How to get sudo access to shares mounted by Gigolo

Question

As found around the web or here, I can use Gigolo to mount a Windows share and even access it through a terminal, via the ~/.gvfs/share on server/ directory, such as:

ls ~/.gvfs/share\ on\ server/

Unfortunately, when I try to access the same directory from a command via sudo, e. g.

sudo ls ~/.gvfs/share\ on\ server/

which fails with:

ls: cannot access /home/user/.gvfs/share\ on\ server/: Permission denied

Any suggestions on how to get sudo access to existing Gigolo-mounted shares? Or, how to run Gigolo in order to get sudo access to the shares?

Answer 1

Gigolo is a frontend to gvfs. gvfs uses FUSE (Filesystem in Userspace) in order to mount network devices (such as Windows shares). Such mountpoints cannot normally be read by other users than the user who mounted it, even by root. Why? Karl Auer suggests here that the reason is that

Just because you have root access on one system doesn't mean you should be allowed to see the files to which other people have access on other systems. I'm pretty sure that is why the .gvfs directory is managed the way it is.

That is, if you are user A on machine X, and you mount some directory from machine Y (where you also have a login) to some place on machine X, then root on machine X shouldn't be able to read that, because root on machine X may not usually have any access to machine Y at all.

Bearing that in mind, if you do want to allow root to acces your ~/.gvfs directory, you can proceed as follows.

1) Edit the file /etc/fuse.conf and uncomment the line that reads #user_allow_other. This will later allow your user to start the gvfs-fuse daemon with the allow_root option, which is what you want. The following command does it quickly for you:

$ sudo sed -i -e 's/#user_allow_other/user_allow_other/' /etc/fuse.conf

2) Add your own user to the fuse group, so that you may read the the file /etc/fuse.conf. Otherwise the change in the previous step would have no effect.

$ sudo addgroup USERNAME fuse
$ newgrp fuse

Replace USERNAME with your username, of course. The newgrp command avoids the need to log out and back in again for the group change to take effect. Check that it works by issuing the command:

$ groups

and verify that fuse is listed among the groups that your user belongs to. If it does not work, log out and back in again. At any rate, your user should be able to read /etc/fuse.conf before you proceed with the next step.

3) You are now able to restart the gvfs-fuse daemon with the allow_root option. First, unmount your ~/.gvfs directory:

$ fusermount -zu $HOME/.gvfs

Next, to restart the daemon, issue the following commands on Ubuntu 13.10:

$ killall gvfsd-fuse
$ /usr/lib/gvfs/gvfsd-fuse -o allow_root $HOME/.gvfs

In older Ubuntu versions, the latter two commands may instead be:

$ killall gvfs-fuse-daemon
$ /usr/lib/gvfs/gvfs-fuse-daemon -o allow_root $HOME/.gvfs

4) Restart Gigolo and mount your Windows share again. root should now be able to read your ~/.gvfs directory.

That's it!

In order to make these changes permanent:

To make the changes permanent, you can write the three commands from step 3 into a small script that you autostart at login time. There may be cleaner ways to do this, but this should work. Your script would contain something like the following:

!#/bin/bash
fusermount -zu $HOME/.gvfs
killall gvfsd-fuse
/usr/lib/gvfs/gvfsd-fuse -o allow_root $HOME/.gvfs

Save that to a file and make the file executable:

chmod 755 /path/to/the/file

This script should now be automatically executed at login time. To find out how to autostart applications, refer to How do I start applications automatically on login?.

Some more discussion on the issue can be found here: https://lists.ubuntu.com/archives/ubuntu-users/2008-November/165644.html

Answer 2

I had a similar requirement on 18.04 where I wanted to allow root to access an android phone mounted in gvfs in order to backup files. I thought it would be worth documenting what I did for people googling for a solution. The steps required were taken from @Malte Skoruppas answer and modified for 18.04.

On 18.04 the gvfs mount point is at /run/user/$UID/gvfs not $HOME/.gvfs. In my case UID=1000.

After login the situation is this:

gvfsd-fuse is running:

$ pgrep gvfsd-fuse -l
1856 gvfsd-fuse

The mount exists:

$ mount | grep gvfs
gvfsd-fuse on /run/user/1000/gvfs type fuse.gvfsd-fuse (rw,nosuid,nodev,relatime,user_id=1000,group_id=1000)

And root does not have permission to read the dir

# ls /run/user/1000/gvfs
ls: cannot access '/run/user/1000/gvfs': Permission denied

A normal user has read permissions for /etc/fuse.conf so we do not have to create a fuse group and add our user to it.

$ grep allow /etc/fuse.conf
# Set the maximum number of FUSE mounts allowed to non-root users.
# Allow non-root users to specify the allow_other or allow_root mount options.
user_allow_other

To give root access I did the following:

$ fusermount -zu /var/run/user/1000/gvfs/
$ pkill gvfsd-fuse
$ /usr/lib/gvfs/gvfsd-fuse -o allow_root /var/run/user/1000/gvfs/
$ mount | grep gvfs
gvfsd-fuse on /run/user/1000/gvfs type fuse.gvfsd-fuse (rw,nosuid,nodev,relatime,user_id=1000,group_id=1000,allow_other)

After this root can access the dir.

I do not know why mount shows allow_other rather than allow_root. If I run gvfsd-fuse with -o allow_other the behavior is the same.