If the SSHFS share in question is mounted manually by the user with the mount command, the permissions are correct and the user has the expected access. No problems.

However, the mount needs to be established automatically (either at boot or on-demand) without user intervention. Unfortunately, if the share is mounted with the following fstab line, the user does not have access to the mount point (permission denied), but root does have access (unexpected since we did not include the allow_root mount option).

mari@sshfs:/home/mari/Documents /home/mari/Documents fuse.sshfs noauto,x-systemd.automount,_netdev,defaults,user,identityfile=/home/mari/.ssh/id_rsa 0 0

The Arch Wiki page includes this example:

user@host:/remote/folder /mount/point  fuse.sshfs noauto,x-systemd.automount,_netdev,users,idmap=user,IdentityFile=/home/user/.ssh/id_rsa,allow_other,reconnect 0 0

It uses the allow_other mount option. However, we do not want to use the allow_other mount option because of the security bug described here: https://github.com/libfuse/libfuse/issues/15

The allow_other mount option really should not be used without the default_permissions mount option, if one cares about security.

However, I'm told that the default_permissions mount option does not support ACL's, which is a requirement for us.

What is the correct solution to this issue? We want to automatically mount SSHFS shares and have the permissions and ACL's work correctly.

  • Did you manage to get this to work? I'm not using ACLs but I also have problems getting on-demand to work. If you get a chance, please could you take a look? – lonix Sep 5 '18 at 17:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.