[infeo]

Closes #222.

This PR replaces the list of well-known libfuse locations for common linux distros with a linux-like approach using dladdr() to get the library path.

Tested with Ubuntu 24.04 and the Cryptomator flatpak.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
1 Accepted issue

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 05d82ef1-7c41-456a-ae60-04a95a8a1ff9

📥 Commits

Reviewing files that changed from the base of the PR and between 684d19b and 5ef40aa.

📒 Files selected for processing (3)

• CHANGELOG.md
• src/main/java/org/cryptomator/frontend/fuse/mount/LinuxFuseMountProvider.java
• src/main/java/org/cryptomator/frontend/fuse/mount/LinuxFuseUtil.java

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

Linux mounting now obtains the libfuse3 path by loading libfuse3.so.3 and then libfuse3.so.4, and resolving fuse_version with FFM dladdr. LinuxFuseUtil caches the resulting absolute path as an Optional<Path>. If neither lookup succeeds, mount() throws IllegalStateException. The hard-coded candidate path list was removed. The Unreleased changelog records the NixOS issue and lookup change.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix · Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to 5ef40

The change replaces fixed library paths with native discovery while retaining an explicit failure when libfuse cannot be found. No actionable merge-blocking risk is established.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 5ef40

Library discovery now depends on the application's native-library search environment rather than fixed locations. No exploitable security regression was established, but deployment controls and downstream library loading remain unverified. Discovery failures also persist across subsequent mount attempts.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — If an attacker can cause a malicious library to win native resolution, its execution would have the mounting JVM's authority and could affect all data and credentials accessible to that process, not merely one mount. Elevated privileges, cross-tenant reachability, and independently attacker-controlled search configuration were not established.

Security Findings and Attack Paths

• inferred — A conditional attack path is control of a searched directory or loader configuration, followed by selection and execution of an unexpected libfuse SONAME. Unlike the base's fixed primary-library paths, the head delegates this selection to the loader. This is not a verified vulnerability: deployment controls, attacker separation, and equivalent pre-existing downstream exposure remain unresolved.

Trust Boundaries and Controls

• observed — The changed code trusts the loader-selected library and dladdr-reported path without validating location or ownership. The symbol check and absolute-path conversion establish lookup results, not library authenticity, and occur after native loading.

Resilience and Maintainability Implications

• observed — Confined arenas bound discovery-resource lifetime, and lookup failures fall back to the next SONAME. Cache initialization is nevertheless a non-atomic check followed by publication: concurrent callers can duplicate native work and overwrite earlier results. A final empty result blocks subsequent discovery attempts for the shared classloader. No concrete security impact or interruptible lookup path was established.

Hardening Proposals

• proposed — Define the native-loader trust contract for consuming applications. Where startup configuration crosses an untrusted boundary, constrain the loader environment and searched directories before discovery; validating the returned path alone is too late to prevent initial native execution.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 40.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 2 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The PR addresses #222. LinuxFuseUtil loads libfuse3.so.3 and libfuse3.so.4 through the dynamic linker and uses dladdr on fuse_version to obtain the resolved library path. This uses the loade…
Out of Scope Changes check	✅ Passed	The changes stay within #222. The mount-provider change integrates the new library lookup, LinuxFuseUtil implements that lookup, and the changelog documents the fix. No unrelated product behavior is…
Title check	✅ Passed	The title clearly and concisely describes the main change: using FFI to locate libfuse.
Description check	✅ Passed	The description directly explains the replacement of hard-coded libfuse paths with dladdr() and identifies the NixOS-related objective and testing performed.

Full details: Docstring Coverage

Explanation

Docstring coverage is 40.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 2 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}