What does 'disable-fusermount' option mean in configure

[amarts]

What exactly does this configure option mean?
--disable-fusermount Use system's fusermount
I am able to build with and without it, but I don't notice anything different

[amarts]

Credits to @csabahenk :

Well, fusermount is specific to Linux. On FreeBSD they have their own mount helper, which is also specific to the platform, and we don't interfere with that.
The help for --disable-fusermount is misleading, so please let me clarify.
The purpose of libfuse's fusermount, and also of glusterfs' fusermount-glusterfs is to allow unprivileged mounts (ie. one who performs the mount is an unprivileged user). This happens in the most basic manner, by using a setuid root helper (contrary to fiddling with capabilities), and that helper is fusermount(-glusterfs).
The reason for having two different helpers, fusermount and fusermount-glusterfs: the mounting scenario of glusterfs has diverged from that of libfuse (because of choosing a different approach to handle the issue of xattr based security frameworks calling into the fs within the mount event, which leads to a deadlock if naively handled), so glusterfs is now bound to use its own variant. Glusterfs cannot use standard fusermount; the choice is either installing and using its own variant, or not facilitate unprivileged mounting.
Why this option exists? Because people might want to avoid installing a setuid root binary.
Do you need fusermount-glusterfs, ie. unprivileged mounting? Most likely no; standard practices of using glusterfs are happy to have glusterfs mounted by root. That said, non-standard workflows might want to experiment with this, so the facility is provided.

Digging into history: original implementation of fusermount-glusterfs has envisioned unprivileged mounting as an extra functionality, and building of the helper was not enabled in the default configuration. The configure help displayed --enable-fusermount Build fusermount. Then at some point it was seen beneficial to enable fusermount by default (probably by a misunderstanding, thinking it's a general requirement for supporting SELinux), and since then what you see now is what's provided. See b2995e0. We can consider reverting this change.

The commit message of this change gives a detailed description of the technical background: fba125a5f.

[itisravi]

It would be nice if this is documented in https://docs.gluster.org/en/latest/Developer-guide/Building-GlusterFS/ too.

[panlinux]

Thanks for this explanation. I still found it a bit confusing, so I went ahead and tried it. I had the misconception that fusermount (from fuse or glusterfs-client) was required even for privileged mounts.

I was using glusterfs as packaged by debian (in ubuntu). In that packaging, glusterfs-client does have /usr/bin/fusermount-glusterfs, but it's NOT installed suid-root.

Using execsnoop from bpf, I was tracing the chain of processes that were called when a client mounted a remote gluster volume, and as root, it never calls any fuse tool. Once I tried the mount again as a regular user, that's when things got interesting.

glusterfs        2204   2139     0 /usr/sbin/glusterfs --acl --log-file=/home/ubuntu/gv0.log --process-name fuse --volfile-server=j1-gluster --volfile-id=/gv0 /gv0
fusermount-glus  2207   2205     0 /usr/bin/fusermount-glusterfs -o allow_other,max_read=131072,fsname=j1-gluster:/gv0,nonempty,subtype=glusterfs -- /gv0

If /usr/bin/fusermount-glusterfs is not suid root, then the above call will fail. Once I made it suid root (which is how fuse installs its own /usr/bin/fusermount, btw), then it worked.

I then proceeded to try this again without enabling gluster's own fusermount, expecting it to just use fuse's suid root /usr/bin/fusermount, but, that's not what happens:

[2022-01-13 20:14:32.595161 +0000] I [mount.c:496:gf_fuse_mount] 0-glusterfs-fuse: direct mount failed (Operation not permitted) errno 1
[2022-01-13 20:14:32.595178 +0000] I [mount.c:501:gf_fuse_mount] 0-glusterfs-fuse: retry to mount via fusermount
[2022-01-13 20:14:32.595184 +0000] E [mount.c:172:fuse_mount_fusermount] 0-glusterfs-fuse: Mounting via helper utility (unprivileged mounting) is supported only if glusterfs is compiled with --enable-fusermount

So it's well explained in the logs. I didn't get any error from mount, though:

ubuntu@gluster-client:~$ mount /gv0 -o log-file=/home/ubuntu/gv0.log;echo $?
0
ubuntu@gluster-client:~$ l /gv0
total 8.0K
drwxr-xr-x  2 ubuntu ubuntu 4.0K Jan 13 20:00 .
drwxr-xr-x 20 root   root   4.0K Jan 13 20:00 ..
ubuntu@gluster-client:~$ 

Still, I think I understand this now. Since the debian packaging isn't installing /usr/bin/fusermount-glusterfs suid root, then it might as well not build gluster's fusermount. Unless it's leaving to the user the decision to add the suid root bit.