- Package:
- sshfs
- Source:
- sshfs-fuse
- Description:
- filesystem client based on SSH File Transfer Protocol
- Submitter:
- Alessandro Vesely
- Date:
- 2013-09-27 09:15:22 UTC
- Severity:
- normal
Superuser has access to anything on a given machine, usually. However, after a user mounts sshfs, the mount point becomes unreadable by other shells: stat says "Permission denied" even to root. The ability to stat mountpoints would allow commands like `find / -xdev ...` to complete without errors when issued by root.
I understand those security concerns. What I'm asking is that just the mountpoint be accessible to root, not the remote files. That would be enough for root to learn that the directory contents reside on a different device. I see no other way to avoid breaking scripts such as check-setuid (package checksecurity).
Distro people should start thinking about doing per-user namespaces. It would clean up the fuse mount vs. root access mess. Not sure who would be responsible for such decisions. Perhaps as a first step, PAM maintainer could be asked? Thanks, Miklos