Bug#725706: gvfs-fuse: make gvfs-fuse work out of the box

[Michael Biebl]

Am 07.10.2013 17:55, schrieb Josselin Mouette:
> Le lundi 07 octobre 2013 à 17:22 +0200, Laurent Bigonville a écrit : 
>> It would be nice if gvfs-fuse was working out of the box.
>>
>> Currently 2 things are blocking this:
>>
>>  - The /dev/fuse being owned by root:fuse with 0660 permissions
>>  - /bin/fusermount being owned by root:fuse with 4750 permission
>>
>> If this matter, upstream udev rule is creating /dev/fuse with
>> permissions 0666 (owned by root:root) and upstream Makefile is
>> installing /bin/fusermount with 4755 permission (owned by root:root
>> again)
>>
>> The correct ways of doing things here still probably need to be
>> discussed.
> 
> An easy way to do that without lowering too much security is to
> make /usr/lib/gvfs/gvfs-fuse-daemon 2755 root:fuse. This way only gvfs
> could use the fuse capabilities.

just some minor correction here: the daemon is called
/usr/lib/gvfs/gvfsd-fuse

> Another possibility is to make /dev/fuse managed by udev-acl, but this
> doesn’t solve the fusermount issue (it would require hiding it behind a
> D-Bus service to do things properly).

Splitting /usr/lib/gvfs/gvfsd-fuse into a user part and a D-Bus system
service (which does the privileged mounting) is definitely more work. If
we go that route, we don't need the udev-acl/uaccess permissions for
/dev/fuse.

Michael
-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 901 bytes
Desc: OpenPGP digital signature
URL: <http://lists.alioth.debian.org/pipermail/pkg-gnome-maintainers/attachments/20131007/0dfaf30b/attachment.sig>