Re: Configuring mount for NTFS partition at boot makes the system unbootable.

[Felix Lechner via <help-guix@gnu.org>]

Hi William,

It seems that help-guix was inadvertently left off of the recipients.  I
hope you don't mind that I copied the mailing list on your response.

On Sun, Mar 03 2024, William wrote:

> Hello.
>
> Thanks for the input, this certainly helped me diagnose the issue.
>
> I set some options so Guix keeps booting if mounting the filesystem
> fails, now I can boot.
>
> I potentially figured out what the issue may be, the filesystem entry is
> defined on /etc/fstab so I tried running "mount -a" without root, and it
> printed this:
>
>> Mount is denied because setuid and setgid root ntfs-3g is insecure
>> with the external FUSE library. Either remove the setuid/setgid bit
>> from the binary or rebuild NTFS-3G with integrated FUSE support and
>> make it setuid root.
>> Please see more information at
>> https://github.com/tuxera/ntfs-3g/wiki/NTFS-3G-FAQ
>
> It seems it's another issue with setuid/setgid. I think this could be
> solved if ntfs-3g is compiled with integrated FUSE support, so
> it doesn't require libfuse at all, then the declaration to load the FUSE
> module wouldn't be needed either I suppose.

I also use FUSE every day and believe it's compiled into our kernels
(i.e. no module). Perhaps someone can help you find our kernel
configurations.

The security concern may also be further explained here. [1]

> Maybe this should be reported as an issue on the Guix tracker?

There is already a bug about it. [2] The filing is from 2021. There is
no proposed solution.

I would write to the bug [3] and ask if there are workarounds. Please
make sure to cc Abdelhakim, whose address you can find here. [4] (I also
copied him on this message.) No one else will receive or read your
message to the bug tracker.

Kind regards
Felix

P.S. Sorry about the complexity of our bug reporting tools. Some work is
being done to simplify them.

[1] https://unparalleled.eu/blog/2022/20220607-help-to-heap-suid-privilege-escalation/
[2] https://issues.guix.gnu.org/46980
[3] 46980@debbugs.gnu.org
[4] https://debbugs.gnu.org/46980