 100644 lib/fuse_service_stub.c
> create mode 100644 util/fuser_conf.c
> create mode 100644 util/fuservicemount.c
> create mode 100644 util/mount_service.c
>