Re: [PATCHSET v5] libfuse: run fuse servers as a contained service

[Bernd Schubert <bernd@bsbernd.com>]

On 4/23/26 01:18, Darrick J. Wong wrote:
> Hi all,
> 
> This patchset defines the necessary communication protocols and library
> code so that users can mount fuse servers that run in unprivileged
> systemd service containers.  That in turn allows unprivileged untrusted
> mounts, because the worst that can happen is that a malicious image
> crashes the fuse server and the mount dies, instead of corrupting the
> kernel's memory.
> 
> v5: Refactor socket IO into helpers, tighten the security checks in
>     mount_service.c, always set nosuid/nodev for unprivileged mounts,
>     use posix_spawnp in mount.fuse, restructure sample programs and hl
>     library code to avoid the need for unmounting during startup
> v4.1: fix various cppcheck/codecheck complaints
> v4: fix a large number of security problems that only matter when the
>     mount helper is being run as a setuid program; fix protocol
>     byteswapping problems; add CLOEXEC to all files being traded
>     back and forth; add an umount command; and strengthen mount socket
>     protocol checks.
> v3: refactor the sample code to reduce duplication; fix all the
>     checkpatch complaints; examples actually build standalone;
>     fuservicemount handles utab now; cleaned up meson feature detection;
>     handle MS_ flags that don't translate to MOUNT_ATTR_*
> v2: cleaned up error code handling and logging; add some example fuse
>     service; fuservicemount3 can now be a setuid program to allow
>     unprivileged userspace to fire up a contained filesystem driver.
>     This could be opening Pandora's box...
> v1: detach from fuse-iomap series
> 
> If you're going to start using this code, I strongly recommend pulling
> from my git trees, which are linked below.
> 
> With a bit of luck, this should all go splendidly.
> Comments and questions are, as always, welcome.
> 
> --D
> 
> kernel git tree:
> https://git.kernel.org/cgit/linux/kernel/git/djwong/xfs-linux.git/log/?h=fuse-service-container

Hi Darrick,

going to look for your previous pull request - kernel tree doesn't help
me for libfuse ;)

Bernd

> ---
> Commits in this patchset:
>  * Refactor mount code / move common functions to mount_util.c
>  * mount_service: add systemd socket service mounting helper
>  * mount_service: create high level fuse helpers
>  * mount_service: use the new mount api for the mount service
>  * mount_service: update mtab after a successful mount
>  * util: hoist the fuse.conf parsing and setuid mode enforcement code
>  * util: fix checkpatch complaints in fuser_conf.[ch]
>  * mount_service: enable unprivileged users in a similar manner as fusermount
>  * mount.fuse3: integrate systemd service startup
>  * mount_service: allow installation as a setuid program
>  * example/service_ll: create a sample systemd service fuse server
>  * example/service: create a sample systemd service for a high-level fuse server
>  * nullfs: support fuse systemd service mode
> ---
>  example/single_file.h                            |  191 ++
>  include/fuse.h                                   |   34 
>  include/fuse_service.h                           |  243 +++
>  include/fuse_service_priv.h                      |  161 ++
>  lib/fuse_i.h                                     |    3 
>  lib/mount_common_i.h                             |   22 
>  lib/mount_util.h                                 |    8 
>  lib/util.h                                       |   35 
>  util/fuser_conf.h                                |   62 +
>  util/mount_service.h                             |   49 +
>  .github/workflows/install-ubuntu-dependencies.sh |    4 
>  README.md                                        |    3 
>  doc/fuservicemount3.8                            |   32 
>  doc/meson.build                                  |    3 
>  example/meson.build                              |   26 
>  example/null.c                                   |   51 +
>  example/null.socket.in                           |   15 
>  example/null@.service                            |  102 +
>  example/service_hl.c                             |  224 ++
>  example/service_hl.socket.in                     |   15 
>  example/service_hl@.service                      |  102 +
>  example/service_ll.c                             |  313 +++
>  example/service_ll.socket.in                     |   15 
>  example/service_ll@.service                      |  102 +
>  example/single_file.c                            |  970 ++++++++++
>  include/meson.build                              |    4 
>  lib/fuse_service.c                               | 1220 +++++++++++++
>  lib/fuse_service_stub.c                          |  106 +
>  lib/fuse_versionscript                           |   18 
>  lib/helper.c                                     |  160 ++
>  lib/meson.build                                  |   17 
>  lib/mount.c                                      |   72 +
>  lib/mount_util.c                                 |    9 
>  meson.build                                      |   53 +
>  meson_options.txt                                |    9 
>  test/ci-build.sh                                 |   14 
>  util/fuser_conf.c                                |  396 ++++
>  util/fusermount.c                                |  363 ----
>  util/fuservicemount.c                            |   65 +
>  util/install_helper.sh                           |    6 
>  util/meson.build                                 |   24 
>  util/mount.fuse.c                                |  169 ++
>  util/mount_service.c                             | 2111 ++++++++++++++++++++++
>  43 files changed, 7197 insertions(+), 404 deletions(-)
>  create mode 100644 example/single_file.h
>  create mode 100644 include/fuse_service.h
>  create mode 100644 include/fuse_service_priv.h
>  create mode 100644 lib/mount_common_i.h
>  create mode 100644 util/fuser_conf.h
>  create mode 100644 util/mount_service.h
>  create mode 100644 doc/fuservicemount3.8
>  create mode 100644 example/null.socket.in
>  create mode 100644 example/null@.service
>  create mode 100644 example/service_hl.c
>  create mode 100644 example/service_hl.socket.in
>  create mode 100644 example/service_hl@.service
>  create mode 100644 example/service_ll.c
>  create mode 100644 example/service_ll.socket.in
>  create mode 100644 example/service_ll@.service
>  create mode 100644 example/single_file.c
>  create mode 100644 lib/fuse_service.c
>  create mode 100644 lib/fuse_service_stub.c
>  create mode 100644 util/fuser_conf.c
>  create mode 100644 util/fuservicemount.c
>  create mode 100644 util/mount_service.c
>