Menu

#1 mounts appear to be owned by root and readable by all

open
nobody
None
5
2009-04-10
2009-04-10
No

version: afuse 0.2-3 from Ubuntu repository
host OS: Ubuntu Linux 8.10

I was a little confused when I started to try this out. I used this command to try it out:
afuse -o mount_template="sshfs %r:/ %m" -o unmount_template="fusermount -u -z %m" ~/temp/afuse

Then I navigated into "~/temp/afuse/brendan@HOMESERVER", causing an automount. When I looked at "~/temp/afuse", "brendan@HOMESERVER" semed to be owned by root and readble by all.

On the one hand, this is confusing and it looks like a security issue. However, I tried "su - ANOTHER-USER" and browsed around. In line with what I really expected, I could not find a way into the mount owned by "brendan" via "~brendan/temp/afuse" or "/tmp/afuse-SESSIONID". Permission denied. So it's secure.

Is the fact that "~/temp/afuse/brendan@HOMESERVER" is owned by root and readable by all a bug? Or is it really not a bug because it doesn't result in a security hole. If it's not a bug, can you please put a sentence or two in the README to clarify this?

Discussion


Log in to post a comment.