Received-SPF: pass (google.com: domain of oss-security-return-30145-linux.lists.archive=gmail.com@lists.openwall.com designates 193.110.157.125 as permitted sender) client-ip=193.110.157.125;
Mailing-List: contact oss-security-help@lists.openwall.com; run by ezmlm
Precedence: bulk
Reply-To: oss-security@lists.openwall.com
Date: Sat, 11 May 2024 13:15:53 +0100
From: Simon McVittie <smcv@debian.org>
To: oss-security@lists.openwall.com
Message-ID: <Zj9hebgV970FCi_6@remnant.pseudorandom.co.uk>
References: <BYAPR03MB4903AF4B05EDB627E47C9370EBE72@BYAPR03MB4903.namprd03.prod.outlook.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <BYAPR03MB4903AF4B05EDB627E47C9370EBE72@BYAPR03MB4903.namprd03.prod.outlook.com>
Subject: [oss-security] Re: lsof "can't stat() fuse.${name} filesystem /run/user/1000/${dir}"

On Fri, 10 May 2024 at 13:19:35 +0000, Corey Lopez wrote:
> Also, I ran the lsof command, which helped me discover 
> the type of file systems that were being used. This prompted me to use apt purge 
> to remove Gnome Virtual File System from my laptop. 
> 
> # lsof /dev/loop*
> 
> I received this in response:
> 
> can't stat() fuse.gvfsd-fuse file system /run/user/1000/gvfs
> can't stat() fuse.portal file system /run/user/1000/doc

This is not evidence of a compromise, and is also nothing to do with
/dev/loop* specifically. You would see the same thing on a system that
is operating correctly, or when issuing other lsof commands as root that
do not involve /dev/loop*.

These are FUSE filesystems running as uid 1000, which by default are
not accessible *by root* - which might seem strange at first glance,
but is an intentional security mechanism to protect root from being
attacked by uid 1000 (see mount.fuse3(8) for details).

fuse.gvfsd-fuse is gvfs (not to be confused with gnomevfs, which is a
much older implementation of the same general concept) making various
remote and virtual filesystems such as SMB and WebDAV available to
non-GLib-based applications as a FUSE filesystem.

fuse.portal is xdg-documents-portal, part of xdg-desktop-portal, and
is used to share a subset of documents between the host system and
sandboxed apps such as Flatpak and Snap under user control, without
needing to extend a higher level of trust to those apps by sharing
entire directories.

    smcv