Mount Windows Share with Non-root User

This is the Gnome-Logo made with vectors. GNOM...

Gnome-Logo (Photo credit: Wikipedia)

Linux systems with low security requirements and single users have simple solutions for mounting and using Windows File Shares. The most common solutions require root (or sudo root) fully privileged access.

If you are in an environment with shared Linux systems and requirements to grant only the least privilege necessary for user tasks, the common root-only solutions will not be acceptable. Under CentOS 6.x (and RHEL 6.x), the standard Nautilus file manager has built-in support for non-root users to mount and use Windows File Shares. The core component of GVFS (Gnome Virtual FileSystem) does not expose these remote files to the command-line for access by non-Gnome programs and scripts. To solve this issue, a utility called “gvfs-fuse-daemon” provides a FUSE (Filesystem in USEr-space) mapping of your GVFS mounted shares under the default ~/.gvfs/ location (or /run/usr/$USER/gvfs/ in newer releases). These “fuse” provided files and folders can then be used within the same user session by standard programs and command-line utilities.

There are some basic security concerns with FUSE, so CentOS 6.x has disabled it for all standard users by default. The core “fusermount” tool runs as setuid root (SUID root) – apparently FUSE (and gvfs-fuse-daemon) will not function without this elevated permission for fusermount. In order to permit the use of FUSE, a CentOS 6.x administrator should add specific users to the local “fuse” group. This will keep the number of users running risky setuid root utilities to a minimum.

Remember that Linux group membership is enumerated and cached during logon for your session. You must exit and cleanly log out of your active user session(s) before new membership in the “fuse” group will take effect. Run the “groups” command to check your cached session group list.

Here are some commands that may be helpful when you’re using GVFS mounted shares from non-Gnome programs.

  • gvfs-mount --list
  • mount | grep gvfs
  • ps ux | grep gvfs-fuse

A related article for Linux Mint: Listing remote mounts (via GVFS) on ~/.gvfs/ folder (community.linuxmint.com)

Advertisements

About notesbytom

Keeping technology notes on WordPress.com to free up my mind to solve new problems rather than figuring out the same ones repeatedly :-).
This entry was posted in Linux, System Administration and tagged , , , , , , . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s