diff --git a/Makefile b/Makefile
index 8cf583a..beccc5f 100644
--- a/Makefile
+++ b/Makefile
@@ -10,9 +10,12 @@ test:
 .phony: root_test
 root_test:
 	./build.bash
-	# Need to use TMPDIR=/var/tmp as TestOverlay fails on tmpfs.
+
+# Need to use TMPDIR=/var/tmp as TestOverlay fails on tmpfs.
 	cd tests/root_test && go test -c && sudo TMPDIR=/var/tmp ./root_test.test -test.v
 
+	cd tests/cli && go test -c && sudo ./cli.test -test.v -test.run=TestDirectMount
+
 .phony: format
 format:
 	go fmt ./...
diff --git a/tests/cli/directmount_test.go b/tests/cli/directmount_test.go
new file mode 100644
index 0000000..da78039
--- /dev/null
+++ b/tests/cli/directmount_test.go
@@ -0,0 +1,61 @@
+package cli
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/moby/sys/mountinfo"
+
+	"github.com/rfjakob/gocryptfs/v2/tests/test_helpers"
+)
+
+// TestDirectMount checks that the effective mount options are what we expect.
+//
+// This test should be run twice:
+// 1) As a normal user (uses fusermount):          make test
+// 2) As root (mount syscall is called directly):  make root_test
+func TestDirectMount(t *testing.T) {
+	type testCase struct {
+		allow_other bool
+	}
+	table := []testCase{
+		{allow_other: false},
+		{allow_other: true},
+	}
+
+	dir := test_helpers.InitFS(t)
+	mnt := dir + ".mnt"
+
+	doTestMountInfo := func(t *testing.T, row testCase) {
+		test_helpers.MountOrFatal(t, dir, mnt, "-extpass=echo test", fmt.Sprintf("-allow_other=%v", row.allow_other))
+		defer test_helpers.UnmountErr(mnt)
+
+		mounts, err := mountinfo.GetMounts(mountinfo.SingleEntryFilter(mnt))
+		if err != nil {
+			t.Fatal(err)
+		}
+		if len(mounts) != 1 {
+			t.Fatalf("Could not find mountpoint %q in /proc/self/mountinfo", mnt)
+		}
+		info := mounts[0]
+
+		if info.FSType != "fuse.gocryptfs" {
+			t.Errorf("wrong FSType: %q", info.FSType)
+		}
+		if info.Source != dir {
+			t.Errorf("wrong Source: have %q, want %q", info.Source, dir)
+		}
+		if !strings.Contains(info.VFSOptions, "max_read=") {
+			t.Errorf("VFSOptions is missing max_read")
+		}
+		if row.allow_other && !strings.Contains(info.VFSOptions, "allow_other") {
+			t.Errorf("VFSOptions is missing allow_other")
+		}
+	}
+
+	for _, row := range table {
+		doTestMountInfo(t, row)
+	}
+
+}