Bug 163048 - normal user cant mount ntfs-3g due to bug in mac_stub module
Summary: normal user cant mount ntfs-3g due to bug in mac_stub module
Status: Open
Alias: None
Product: Base System
Classification: Unclassified
Component: amd64 (show other bugs)
Version: Unspecified
Hardware: Any Any
: Normal Affects Only Me
Assignee: freebsd-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-12-04 10:13 UTC by Marcelo Froes
Modified: 2024-01-19 14:21 UTC (History)
4 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcelo Froes 2011-12-04 10:13:44 UTC
+Have set the local rules for devfs
[localrules=5]
add path 'da*' mode 0660 group operator
add path 'fuse*' mode 666

+on /etc/rc.conf
devfs_system_ruleset="localrules"
+have set vfs.usermount=1 and runned the command
sysctl vfs.usermount=1

/dev/da4s1 has 0666 permissions as does mount_fusefs and the mounting point.

inserted on fstab

/dev/da4s1              /media/Story    ntfs rw,mountprog=/usr/local/bin/ntfs-3g,late 0 0

when trying to mount
$ mount  /media/Story
mount_fusefs: /dev/fuse0 on /media/Story: Operation not permitted
fuse: failed to mount file system: No such file or directory

this is the permissions of the device 
crw-rw-rw-  1 root  storage    0,  92 Dec  4 20:50 /dev/fuse0

lrwxr-xr-x  1 root  wheel  28 Dec  4 03:44 /usr/sbin/mount_fusefs -> /usr/local/sbin/mount_fusefs
here is the ktrace:
http://pastebin.com/WnkqrHBp

How-To-Repeat: couldnt replicate on virtualbox.
Comment 1 Henry Hu 2017-12-19 03:49:40 UTC
Do you have any update on this problem? I'm also having this problem, on 11.1-STABLE, using ntfs-3g.
Comment 2 Henry Hu 2017-12-19 04:53:55 UTC
I traced it to a failed mac_priv_grant:
from DTrace:
  1                          -> priv_check_cred 
  1                            -> mac_priv_check 
  1                            <- mac_priv_check return val: 0
  1                            -> prison_priv_check 
  1                            <- prison_priv_check return val: 0
  1                            -> mac_priv_grant 
  1                            <- mac_priv_grant return val: 1
  1                          <- priv_check_cred return val: 1
 This priv_check_cred(PRIV_VFS_ADMIN) is in vfs_domount_first().
Comment 3 Henry Hu 2017-12-19 05:17:51 UTC
I solved this by loading a slightly changed mac_stub module: change EPERM to 0 in stub_priv_grant(). I'll just rebuild the kernel with "option MAC" removed from my kernel config.
If MAC is enabled but no policy module is loaded, then no operation should be blocked by MAC. This bug shows that this is not the case. Please consider fix it.
Comment 4 Henry Hu 2018-01-01 19:49:39 UTC
With "option MAC" removed, non-root mounting still does not work.
This time, in fuse_vfsop.c:324, fuse_vfsop_mount() calls priv_check(PRIV_VFS_FUSE_MOUNT_NONUSER), while PRIV_VFS_FUSE_MOUNT_NONUSER is defined as PRIV_VFS_MOUNT_NONUSER.
Comment 5 Henry Hu 2018-01-01 21:46:47 UTC
Finally I understand what's the problem.
It's not line 324 (PRIV_VFS_FUSE_MOUNT_NONUSER), but line 321 (PRIV_VFS_FUSE_ALLOWOTHER).
By default, ntfs-3g sets some options, including "allow_other". This option is only allowed by root, so mount using ntfs-3g can only be done by root.
By mounting with "no_def_opts", I can finally mount an ntfs volume as non-root user. I suggest adding this into the pkg message.
Comment 6 rlgcrh 2018-09-25 19:01:41 UTC
(In reply to Henry Hu from comment #1)
Comment 7 skrech 2019-01-24 21:51:22 UTC
I second that this is useful information to be included in the documentation. There are lots of unresolved forum threads with failed mounting caused by some really strange default argument values for ntfs-3g.
Moreover, "user_allow_other" option in /etc/fuse.conf should also fix the problem.
Comment 8 skrech 2019-01-24 22:26:39 UTC
Now I've tried putting user_allow_other in /etc/fuse.conf and apparently this file is not read in FreeBSD.
However, there is a man page for it called mount.fuse(8).
Moreover, this man page contains information about mounting/unmounting with fusermount which is also not present in FreeBSD.
Comment 9 Mark Linimon freebsd_committer freebsd_triage 2024-01-19 14:21:43 UTC
^Triage: mark as not amd64-specific (most likely), and unmark In Progress (no work seems to have been done).

To submitters/commenters: was this problem ever fixed?