yashsingh1/xdaforums huggingface dataset:
[Miscellaneous Android Development] agnostic-apollo:
i don't think u got the answer....

currently the magisk rclone mount module is most likely running the mount command as the root user. Since you have blocked root user with afwall, the rclone mount command doesn't work. What you want is to run the rclone mount command not as the root user, but as a different user that you allow through afwall. For that since you have already allowed magisk manager, you can run rclone mount command as the uid/user of the magisk manager and the command should be allowed internet by afwall...

The "su - uid -c "command"" is for that, it allows to run the command as a different uid/user than the root... so find uid of magisk manager and use the su command to run the rclone mount command... search on the internet for how to run a command as a different user with su for more details

Although not sure how much access to the filesystem does magisk manager has and if it has the same access as the root user or not, otherwise u might get permission denied errors...
[Miscellaneous Android Development] Geofferey:
[MENTION=6734471]agnostic-apollo[/MENTION]

Thanks so much, I'm looking forward to trying it. I've read the post, just don't have a lot of time. Most of it has been consumed by the module lol. As for a security debate maybe we should have a discussion outside of this thread. Sorta highjacking with it but I do have some tips for you especially in regards to point #4.

[MENTION=1344291]darfri[/MENTION]

In general you shouldn't block root processes from egress access (outbound). When I configure a firewall I allow everything out and deny inbound traffic unless it's related to my outbound. It's very hard to limit egress access for root on an Android device without blocking all its process at same time. For specific app it's easy to deny because each one has its own UID. Root process will always have UID 0 so that's a delima. As far as I know it's not possible to allow processes via their process ID.
[Miscellaneous Android Development] agnostic-apollo:
yeah no problem, im busy as well. I saw the recent changes to your repo, looked better, custom prams and all...as far as discussion is concerned, drop me an email at agnosticapollo@gmail.com when u can and we can exchange our signal app info or of some web chat on the tor network, we should also share our gpg public keys as well for the initial encrypted emails we will be exchanging :p (and yeah i know its broken now)

i have only played with iptables for dns routing, but wouldn't manufacturer spywares be running with root and the major risk would be apps who are exploiting vulnerabilities to get root access, although any sophisticated root process could add iptable exceptions itself to bypass blocks... on if its actually possible to allow specific procceses with specific uid with iptables, will need to checked and tested...
[Miscellaneous Android Development] westeight:
Hi,

I have two remotes: one a teamdrive + crypt (tcrypt) and one a gdrive + cache + crypt (gcrypt).

The Magisk module finds the drives and mounts them correctly at /mnt/cloud/ and I can access the tcrypt.

I can also access the gdrive, but for some reason I can't access the cached gcrypt ... gives an empty folder. I know the rclone.conf is fine as I use it with rclone Explorer and that can access the gcrypt.

Can I ask if this module supports cached, encrypted remotes?

Thank you :)
[Miscellaneous Android Development] darfri:
This actually makes it pointless indeed. Rooted apps can access net anyway.

Thanks for changing my paradigm
[Miscellaneous Android Development] agnostic-apollo:
yeah and i don't think selinux provides any protection against running iptables by root processes, you could add a special selinux policy to the /system/bin/iptables binary to only allow specific processes like maybe some init related processes and afwall to execute it but apps could still bring their own iptables binary... I'm not an expert in selinux, someone with better knowledge could provide more reliable info...you could also monitor iptables exceptions to find malicious processes of course

---------- Post added at 04:53 ---------- Previous post was at 04:45 ----------

should be supported, Geofferey might have done more testing... although cache remote might be too resource heavy for an android device...

try running rclone mount command with "--log-level DEBUG --log-file /path/to/log_file"

or try using cloud remote -> cache -> crypt instead... there is cache and crypt section on rclone cache page with an issue mentioned, although might not be related to yours...
[Miscellaneous Android Development] westeight:
I can access the folders via cache - but of course they are all encrypted.

When I updated the module to the latest version a short while ago, I noticed that it stated 'Default CACHEMODE off'. Is that the reason I can't access the crypt via the cache?

