Skip to content

Linux/FUSE: tune FUSE 3 init config and fix error mapping #1675

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
abhinavagarwal07 wants to merge 2 commits into
base: master
Choose a base branch
from
+6 −2
Open

Linux/FUSE: tune FUSE 3 init config and fix error mapping #1675

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7f36cff
Linux: configure FUSE 3 caching and inode policy in init
abhinavagarwal07 Apr 15, 2026
f45ef95
FUSE: return EIO instead of EINTR for unhandled exceptions
abhinavagarwal07 Apr 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions src/Driver/Fuse/FuseService.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -125,6 +125,10 @@ namespace VeraCrypt
cfg->set_gid = 1;
cfg->uid = FuseService::GetUserId();
cfg->gid = FuseService::GetGroupId();

cfg->use_ino = 1;
cfg->entry_timeout = 86400.0;
Copy link
Copy Markdown
Member

@idrassi idrassi Apr 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

VeraCrypt auxiliary FUSE mount uses allow_other on Linux and relies on userspace fuse_get_context()->uid checks for access control. libfuse documents a known security issue with allow_other when default_permissions is not used: permission-check results for cached directory entries may be reused for later accesses, including accesses by another user, while the inode remains in kernel cache.

Setting entry_timeout to 24 hours expands that risk for a security-sensitive mount. Please either remove this entry_timeout change or rework the mount to use default_permissions and provide validation that cross-user access behavior remains correct.

cfg->attr_timeout = 1.0;
}

return fuse_service_init_common ();
Expand Down Expand Up @@ -475,12 +479,12 @@ namespace VeraCrypt
catch (std::exception &e)
{
SystemLog::WriteException (e);
return -EINTR;
return -EIO;
}
catch (...)
{
SystemLog::WriteException (UnknownException (SRC_POS));
return -EINTR;
return -EIO;
}
}

Expand Down
Loading