user process can't access filesystem when not in primary group

[jonleivent]

I asked this in the gocryptfs discussions page, and it was suggested that I ask it here:

I have a mounted fuse (gocryptfs) filesystem that a user owns and can access. However,a process with that user's UID but not the user's primary group GID cannot access the filesystem. The filesystem is not mounted with the allow_others option, and I would rather not have to resort to using allow_others. I haven't tried allow_others to see if it changes this behavior, because of the security implications.

Is this expected behavior? Is there an alternative way around it besides using the allow_others mount option?

[hanwen]

It sounds like something outside of go-fuse control. Does a debug log show that it's trying to check for access? (ACCESS opcode)? Let me check over here.

[hanwen]

Double checked this: in this config (without allow_other) the request never reaches the server. So you need some sort of kernel option to allow the request to go through.

If you do use allow_other, then it is up to the FUSE daemon to check requests agains the calling GID/UID. I don't know if go-cryptfs does anything of the sort. @rfjakob

come to think of it, the loopback FS never bothers to set correct UID/GID for requests passed on in the loopback FS.

[rfjakob]

No, gocryptfs leaves the permission checking to the kernel. I linked to the kernel check in the cross-post: rfjakob/gocryptfs#740 (comment)

…

On Mon, 15 May 2023, 17:48 Han-Wen Nienhuys, ***@***.***> wrote: Double checked this: in this config (without allow_other) the request never reaches the server. So you need some sort of kernel option to allow the request to go through. Then it is up to the FUSE daemon to check requests agains the calling GID/UID. I don't know if go-cryptfs does anything of the sort. @rfjakob <https://github.com/rfjakob> — Reply to this email directly, view it on GitHub <#465 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AACGA777W6OIONRZ5LCH6ILXGJF4HANCNFSM6AAAAAAYBKV6SI> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[hanwen]

#466 for the loopback problem.