If so, how do I enable CACHEMODE?
[Miscellaneous Android Development] agnostic-apollo:
firstly you should be tagging Geofferey for magisk rclone mount related problems, since he is the maintainer...

anyways you are confusing different things, CACHEMODE refers to the "--vfs-cache-mode" command parameter to the rclone mount command referred here. It applies to all types of rclone remotes normal,crypt,cache etc when mounting.

Your rclone cache is a type of rclone remote detailed here.

Those are different things. The default value of CACHEMODE is off and can be overridden by using Custom Params mentioned on the github page. It does not disable mounting of the rclone cache remote.

My rclone crypt remote is not encrypted when i mount it on my device and i can see normal filenames. I have not tried rclone cache remote, so do not know if the filenames are supposed to be encrypted or not, possibly shouldn't be. Might depend on if cache -> crypt or crypt -> cache is used.
[Miscellaneous Android Development] HazemSayad:
freezing issue

all through rclone on a terminal, I tried copying an existing drive storage and then remounting it as teamdrive and it can't mount drives anymore.

Tried (not in that order):

- disabling/deleting the module

- deleting and reconfiguring the config file

- manually deleted stuff related to rclone

- manually deleted module from magisk directory

- enabling core mode only

- Changing API's

- clearing cache

Everything was great until i did a copy command for an existing drive (LIU drive) and had everything configured exactly the same as the drive but selected yes for teamdrive and then it hanged at killing and remounting drives (screenshot included)

Edit: rclone is working as expected and accessing the drive without any errors

Edit2: i changed the config twice for it to work while clearing datas and cache and removing some stuff related to the module, it finally worked as it used to work, so this 2nd edit is for anyone, who unfortunately faces whatever i faced, knows how it got fixed
[Miscellaneous Android Development] darfri:
Has anyone got sftp working?

Could you post your conf? obfuscating private parts
[Miscellaneous Android Development] mariospizza:
Has anyone tried it on Android 10?
[Miscellaneous Android Development] mirfatif:
Static fusermount

Anyone looking for static "fusermount" binary may download this one for arm and arm64. It's built with musl libc (void Linux) on Android without making any changes to source code taken from libfuse git. I've been using this with official rclone static binaries without any problems, up to Pie. Set $HOME or use --config option.
[Miscellaneous Android Development] agnostic-apollo:
[MENTION=7805402]mirfatif[/MENTION] thanks for posting, and it's great you got a static compile with mucl... This could be useful.

But note that libfuse source code in OP is patched for android to disable some stuff not "compatible" with android, the official libfuse is not from what I saw when i looked into it. Although the latest version of official libfuse could be more stable and better than the relatively old modified version of OP, and it would be great if someone could look into that and try modifying latest versions or try to get android support added in the official releases...
[Miscellaneous Android Development] ryuksniper:
Hi have the same error. but i can't resolve...
[Miscellaneous Android Development] mirfatif:
On Android sdcard daemon is the main user of libfuse, so libfuse in AOSP code has been modified according to the requirements, so that building with Bionic on SDK/NDK is possible. But using a static binary doesn't require any specific changes as far as I can think of. The only hard-coded paths it uses are /dev/fuse and /etc/fuse.conf. Configuration file is optional as it's required only to set user_allow_other to let non-root users (u)mount FUSE filesystems. That's not the case on Android as root is always needed due to some factors discussed here. Neither there seems to be any other incompatibility e.g. of syscalls.

Also fusermount code has been removed from the latest releases of AOSP due to changes in license.

If something breaks on Android, do share. That can be looked into, though I know almost nothing about coding stuff.
[Miscellaneous Android Development] agnostic-apollo:
sorry for late reply, was busy with stuff...

yeah /etc/fuse.conf is not what I would be worried about since it's not necessary...

I was actually referring to /etc/mtab which is updated by lib/mount_util.c but android does not have that, nor would the symlink /etc to /system/etc exist in all phones to make /etc path accessible...

The libfuse in OP has defined a special c macro __ANDROID__ that disables certain stuff like updates to /etc/mtab and provided alternatives for android in certain places, u can search in the repo...

