From b1b0848bed7f65621dc78efc4a487e8f84733838 Mon Sep 17 00:00:00 2001 From: Alexander Larsson Date: Thu, 11 Jun 2026 10:20:14 +0200 Subject: [PATCH 1/2] Cargo.lock: Update to latest main to pick up new fuse mount api Signed-off-by: Alexander Larsson --- Cargo.lock | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 11a70b8..cf1976f 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -339,7 +339,7 @@ checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9" [[package]] name = "composefs" version = "0.4.0" -source = "git+https://github.com/containers/composefs-rs?branch=main#4c3e68f8ed84b2e909452b1b41635cc37715699e" +source = "git+https://github.com/containers/composefs-rs?branch=main#7f9f81fb4302cb3c4906474138fe15b89ae7f9aa" dependencies = [ "anyhow", "composefs-ioctls", @@ -364,7 +364,7 @@ dependencies = [ [[package]] name = "composefs-fuse" version = "0.4.0" -source = "git+https://github.com/containers/composefs-rs?branch=main#4c3e68f8ed84b2e909452b1b41635cc37715699e" +source = "git+https://github.com/containers/composefs-rs?branch=main#7f9f81fb4302cb3c4906474138fe15b89ae7f9aa" dependencies = [ "anyhow", "composefs", @@ -376,7 +376,7 @@ dependencies = [ [[package]] name = "composefs-ioctls" version = "0.4.0" -source = "git+https://github.com/containers/composefs-rs?branch=main#4c3e68f8ed84b2e909452b1b41635cc37715699e" +source = "git+https://github.com/containers/composefs-rs?branch=main#7f9f81fb4302cb3c4906474138fe15b89ae7f9aa" dependencies = [ "rustix", "thiserror 2.0.18", @@ -385,7 +385,7 @@ dependencies = [ [[package]] name = "composefs-oci" version = "0.4.0" -source = "git+https://github.com/containers/composefs-rs?branch=main#4c3e68f8ed84b2e909452b1b41635cc37715699e" +source = "git+https://github.com/containers/composefs-rs?branch=main#7f9f81fb4302cb3c4906474138fe15b89ae7f9aa" dependencies = [ "anyhow", "async-compression", @@ -429,7 +429,7 @@ dependencies = [ [[package]] name = "composefs-storage" version = "0.4.0" -source = "git+https://github.com/containers/composefs-rs?branch=main#4c3e68f8ed84b2e909452b1b41635cc37715699e" +source = "git+https://github.com/containers/composefs-rs?branch=main#7f9f81fb4302cb3c4906474138fe15b89ae7f9aa" dependencies = [ "anyhow", "base64", From 39c15bef10302be46cdc9ddede845dfe73f0fe9e Mon Sep 17 00:00:00 2001 From: Alexander Larsson Date: Thu, 11 Jun 2026 10:22:13 +0200 Subject: [PATCH 2/2] Drop custom fuse mount code now that upstream has options We couldn't use the composefs-rs API for this as it enforced user_allow_other which doesn't (always) work rootless. This is now fixed. Signed-off-by: Alexander Larsson --- composefs-run/src/fuse.rs | 30 +----------------------------- composefs-run/src/run.rs | 4 +++- 2 files changed, 4 insertions(+), 30 deletions(-) diff --git a/composefs-run/src/fuse.rs b/composefs-run/src/fuse.rs index 6a0667d..2c7b641 100644 --- a/composefs-run/src/fuse.rs +++ b/composefs-run/src/fuse.rs @@ -1,6 +1,6 @@ use std::fs; use std::io::Read; -use std::os::fd::{AsFd, AsRawFd, FromRawFd}; +use std::os::fd::FromRawFd; use std::os::unix::process::CommandExt; use std::path::Path; use std::process::Command; @@ -10,7 +10,6 @@ use clap::Parser; use composefs::fsverity::{FsVerityHashValue, Sha256HashValue, Sha512HashValue}; use composefs::repository::{Repository, read_repo_algorithm}; use rustix::fs::{CWD, Mode, OFlags}; -use rustix::mount::{FsMountFlags, MountAttrFlags}; /// Arguments for the internal FUSE server mode. #[derive(Debug, Parser)] @@ -67,33 +66,6 @@ pub fn spawn_server(repo_path: &Path, erofs_hex: &str, fuse_fd: i32) -> Result<( Ok(()) } -/// Like composefs_fuse::mount_fuse() but without `allow_other`, which -/// requires /etc/fuse.conf `user_allow_other` or CAP_SYS_ADMIN in the -/// init user namespace. We don't need it since only our own process tree -/// accesses the mount. -/// TODO: fix upstream composefs_fuse::mount_fuse() to make allow_other -/// optional, then use that instead. -pub fn mount_rootless(dev_fuse: impl AsFd) -> Result { - let fusefs = composefs::mount::FsHandle::open("fuse")?; - rustix::mount::fsconfig_set_flag(fusefs.as_fd(), "ro")?; - rustix::mount::fsconfig_set_flag(fusefs.as_fd(), "default_permissions")?; - rustix::mount::fsconfig_set_string(fusefs.as_fd(), "source", "composefs-fuse")?; - rustix::mount::fsconfig_set_string(fusefs.as_fd(), "rootmode", "040555")?; - rustix::mount::fsconfig_set_string(fusefs.as_fd(), "user_id", "0")?; - rustix::mount::fsconfig_set_string(fusefs.as_fd(), "group_id", "0")?; - rustix::mount::fsconfig_set_string( - fusefs.as_fd(), - "fd", - format!("{}", dev_fuse.as_fd().as_raw_fd()), - )?; - rustix::mount::fsconfig_create(fusefs.as_fd())?; - Ok(rustix::mount::fsmount( - fusefs.as_fd(), - FsMountFlags::FSMOUNT_CLOEXEC, - MountAttrFlags::empty(), - )?) -} - /// Run the FUSE server (called via --internal-fuse-serve). pub fn run_server(args: &FuseServeArgs) -> Result<()> { let repo_fd = rustix::fs::open( diff --git a/composefs-run/src/run.rs b/composefs-run/src/run.rs index 5a600f6..dab86f0 100644 --- a/composefs-run/src/run.rs +++ b/composefs-run/src/run.rs @@ -203,7 +203,9 @@ fn mount_rootfs_with_fuse( let dev_fuse = composefs_fuse::open_fuse().context("Opening /dev/fuse")?; let fuse_fd_num = dev_fuse.as_raw_fd(); - let fuse_mount_fd = fuse::mount_rootless(&dev_fuse).context("Creating FUSE mount")?; + let fuse_mount_fd = + composefs_fuse::mount_fuse(&dev_fuse, &composefs_fuse::FuseMountOptions::default()) + .context("Creating FUSE mount")?; let erofs_hex = image.erofs_hex.as_deref().context("No composefs image")?; fuse::spawn_server(repo_path, erofs_hex, fuse_fd_num)?;