From 13026d8d9d43bb56daccfa253bf41c3b83568030 Mon Sep 17 00:00:00 2001
From: Connor Brewster <cbrewster@hey.com>
Date: Tue, 19 Sep 2023 11:25:27 -0500
Subject: [PATCH] linux_session: Make allow_other mount option optional

The `allow_other` mount option typically requires root user permissions
unless configured otherwise on the machine. It would be nice if this was
configurable to allow for unprivileged mounting.

For non-root users to use this option the system must have 'user_allow_other'
set in /etc/fuse.conf.

Signed-off-by: Connor Brewster <cbrewster@hey.com>
---
 src/transport/fusedev/linux_session.rs | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/src/transport/fusedev/linux_session.rs b/src/transport/fusedev/linux_session.rs
index 22db3cdce..ddff4cadf 100644
--- a/src/transport/fusedev/linux_session.rs
+++ b/src/transport/fusedev/linux_session.rs
@@ -52,6 +52,7 @@ pub struct FuseSession {
     readonly: bool,
     wakers: Mutex<Vec<Arc<Waker>>>,
     auto_unmount: bool,
+    allow_other: bool,
     target_mntns: Option<libc::pid_t>,
     // fusermount binary, default to fusermount3
     fusermount: String,
@@ -95,6 +96,7 @@ impl FuseSession {
             auto_unmount,
             target_mntns: None,
             fusermount: FUSERMOUNT_BIN.to_string(),
+            allow_other: true,
         })
     }
 
@@ -109,6 +111,13 @@ impl FuseSession {
         self.fusermount = bin.to_string();
     }
 
+    /// Set the allow_other mount option. This allows other users than the one mounting the
+    /// filesystem to access the filesystem. However, this option is usually restricted to the root
+    /// user unless configured otherwise.
+    pub fn set_allow_other(&mut self, allow_other: bool) {
+        self.allow_other = allow_other;
+    }
+
     /// Get current fusermount binary.
     pub fn get_fusermount(&self) -> &str {
         self.fusermount.as_str()
@@ -126,6 +135,7 @@ impl FuseSession {
             &self.subtype,
             flags,
             self.auto_unmount,
+            self.allow_other,
             self.target_mntns,
             &self.fusermount,
         )?;
@@ -362,12 +372,14 @@ impl FuseChannel {
 }
 
 /// Mount a fuse file system
+#[allow(clippy::too_many_arguments)]
 fn fuse_kern_mount(
     mountpoint: &Path,
     fsname: &str,
     subtype: &str,
     flags: MsFlags,
     auto_unmount: bool,
+    allow_other: bool,
     target_mntns: Option<libc::pid_t>,
     fusermount: &str,
 ) -> Result<(File, Option<UnixStream>)> {
@@ -380,13 +392,16 @@ fn fuse_kern_mount(
     let meta = mountpoint
         .metadata()
         .map_err(|e| SessionFailure(format!("stat {mountpoint:?}: {e}")))?;
-    let opts = format!(
-        "default_permissions,allow_other,fd={},rootmode={:o},user_id={},group_id={}",
+    let mut opts = format!(
+        "default_permissions,fd={},rootmode={:o},user_id={},group_id={}",
         file.as_raw_fd(),
         meta.permissions().mode() & libc::S_IFMT,
         getuid(),
         getgid(),
     );
+    if allow_other {
+        opts.push_str(",allow_other");
+    }
     let mut fstype = String::from(FUSE_FSTYPE);
     if !subtype.is_empty() {
         fstype.push('.');