For example check libfuse lib/mount_util.c from OP. It uses the __ANDROID__ macro to override the mtab_needs_update function, which also ensures that mount and umount --fake and --no-canonicalize command options are not used since mtab_needs_update function always returns 0 when called in fuse_mnt_add_mount and fuse_mnt_remove_mount functions. The mount and umount binaries in android phones don't have those command options. Even termux doesn't have that, since termux-tools mount and umount are just wrappers to /system/bin mount and umount... The libfuse of the OP also had checks to check for support of these command options during compilation at the end of the configure.ac unless you were cross compiling. I had to patch configure.ac in the source i posted a few posts back for successful on device termux compilation.

The official libfuse lib/mount_util.c does not have the __ANDROID__ macro, but mtab_needs_update function in both OP and offical repos already return 0 if /etc/mtab is not found so overriding the function might not be necessary normally, so i don't think it should cause crashes on devices unless someone's device creates /etc/mtab for some other reason, then it would fail while running mount/umoumt commands. Maybe try creating a blank /etc/mtab file and checking. Also there are other places where the __ANDROID__ macro is used in OP and would need looking into. If it has not failed for you and others, then thats good. I just hate crashes, hence wanted this looked into.
[Miscellaneous Android Development] mirfatif:
Static fusermount

"/etc/mtab" is in fact an outdated mechanism to keep track of mounted filesystem which became quite unnecessary after "/proc/mounts" was made available. Also it won't work with innovations like mount namespaces, so even on Linux distros it's only a symlink to "/proc/mounts", just for compatibility. "libfuse" also ignores this:

So it's highly unlikely that "mtab_needs_update" becomes true on Android, as you have stated. (u)mount options "--no-canonicalize" and "--fake" also don't make any difference because they are also related to "mtab".

I doubt that. AOSP defined that symlink even in Android 1.6. OEMs or ROM developers may deviate though. "/bin" symlink is added recently, to keep things synchronized on SAR and non-SAR devices. "mount.fuse" code contains hard-coded path "/bin/sh".

With two exceptions described below, all other __ANDROID__ references (here, here and here) are related to "libpthread" (as they look apparently). This alteration is required when building code with Android NDK which was targeted for "glibc" (or other similar libc's) because Android doesn't have a separate "libpthread.so", the limited functionality is included in "libc" which lacks some functions. Static building with musl libc doesn't need these changes in code.

Defining FUSERMOUNT_DIR also doesn't seem necessary as "fusermount(3)" will be executed from $PATH (note execvp).

Including Android's paths.h is also unnecessary; the only different path ("/proc/mounts" vs "/etc/mtab") variable is _PATH_MOUNTED which is used in libfuse to acquire lock before "umount", or in the above code to update "/etc/mtab". Again it won't produce any errors.

However it's a good idea to exclude the "mtab" related code and it's simple by using IGNORE_MTAB. New static binary is attached.

Download:

fusermount3_static_aarch64_v3.6.2
[Miscellaneous Android Development] agnostic-apollo:
Well after you messaged I realized that there was actually a case for me atleast where mtab would exist. I merge a chroot ubuntu 14.04 distro's rootfs with my android rootfs to run ubuntu stuff directly from android environment without ssh. My scripts replaces the android's "/etc -> /system/etc" with "/etc -> /chroot/etc" and then inside the newly created "/etc", create symlinks to all files inside android "/system/etc". In my ubuntu distro "/etc/mtab" exists and is not a symlink to "/proc/mounts". When I tested the fusermount from your other thread while rootfses were merged, it did not fail, which kinda confused me at first. But after some testing I realized that my scripts also create the symlink "/bin -> /chroot/bin", which actually has the proper mount and umount binaries with the options "--no-canonicalize" and "--fake", making fusermount work properly with the mtab. My initial guess at fusermount failing at the options "--no-canonicalize" and "--fake" was also partially wrong. fusermount would first fail because "/bin/mount" and "/bin/umount" are hardcoded paths and they won't exist in android by default until recently as you have mentioned. The options failure would only occur if they exist at "/bin" but do not support the options.

Without the merging, just creating a file "/system/etc/mtab" and making "/system" RW will cause a failure of fusermount failing to find "/bin/umount". It will not fail if "/system" is RO though, cause "mtab_needs_update" checks for that. I wrote some c code to test as well, which is attached. You can compile it in termux with "clang stat.c -o stat" and run with sudo with "./stat" if any one wanna play around ;)

Basically compilation with IGNORE_MTAB is gonna be needed to ensure failures don't happen. The new binary does work properly and thanks for that. Would be nice if compiled for all archs though, even x86_64 and x86. Is that possible?

