2

As found around the web or here, I can use Gigolo to mount a Windows share and even access it through a terminal, via the ~/.gvfs/share on server/ directory, such as:

ls ~/.gvfs/share\ on\ server/

Unfortunately, when I try to access the same directory from a command via sudo, e. g.

sudo ls ~/.gvfs/share\ on\ server/

which fails with:

ls: cannot access /home/user/.gvfs/share\ on\ server/: Permission denied

Any suggestions on how to get sudo access to existing Gigolo-mounted shares? Or, how to run Gigolo in order to get sudo access to the shares?

2 Answers 2

9

Gigolo is a frontend to gvfs. gvfs uses FUSE (Filesystem in Userspace) in order to mount network devices (such as Windows shares). Such mountpoints cannot normally be read by other users than the user who mounted it, even by root. Why? Karl Auer suggests here that the reason is that

Just because you have root access on one system doesn't mean you should be allowed to see the files to which other people have access on other systems. I'm pretty sure that is why the .gvfs directory is managed the way it is.

That is, if you are user A on machine X, and you mount some directory from machine Y (where you also have a login) to some place on machine X, then root on machine X shouldn't be able to read that, because root on machine X may not usually have any access to machine Y at all.

Bearing that in mind, if you do want to allow root to acces your ~/.gvfs directory, you can proceed as follows.

1) Edit the file /etc/fuse.conf and uncomment the line that reads #user_allow_other. This will later allow your user to start the gvfs-fuse daemon with the allow_root option, which is what you want. The following command does it quickly for you:

$ sudo sed -i -e 's/#user_allow_other/user_allow_other/' /etc/fuse.conf

2) Add your own user to the fuse group, so that you may read the the file /etc/fuse.conf. Otherwise the change in the previous step would have no effect.

$ sudo addgroup USERNAME fuse
$ newgrp fuse

Replace USERNAME with your username, of course. The newgrp command avoids the need to log out and back in again for the group change to take effect. Check that it works by issuing the command:

$ groups

and verify that fuse is listed among the groups that your user belongs to. If it does not work, log out and back in again. At any rate, your user should be able to read /etc/fuse.conf before you proceed with the next step.

3) You are now able to restart the gvfs-fuse daemon with the allow_root option. First, unmount your ~/.gvfs directory:

$ fusermount -zu $HOME/.gvfs

Next, to restart the daemon, issue the following commands on Ubuntu 13.10:

$ killall gvfsd-fuse
$ /usr/lib/gvfs/gvfsd-fuse -o allow_root $HOME/.gvfs

In older Ubuntu versions, the latter two commands may instead be:

$ killall gvfs-fuse-daemon
$ /usr/lib/gvfs/gvfs-fuse-daemon -o allow_root $HOME/.gvfs

4) Restart Gigolo and mount your Windows share again. root should now be able to read your ~/.gvfs directory.

That's it!

In order to make these changes permanent:

To make the changes permanent, you can write the three commands from step 3 into a small script that you autostart at login time. There may be cleaner ways to do this, but this should work. Your script would contain something like the following:

!#/bin/bash
fusermount -zu $HOME/.gvfs
killall gvfsd-fuse
/usr/lib/gvfs/gvfsd-fuse -o allow_root $HOME/.gvfs

Save that to a file and make the file executable:

chmod 755 /path/to/the/file

This script should now be automatically executed at login time. To find out how to autostart applications, refer to How do I start applications automatically on login?.

Some more discussion on the issue can be found here: https://lists.ubuntu.com/archives/ubuntu-users/2008-November/165644.html

10
  • Okay, but what if you get the message "group 'fuse' does not exist"? with the addgroup command?
    – Nuzzolilo
    Jan 1, 2016 at 9:17
  • @Nuzzolilo What Ubuntu version are you using? Also, do you have the package fuse installed? Jan 2, 2016 at 20:06
  • 15.10, and yes.
    – Nuzzolilo
    Jan 2, 2016 at 22:48
  • Also see askubuntu.com/questions/715637/…
    – Nuzzolilo
    Jan 2, 2016 at 22:49
  • 2
    Ok, here's the thing. For some reason your system did not create the group fuse and thus did not make /etc/fuse.conf belong to the group fuse. You created the group, but you also need to change the ownership of the file accordingly to simulate the normal behavior: sudo chown root:fuse /etc/fuse.conf will take care of this. According to /etc/group, your user nuzz is already part of group fuse. Please ensure this is indeed the case using the command groups. If it does not show fuse, try to log out and back in again. Then you should be able to proceed with step 3 of the answer. Jan 3, 2016 at 22:10
1

I had a similar requirement on 18.04 where I wanted to allow root to access an android phone mounted in gvfs in order to backup files. I thought it would be worth documenting what I did for people googling for a solution. The steps required were taken from @Malte Skoruppas answer and modified for 18.04.

On 18.04 the gvfs mount point is at /run/user/$UID/gvfs not $HOME/.gvfs. In my case UID=1000.

After login the situation is this:

gvfsd-fuse is running:

$ pgrep gvfsd-fuse -l
1856 gvfsd-fuse

The mount exists:

$ mount | grep gvfs
gvfsd-fuse on /run/user/1000/gvfs type fuse.gvfsd-fuse (rw,nosuid,nodev,relatime,user_id=1000,group_id=1000)

And root does not have permission to read the dir

# ls /run/user/1000/gvfs
ls: cannot access '/run/user/1000/gvfs': Permission denied

A normal user has read permissions for /etc/fuse.conf so we do not have to create a fuse group and add our user to it.

$ grep allow /etc/fuse.conf
# Set the maximum number of FUSE mounts allowed to non-root users.
# Allow non-root users to specify the allow_other or allow_root mount options.
user_allow_other

To give root access I did the following:

$ fusermount -zu /var/run/user/1000/gvfs/
$ pkill gvfsd-fuse
$ /usr/lib/gvfs/gvfsd-fuse -o allow_root /var/run/user/1000/gvfs/
$ mount | grep gvfs
gvfsd-fuse on /run/user/1000/gvfs type fuse.gvfsd-fuse (rw,nosuid,nodev,relatime,user_id=1000,group_id=1000,allow_other)

After this root can access the dir.

I do not know why mount shows allow_other rather than allow_root. If I run gvfsd-fuse with -o allow_other the behavior is the same.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .