[Bug 236291] [FUSE] fuse(4) ignore file permissions

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=236291

            Bug ID: 236291
           Summary: [FUSE] fuse(4) ignore file permissions
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Many People
          Priority: ---
         Component: kern
          Assignee: bugs at FreeBSD.org
          Reporter: asomers at FreeBSD.org

fuse(4) is supposed to have two different modes of operation.  With the "-o
default_permissions" mount option, the kernel is supposed to do all validation
of file permissions (it doesn't, but that's a separate bug:
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=216391).  Without that mount
option, fuse(4) is supposed to query the daemon to validate permissions with
FUSE_ACCESS.  However, our currently implementation isn't doing that.  Instead,
fuse_internal_access merely validates:

* The filesystem is not read-only if write access is requested
* The accessing user is the same user who is running the daemon if
  "-o allow_other" was not specified at mount time

This means, for example, that a user can execute a non-executable file stored
on a fuse filesystem.

-- 
You are receiving this mail because:
You are the assignee for the bug.