I see, I wasn't aware of that. Although I don't remember having it my phone from a few years ago, could be wrong.

Thanks for the "/bin" symlink info too.

Yeah noticed the pthread part when I initially looked. I think I remember from long time ago with issues related to that but if mucl static compile doesn't need changes, that's good.

paths.h is included twice in mount_util.c in OP code for some reason, don't think that should make a difference. And It's already included in official libfuse.

FUSERMOUNT_DIR to execute fusermount is not going to be needed by fusermount, that would be like a cyclic dependency kinda thing ;)

Its apparently used by mount.fuse util and the libs which we are not using. "/bin/sh" won't be an issue too, unless someone uses mount.fuse.

Although rclone uses libfuse-dev for exporting the remote filesystems and from a quick search does not look like it uses mount.fuse util but probably uses the lib APIs only, so issues could be there if any, including pthread stuff, but seems to be working fine till now.

fusermount apparently mainly uses mount_util.c from what I see.

IGNORE_MTAB should probably be enough. Will see if any other issue arises.
[Miscellaneous Android Development] swie:
Hello.

I succesfully instaled fusermount on my LG k350n device (stock rom with supersu). But I have a problem doing rclone mount commad.

See below:

$ rclone mount gcache: gdrive --allow-other --cache-db-purge --allow-non-empty --buffer-size 256M --dir-cache-time 72h --drive-chunk-size 32M --timeout 1h --vfs-cache-mode minimal --vfs-read-chunk-size 128M --vfs-read-chunk-size-limit 1G &
[1] 30993
$ 2019/10/22 13:43:43 mount helper error: fusermount: failed to open /dev/fuse: Permission denied
2019/10/22 13:43:43 Fatal error: failed to mount FUSE fs: fusermount: exit status 1

I try change permissions of fuse file but nothig helps.

$ ls -al fuse crwxrwxrwx 1 u0_a138 u0_a138 10, 229 Sep 29 10:00 fuse

Do You know how fix this ?

Sorry for my bugs in english language ;)
[Miscellaneous Android Development] agnostic-apollo:
run command with su permissions, if using termux install tsu or sudo
[Miscellaneous Android Development] swie:
Thank you.

Now. I have mounted my gdrive in /mnt/gdrive and I can list my files in termux. But only in termux.

So next question is how do it visible for any installed app in my phone ?

There is also possible to saw this in my computer connected with usb cable ?
[Miscellaneous Android Development] agnostic-apollo:
check above... computer one over usb is probably not possible, atleast easily... set up rclone on computer with the same rclone config file, no point in connecting over a usb cable...
[Miscellaneous Android Development] mirfatif:
On Magisk set "Mount Namespace Mode" to "Global". This can be helpful: https://android.stackexchange.com/a/200449/218526
[Miscellaneous Android Development] swie:
Sorry but it's not working for me. Still I don't have new partition visible in other apps.

Maybe I mount in wrong directory ? Should be in /storage ?
[Miscellaneous Android Development] mirfatif:
You need to take care of four things: 1. Ownership 2. Permission mode 3. SELinux context 4. Mount namesapce. Even if one is misconfigured, non-root apps won't be able to access mount point.
[Miscellaneous Android Development] swie:
It sounds complicated.

Can You help me step by step how do it ?

I don't know how check all this points.
[Miscellaneous Android Development] mirfatif:
See this answer.
[Miscellaneous Android Development] ddogishere:
hi is there link to a Step guide to view my unlimited gdrive as Plex server on rooted/magisk android himedia q10 pro?

Many thanks.
[Miscellaneous Android Development] ddogishere:
Hi all in rclone I get message:not enough space when copy or mount 1gb+ file to storage/cloud written gdrive unlimited storage any idea why?

Thx
[Miscellaneous Android Development] swie:
Still withought succes.

I use command

rclone mount gcache: /mnt/runtime/write/emulated/0/gdrive --uid=0 --gid=9997 --umask=022 --allow-other --cache-db-purge --allow-non-empty --buffer-size 64M --dir-cache-time 72h --drive-chunk-size 16M --timeout 1h --vfs-cache-mode minimal --vfs-read-chunk-size 128M --vfs-read-chunk-size-limit 1G &

So I set permissions like another visible folder. But then my cloud files are visible only for root user.

