Owner of sshfs-mounted directory with 777 permission can't open it (no ACL, no SELinux)

Question

So I have a permission problem with my sshfs mount:

root@server01:/mnt# sshfs -o uid=$(id -u www-data) -o gid=$(id -g www-data) user@host:/path mountpoint
root@server01:/mnt# ls -Zlah
total 12K
drwxr-xr-x  3 root     root     ? 4.0K Nov 29 20:00 .
drwxr-xr-x 23 root         1001 ? 4.0K Nov 29 13:03 ..
drwxrwxrwx  1 www-data www-data ? 4.0K Nov 29 18:53 mountpoint
root@server01:/mnt# getfacl mountpoint/
# file: mountpoint/
# owner: www-data
# group: www-data
user::rwx
group::rwx
other::rwx
root@server01:/mnt# sudo -u www-data ls -lah
ls: cannot access mountpoint: Permission denied
total 8.0K
drwxr-xr-x  3 root root 4.0K Nov 29 20:00 .
drwxr-xr-x 23 root 1001 4.0K Nov 29 13:03 ..
d?????????  ? ?    ?       ?            ? mountpoint

Maybe the problem lies here:

root@server01:/mnt# mount
# unrelated stuff skipped
user@host:/path/ on /mnt/mountpoint type fuse.sshfs (rw,nosuid,nodev,relatime,user_id=0,group_id=0)

Here it says the uid and gid of the mount are both 0, which is root. But on my mount command and when using ls as root, it tells me everything belongs to gid/uid 33 which is www-data.

Answer 1

sshfs = FUSE, you are mounting as root, then trying to access using another user.

for a joke / test, you can sshfs as regular user, then switch to root, cd, ohh permission denied, how can root be denied, it's root...

run sshfs as the user you want to access.

update with example:

**test**@mike-laptop4:/mnt$ sshfs [email protected]:/home/mike moo
test@mike-laptop4:/mnt$ ls moo/
src
mike@mike-laptop4:/mnt$ ls moo 
ls: cannot access 'moo': Permission denied
mike@mike-laptop4:/mnt$ sudo su
root@mike-laptop4:/mnt# ls moo 
ls: cannot access 'moo': Permission denied

and vice versa:

**mike**@mike-laptop4:/mnt$ sshfs [email protected]:/home/mike moo
mike@mike-laptop4:/mnt$ ls moo
src
test@mike-laptop4:/mnt$ ls moo
ls: cannot access 'moo': Permission denied
mike@mike-laptop4:/mnt$ sudo su
root@mike-laptop4:/mnt# ls moo
ls: cannot access 'moo': Permission denied

UPDATE, Expand on solutions:

Solution 1: mount as the user required to access the data (security preference).

$ sshfs [email protected]:/home/mike moo

Using this option will allow only the mounting user to access the data.

---

The following 2x solution require (unless mounting as root, root shouldn't be used for sshfs);

/etc/fuse.conf user_allow_other

Solution 2: allow any user on the box access

$ sshfs -o allow_other [email protected]:/home/mike moo

Literally any user on the source host can create,edit,delete files, this is a terrible idea in most circumstances, and I can't imaging would ever be allowed in a PCI environment.

Not only do you risk all the data on the remote, but you risk a local user manipulating data that can be later used by another local user.

Solution 3: allow any user on the box, but honor local filesystem perms.

$ sshfs -o allow_other,default_permissions [email protected]:/home/mike moo

This option is much more acceptable than the last owing to the fact that only users authorized by the local filesystem will be allowed to access / edit files in the mount.

It would also be possible to setup group based permissions.