Fuse mount: make auto_unmount compatible with suid/dev mount options

[matthiasgoergens]

When you run as root, fuse normally does not call fusermount but uses
the mount system call directly. When you specify auto_unmount, it goes
through fusermount instead. However, fusermount is a setuid binary that
is normally called by regular users, so it cannot in general accept suid
or dev options.

In this patch, we split up how fuse mounts as root when auto_unmount is specified.

First, we mount using system calls directly, then we reach out to fusermount to set up auto_unmount only (with no actual mounting done in fusermount).

Fixes #148

[matthiasgoergens]

Btw, I'm a bit worried about race conditions for auto_unmount in general. After all, auto_unmount identifies the mountpoint by path only (both in my new usage, and in established usage). Couldn't something happen in between check and unmount?

[bsbernd]

Yeah, I had scanned through your patches and the code and also seen the race.

[Nikratio]

Thanks for the patch. I am generally not a big fan of auto_unmount, and I don't think I would add this feature today (but it existing we're unfortunately stuck with it).

I've just pushed a commit that explains the drawbacks in more detail: #763

[Nikratio]

Could you also add a unit tests that checks if this works?

[matthiasgoergens]

Yes, working on it.

I discovered a few minor issues when looking at the tests. You've already seen the PRs.

[matthiasgoergens]

@Nikratio I added a test.

[Nikratio]

Looks like the test discovered some memory leaks.

[matthiasgoergens]

Yes, I'll check that. Perhaps it's one I just introduced, even.

[matthiasgoergens]

@Nikratio I found the memory leak and fixed it. Weirdly enough, it's in fuse_opt_parse which should have already been suppressed.

More detail: when fuse_opt_parse handles

	{ "source=%s",
	  offsetof(struct lo_data, source), 0 },

in passthrough_ll.c it allocates a brand-new string for us. And that's the one we have to free properly or get scolded for leaking.

[matthiasgoergens]

The true-branch of this if gives us a malloc-ed string. So for symmetry, we make this one a malloced on, too. So we can free without a care further down.

[matthiasgoergens]

@Nikratio Does this one need more changes?