'Access image files by FUSE in userspace only
I am writing some tools that operate on files stored inside a disk image file under a users control. FUSE tools like fuse2fs are used to access file systems inside of partitions of those image files.
However, mounting those filesystems, and even accessing parts of it still require superuser privileges (and a lot of kernel work), as FUSE will still register the filesystem in kernel space, provide an /etc/mtab entry and VFS mount of course. FUSE allows some configuration to allow a non-privileged user to mount such FS, but fuse2fs still enforces user rights.
So I wonder if something can be done to stop for example fuse2fs exporting the fs to kernel space at all, and just access files in userspace. Like a wrapper, used like this:
fusewrapper --fuse-cmd="fuse2fs foo.img /bar" ls /bar/ # lists "/" of foo.img's ext4 FS
fusewrapper --user=root --group=root --fuse-cmd="fuse2fs foo.img /bar" cat /bar/baz # prints "/baz" contents from foo.img's ext4 fs as root.
where /bar is a virtual mount path only valid inside of the fusewrapper universe and ls / cat internal fusewrapper command to list or cat the named path.
This tool would only use the kernel for access to foo.img and stdin / out, and can still impersonate any user (eg. root).
How could such a tool work? What is needed to get rid of FUSEs non-userspace parts (eg. kernel interface) ?
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
