Trust in and maintenance of filesystems

Trust in and maintenance of filesystems

Both FUSE and GVfs put the FS parsing code in a separate process; the only significant difference is that the preferred way to access a FUSE protocol filesystem is to mount it like a "trusted" kernel filesystem, while GVfs is accessed via GIO calls that turn into DBus method calls. This means that if I have a GVfs style filesystem, it's harder to chain attacks into loading code from the filesystem than if I've got a FUSE filesystem (for example, if there's a bug in the program that I can exploit to make it pass an arbitrary path to dlopen or equivalent, I can't use it to dlopen something on a GVfs type filesystem, but I can in theory use it to dlopen something on a FUSE filesystem).

That said, GNOME promptly breaks the extra security benefits of GVfs by having a FUSE bridge that automounts the filesystems as FUSE filesystems, so it's a wash in practice.