If the SSHFS share in question is mounted manually by the user with the mount command, the permissions are correct and the user has the expected access. No problems.
However, the mount needs to be established automatically (either at boot or on-demand) without user intervention. Unfortunately, if the share is mounted with the following fstab line, the user does not have access to the mount point (permission denied), but root does have access (unexpected since we did not include the
allow_root mount option).
mari@sshfs:/home/mari/Documents /home/mari/Documents fuse.sshfs noauto,x-systemd.automount,_netdev,defaults,user,identityfile=/home/mari/.ssh/id_rsa 0 0
The Arch Wiki page includes this example:
user@host:/remote/folder /mount/point fuse.sshfs noauto,x-systemd.automount,_netdev,users,idmap=user,IdentityFile=/home/user/.ssh/id_rsa,allow_other,reconnect 0 0
It uses the
allow_other mount option. However, we do not want to use the
allow_other mount option because of the security bug described here: https://github.com/libfuse/libfuse/issues/15
allow_other mount option really should not be used without the
default_permissions mount option, if one cares about security.
However, I'm told that the
default_permissions mount option does not support ACL's, which is a requirement for us.
What is the correct solution to this issue? We want to automatically mount SSHFS shares and have the permissions and ACL's work correctly.