What command should be correct and where I must mount ?

Please help.
[Miscellaneous Android Development] mirfatif:
I just tested:

~# nsenter -t 1 -m -- rclone mount GDrive: /mnt/runtime/write/emulated/0/GDrive --gid 9997 --dir-perms 0771 --file-perms 0660 --umask=0 --allow-other

And it works perfectly. My file explorer and gallery apps are able to see the files. Rclone doesn't accept mount "--option" at the moment, so can't pass "context=" option. But the default SELinux label for FUSE (u:object_r:fuse:s0) is readable/writable by apps in default SELinux policy, so it works in "enforcing" mode.

Mounting to "read" and "default" views isn't necessary. READ_EXTERNAL_STORAGE and WRITE_EXTERNAL_STORAGE belong to same permission group. So granting one to an app also grants the other (except if you explicitly deny one using "pm"). "default" is only to let apps (which don't have READ|WRITE STORAGE permission) traverse "/sdcard/Android/data" directories, no other files in "/sdcard" are readable at all.

Also in my experience mounting to one view also propagates to the other two (at least on "sdcardfs").
[Miscellaneous Android Development] agnostic-apollo:
no propogation in my case whether i bind mount at default or write, like i said, it would depend on the device itself, it might not be universal... mounting to only write does give apps access in my case but maintaining the convention of mounting to all 3 runtime directories should be maintained like its done for internal and external storage by android, even though it might not be necessary for most people, but it could potentially break on some random device, custom implementation or use case and then those people are left with an unknown bug and bang their head about it ;)
[Miscellaneous Android Development] mirfatif:
I can't recall exactly what was the case with FUSE (it's been a few years), but with "sdcardfs" emulation "/mnt/runtime/read/emulated" and "/mnt/runtime/write/emulated" are actually bind mounted from "/mnt/runtime/default/emulated" first, then remounted with changed permissions. So mounting on one VIEW propagates to others due to bind mount.

I can't think of a practical situation where things may break because of this but to be on safe side is a good thing. However you may consider putting a check so that 3 mounts don't become 9. Though this won't either break anything but output from "mount" command may again perplex someone.
[Miscellaneous Android Development] pmj_pedro:
I had no idea that there was so much interest in this. Sorry for ghosting but I didn't receive any notifications from this thread. [MENTION=6734471]agnostic-apollo[/MENTION] thanks for creating a Magisk Module, I may want to use in the future on my MediaPad.
[Miscellaneous Android Development] Cubuss:
just wanna say thank you guys , after messning around with webdav and smb to mount a network drive with no avail.

i did find the rclone magisk module but unfortunately the vfs-cache-mode wasn'nt working which i did need in my usecase,

Nice thing to have rclone natively on android now with mount working,,
[Miscellaneous Android Development] darfri:
Its nice to see someone happy with magisk version as it is very hard to get adequate support for it.

I tried to have mine over sftp and all I had were empty folders from sever, I think it was one level directory depth only also
[Miscellaneous Android Development] Cubuss:
Like i said at first i was using the magisk module to but it was getting me empty folders when using the vfs-cache-mode parameter ,

Really needed vfs-cache-mode for my use case so i found this thread and im now running rclone directly via termux without magisk,
[Miscellaneous Android Development] darfri:
Nice work, codehead :)

If your'e don't happen to be a genius then maybe thats why there is a lack of support for it - people use solution like yours so there would be no buzz around magisk version.

Anyway, if your solution felt easy to build (which would mean again that you ARE a genius) would you mind sharing it? In a form of a shell script maybe or conf file etc
[Miscellaneous Android Development] DumbKing@letthemeatspam:
I rthink the magisk module is broken on the latest canary updates, any help on how to fix?

[MENTION=3421557]Geofferey[/MENTION]
[Miscellaneous Android Development] player594:
I can't get rclone to mount drives to sdcard. I'm using bindsd in the param file with no luck.
[Miscellaneous Android Development] mirfatif:
What resistance rclone shows when you execute this?