diff options
| -rw-r--r-- | Documentation/MANPAGE.md | 9 | ||||
| -rw-r--r-- | main.go | 18 |
2 files changed, 18 insertions, 9 deletions
diff --git a/Documentation/MANPAGE.md b/Documentation/MANPAGE.md index 11d903d..66e8606 100644 --- a/Documentation/MANPAGE.md +++ b/Documentation/MANPAGE.md @@ -85,6 +85,15 @@ continue be printed to stdout and stderr. : Send USR1 to the specified process after successful mount. This is used internally for daemonization. +**-o** +: Pass additonal mount options to the kernel (comma-separated list). +FUSE filesystems are mounted with "nodev,nosuid" by default. If gocryptfs +runs as root, you can enable device files by passing the opposite mount option, +"dev", and if you want to enable suid-binaries, pass "suid". +"ro" (equivalent to passing the "-ro" option) and "noexec" may also be +interesting. For a complete liste see the section +`FILESYSTEM-INDEPENDENT MOUNT OPTIONS` in mount(8). + **-openssl bool** : Use OpenSSL instead of built-in Go crypto (default "auto"). Using built-in crypto is 4x slower unless your CPU has AES instructions and @@ -45,7 +45,7 @@ type argContainer struct { plaintextnames, quiet, nosyslog, wpanic, longnames, allow_other, ro bool masterkey, mountpoint, cipherdir, cpuprofile, config, extpass, - memprofile string + memprofile, o string notifypid, scryptn int } @@ -185,6 +185,7 @@ func main() { flagSet.StringVar(&args.memprofile, "memprofile", "", "Write memory profile to specified file") flagSet.StringVar(&args.config, "config", "", "Use specified config file instead of CIPHERDIR/gocryptfs.conf") flagSet.StringVar(&args.extpass, "extpass", "", "Use external program for the password prompt") + flagSet.StringVar(&args.o, "o", "", "Pass additional mount options to the kernel, comma-separated list") flagSet.IntVar(&args.notifypid, "notifypid", 0, "Send USR1 to the specified process after "+ "successful mount - used internally for daemonization") flagSet.IntVar(&args.scryptn, "scryptn", configfile.ScryptDefaultLogN, "scrypt cost parameter logN. "+ @@ -402,13 +403,6 @@ func initFuseFrontend(key []byte, args argContainer, confFile *configfile.ConfFi // Make the kernel check the file permissions for us mOpts.Options = append(mOpts.Options, "default_permissions") } - if os.Getuid() == 0 { - // FUSE filesystems are mounted with "nodev" by default. If we run as root, - // we can use device files by passing the opposite mount option, "dev". - mOpts.Options = append(mOpts.Options, "dev") - // Same thing for "nosuid". If we run as root, we can pass "suid". - mOpts.Options = append(mOpts.Options, "suid") - } // Set values shown in "df -T" and friends // First column, "Filesystem" mOpts.Options = append(mOpts.Options, "fsname="+args.cipherdir) @@ -419,7 +413,13 @@ func initFuseFrontend(key []byte, args argContainer, confFile *configfile.ConfFi if args.ro { mOpts.Options = append(mOpts.Options, "ro") } - + // Add additional mount options (if any) after the stock ones, so the user has + // a chance to override them. + if args.o != "" { + parts := strings.Split(args.o, ",") + tlog.Debug.Printf("Adding -o mount options: %v", parts) + mOpts.Options = append(mOpts.Options, parts...) + } srv, err := fuse.NewServer(conn.RawFS(), args.mountpoint, &mOpts) if err != nil { tlog.Fatal.Printf("Mount failed: %v", err) |