SSHFS gives full access to every user even with -o allow_other

[ghost]

I've found that the default SSHFS package in Debian 9 (says SSHFS 2.8, FUSE 2.9.7, fuserrmount 2.9.7, kernel interface 7.19) allows any user to write, delete, etc, regardless of permissions. I'd say if this is intentional, it's a bit unobvious from the benign looking man page. If it is unintentional, it's a pretty big security issue and should maybe get a CVE.

Not sure if this is fixed in later versions. I could work with this behavior if there was a -o read_only mode, but I see none. I think that would be a nice feature to have.

I know you said you're busy with other things, I completely understand. I would appreciate it if you can tell me if this was fixed in later versions, intentional or not, etc.

Thank you for your time.

[ghost]

One more thing, I am using -o slave. Maybe that has something to do with it. -o default_permissions doesn't seem to get it working how I'd like, either.

[jakobcornell]

Regarding your workaround, you can mount read-only using the mount option ro (the man page doesn't list these options):

sshfs -o ro user@host:path mountpoint

[Nikratio]

Thanks for the report. This is intentional on the SSHFS side. -o default_permissions (which is implemented purely in the kernel and libfuse) should work as expected, however and should give you the desired access checks. If this doesn't work, it's a bug.

[ghost]

Ah, nice. Looks like -o ro works as intended.

-o default_permissions does not allow any non-root read access (even though by permissions, it should).

Thanks for getting back to me.

[ghost]

I'm pretty confused with this.

$ id
uid=1984(user) gid=1984(user) groups=1984(user),29(audio)
$ whoami
user
$ pwd
/srv/files/software/gopath
$ ls
pkg/
$ mkdir test
$ ls -ld test
drwxr-xr-x 1 root root 4096 Jan 18 00:20 test/
$ cd test
$ touch foo
touch: cannot touch 'foo': Permission denied

Non-root users can make folders, but they get owned by root.

I'm using -o allow_other, -o default_permissions on 2.10.0. Debian Buster (10) now.