hardcoresushi/libgocryptfs
1
0
Fork 0
Code Issues Pull Requests Releases Activity

main: add "-o" option to enable "suid" and "dev"

Browse Source 
Device files and suid binaries are often not needed when running
gocryptfs as root. As they are potentially dangerous, let the
user enable them explicitely via the new "-o" option instead of
always enabling them when running as root.
This commit is contained in:
Jakob Unterwurzacher 2016-06-26 23:03:18 +02:00
parent 0115588680
commit 15b88756ad
2 changed files with 18 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
Documentation/MANPAGE.md
View File

@ -85,6 +85,15 @@ continue be printed to stdout and stderr.
: Send USR1 to the specified process after successful mount. This is
used internally for daemonization.
**-o**
: Pass additonal mount options to the kernel (comma-separated list).
FUSE filesystems are mounted with "nodev,nosuid" by default. If gocryptfs
runs as root, you can enable device files by passing the opposite mount option,
"dev", and if you want to enable suid-binaries, pass "suid".
"ro" (equivalent to passing the "-ro" option) and "noexec" may also be
interesting. For a complete liste see the section
`FILESYSTEM-INDEPENDENT MOUNT OPTIONS` in mount(8).
**-openssl bool**
: Use OpenSSL instead of built-in Go crypto (default "auto"). Using
built-in crypto is 4x slower unless your CPU has AES instructions and

18
main.go
View File

@ -45,7 +45,7 @@ type argContainer struct {
plaintextnames, quiet, nosyslog, wpanic,
longnames, allow_other, ro bool
masterkey, mountpoint, cipherdir, cpuprofile, config, extpass,
memprofile string
memprofile, o string
notifypid, scryptn int
}
@ -185,6 +185,7 @@ func main() {
flagSet.StringVar(&args.memprofile, "memprofile", "", "Write memory profile to specified file")
flagSet.StringVar(&args.config, "config", "", "Use specified config file instead of CIPHERDIR/gocryptfs.conf")
flagSet.StringVar(&args.extpass, "extpass", "", "Use external program for the password prompt")
flagSet.StringVar(&args.o, "o", "", "Pass additional mount options to the kernel, comma-separated list")
flagSet.IntVar(&args.notifypid, "notifypid", 0, "Send USR1 to the specified process after "+
"successful mount - used internally for daemonization")
flagSet.IntVar(&args.scryptn, "scryptn", configfile.ScryptDefaultLogN, "scrypt cost parameter logN. "+
@ -402,13 +403,6 @@ func initFuseFrontend(key []byte, args argContainer, confFile *configfile.ConfFi
// Make the kernel check the file permissions for us
mOpts.Options = append(mOpts.Options, "default_permissions")
}
if os.Getuid() == 0 {
// FUSE filesystems are mounted with "nodev" by default. If we run as root,
// we can use device files by passing the opposite mount option, "dev".
mOpts.Options = append(mOpts.Options, "dev")
// Same thing for "nosuid". If we run as root, we can pass "suid".
mOpts.Options = append(mOpts.Options, "suid")
}
// Set values shown in "df -T" and friends
// First column, "Filesystem"
mOpts.Options = append(mOpts.Options, "fsname="+args.cipherdir)
@ -419,7 +413,13 @@ func initFuseFrontend(key []byte, args argContainer, confFile *configfile.ConfFi
if args.ro {
mOpts.Options = append(mOpts.Options, "ro")
}
// Add additional mount options (if any) after the stock ones, so the user has
// a chance to override them.
if args.o != "" {
parts := strings.Split(args.o, ",")
tlog.Debug.Printf("Adding -o mount options: %v", parts)
mOpts.Options = append(mOpts.Options, parts...)
}
srv, err := fuse.NewServer(conn.RawFS(), args.mountpoint, &mOpts)
if err != nil {
tlog.Fatal.Printf("Mount failed: %v", err)