Subject: Re: X2Go Client exposes all (network and local) drives on client-side folder sharing

From: "Chavez, Christopher A. (Assoc)" <[email-masked]>
Date: Wed, 27 Jul 2016 00:41:07 +0000

I could almost reproduce this issue using client 4.0.5.1, Windows 7 64-bit, and server 4.0.1.19 on Ubuntu 14.04.

I shared a folder from a running session, and the folder appeared as expected as a fuse.sshfs mount: _cygdrive_C_Users_%USERNAME%_SharedFolder (options: rw,nosuid,nodev,default_permissions,user=$USER)

A few minutes later the _cygdrive_ mount appeared (with same mount options).
However, only the drive corresponding to my %HOMEDRIVE% (which is not C:) has permissions 0700; the other drives (including c) had permissions 0000, so I could not traverse them. It also did not list any drives that appear in My Computer but are either inaccessible (e.g. disconnected share or insufficient permissions) or do not have media present (e.g. empty CD drive). There are also different permissions between the directories for intended shared folder mount (0700) and the ~/media/disk/_cygdrive_ mount (0555). chmod is unable to modify the permissions of the drive folders since it does not have write permissions for _cygrdrive_, but chmod also cannot add write permission to _cygdrive_ either for some reason (which might be expected fuse behavior).

Since the mount options allow_other and allow_root aren't specified, non-root users should not be able to access the files in the intended share mount or the _cygdrive_ mount (it's still possible for other users who can sudo to run sudo -u with your username to access any fuse mounts).

Also, when I go back to Share Folders in the main X2Go Client window, the folder I shared during the session is not listed (although the server is still connected to it).

Christopher A. Chavez
National Institute of Standards and Technology