Gate FUSE behind a runsc flag

This change gates all FUSE commands (by gating /dev/fuse) behind a runsc
flag. In order to use FUSE commands, use the --fuse flag with the --vfs2
flag. Check if FUSE is enabled by running dmesg in the sandbox.

3 files changed, 21 insertions, 4 deletions

diff --git a/runsc/boot/config.go b/runsc/boot/config.go
index bb01b8fb5..80da8b3e6 100644
--- a/runsc/boot/config.go
+++ b/runsc/boot/config.go
@@ -274,6 +274,9 @@ type Config struct {
 
 	// Enables VFS2 (not plumbled through yet).
 	VFS2 bool
+
+	// Enables FUSE usage (not plumbled through yet).
+	FUSE bool
 }
 
 // ToFlags returns a slice of flags that correspond to the given Config.
@@ -325,5 +328,9 @@ func (c *Config) ToFlags() []string {
 		f = append(f, "--vfs2=true")
 	}
 
+	if c.FUSE {
+		f = append(f, "--fuse=true")
+	}
+
 	return f
 }
diff --git a/runsc/boot/loader.go b/runsc/boot/loader.go
index 0c0423ab2..93ac7ec41 100644
--- a/runsc/boot/loader.go
+++ b/runsc/boot/loader.go
@@ -205,6 +205,10 @@ func New(args Args) (*Loader, error) {
 	// Is this a VFSv2 kernel?
 	if args.Conf.VFS2 {
 		kernel.VFS2Enabled = true
+		if args.Conf.FUSE {
+			kernel.FUSEEnabled = true
+		}
+
 		vfs2.Override()
 	}
 
diff --git a/runsc/boot/vfs.go b/runsc/boot/vfs.go
index 6ee6fae04..56f4ba15d 100644
--- a/runsc/boot/vfs.go
+++ b/runsc/boot/vfs.go
@@ -86,9 +86,12 @@ func registerFilesystems(k *kernel.Kernel) error {
 		return fmt.Errorf("registering ttydev: %w", err)
 	}
 
-	if err := fuse.Register(vfsObj); err != nil {
-		return fmt.Errorf("registering fusedev: %w", err)
+	if kernel.FUSEEnabled {
+		if err := fuse.Register(vfsObj); err != nil {
+			return fmt.Errorf("registering fusedev: %w", err)
+		}
 	}
+
 	if err := tundev.Register(vfsObj); err != nil {
 		return fmt.Errorf("registering tundev: %v", err)
 	}
@@ -110,8 +113,11 @@ func registerFilesystems(k *kernel.Kernel) error {
 	if err := tundev.CreateDevtmpfsFiles(ctx, a); err != nil {
 		return fmt.Errorf("creating tundev devtmpfs files: %v", err)
 	}
-	if err := fuse.CreateDevtmpfsFile(ctx, a); err != nil {
-		return fmt.Errorf("creating fusedev devtmpfs files: %w", err)
+
+	if kernel.FUSEEnabled {
+		if err := fuse.CreateDevtmpfsFile(ctx, a); err != nil {
+			return fmt.Errorf("creating fusedev devtmpfs files: %w", err)
+		}
 	}
 	return nil
 }