Hi,

I've the following issue with sshfs while it doesn't happen when I login
using ssh:

root@itek:~# sshfs rpi:/ /media/raspberrypi
root@itek:~# LC_ALL=C.UTF-8 ls -l -a -h /media/raspberrypi/etc/alternatives/rsh
ls: cannot read symbolic link '/media/raspberrypi/etc/alternatives/rsh': Operation not permitted
lrwxrwxrwx 1 root root 12 Nov 27 2019
/media/raspberrypi/etc/alternatives/rsh
root@itek:~# /bin/fusermount -u /media/raspberrypi/
root@itek:~# ssh rpi

[...]

root@raspberrypi:~# LC_ALL=C.UTF-8 ls -l -a -h /etc/alternatives/rsh
lrwxrwxrwx 1 root root 12 Nov 27 2019 /etc/alternatives/rsh -> /usr/bin/ssh

I pick "/etc/alternatives/rsh" as case test but many symlinks cannot be
read when mounting the filesystem via sshfs. I don't want to use the
option "follow_symlinks":

root@itek:~# sshfs -o follow_symlinks rpi:/ /media/raspberrypi
root@itek:~# LC_ALL=C.UTF-8 ls -l -a -h /media/raspberrypi/etc/alternatives/rsh
-rwxr-xr-x 1 root root 771K Apr 16 18:19 /media/raspberrypi/etc/alternatives/rsh
root@itek:~# /bin/fusermount -u /media/raspberrypi/

because sshfs replace the symlink with the pointed file, I just want the symlink be readable. Does anybody know how to accomplish that?

Thank you very much for any hint, kind regards.
--
Franco Martelli

--- PyGate Linux v1.5.19
* Origin: Dragon's Lair, PyGate NNTP<>Fido Gate (3:633/10)

Hi,

On Mon, Jul 27, 2026 at 03:44:17PM +0200, Franco Martelli wrote:

I've the following issue with sshfs while it doesn't happen when I login using ssh:

root@itek:~# sshfs rpi:/ /media/raspberrypi
root@itek:~# LC_ALL=C.UTF-8 ls -l -a -h /media/raspberrypi/etc/alternatives/rsh
ls: cannot read symbolic link '/media/raspberrypi/etc/alternatives/rsh': Operation not permitted

Without the option "follow_symlinks" isn't it the case that sshfs can't
follow symlinks at all?

Also note that without the option "transform_symlinks", symlinks to
absolute paths (such as all the ones in /etc/alternatives/) will be
pointing to paths on your source system, not the paths they would
ordinarily point to on the remote system.

Thanks,
Andy

--
https://bitfolk.com/ -- No-nonsense VPS hosting

--- PyGate Linux v1.5.19
* Origin: Dragon's Lair, PyGate NNTP<>Fido Gate (3:633/10)

On 27/07/2026 10:44, Franco Martelli wrote:

Hi,

I've the following issue with sshfs while it doesn't happen when I login using ssh:

root@itek:~# sshfs rpi:/ /media/raspberrypi
root@itek:~# LC_ALL=C.UTF-8 ls -l -a -h /media/raspberrypi/etc/ alternatives/rsh
ls: cannot read symbolic link '/media/raspberrypi/etc/alternatives/rsh': Operation not permitted
lrwxrwxrwx 1 root root 12 Nov 27ÿ 2019 /media/raspberrypi/etc/ alternatives/rsh
root@itek:~# /bin/fusermount -u /media/raspberrypi/
root@itek:~# ssh rpi

[...]

root@raspberrypi:~# LC_ALL=C.UTF-8 ls -l -a -h /etc/alternatives/rsh lrwxrwxrwx 1 root root 12 Nov 27ÿ 2019 /etc/alternatives/rsh -> /usr/ bin/ssh

I pick "/etc/alternatives/rsh" as case test but many symlinks cannot be
read when mounting the filesystem via sshfs. I don't want to use the
option "follow_symlinks":

root@itek:~# sshfs -o follow_symlinks rpi:/ /media/raspberrypi
root@itek:~# LC_ALL=C.UTF-8 ls -l -a -h /media/raspberrypi/etc/ alternatives/rsh
-rwxr-xr-x 1 root root 771K Apr 16 18:19 /media/raspberrypi/etc/ alternatives/rsh
root@itek:~# /bin/fusermount -u /media/raspberrypi/

because sshfs replace the symlink with the pointed file, I just want the symlink be readable. Does anybody know how to accomplish that?

Thank you very much for any hint, kind regards.

I had to add -o no_contain_symlinks to a sshfs mount recently (even if
the symlink containing .. pointed to a file inside the shared
directory). Note that this option might allow access to files outside
the shared directory.

--
Love sometimes expresses itself in sacrifice.
-- Kirk, "Metamorphosis", stardate 3220.3

Eduardo M KALINOWSKI
eduardo@kalinowski.com.br

--- PyGate Linux v1.5.19
* Origin: Dragon's Lair, PyGate NNTP<>Fido Gate (3:633/10)

I just ran into something like this recently. I sshfs mounted remote
directory /home/remote-user locally on /home/local-user/mnt


A symlink in the remote directory pointing at /usr/lib/my-app appeared
broken. I assumed this was a result of the symlink pointing outside of
the shared path.

As I only temporarily needed to access it, my quick and dirty fix was to
copy the remote small directory /usr/lib/my-app into
/home/remote-user/my-app then I could easily access those files over
sshfs. After I was finished, I deletedÿ/home/remote-user/my-app

--- PyGate Linux v1.5.19
* Origin: Dragon's Lair, PyGate NNTP<>Fido Gate (3:633/10)

On 27/07/26 at 16:12, Eduardo M KALINOWSKI wrote:

I had to add -o no_contain_symlinks to a sshfs mount recently (even if
the symlink containing .. pointed to a file inside the shared
directory). Note that this option might allow access to files outside
the shared directory.

Thanks it worked, I recently upgrade Trixie to 13.6 and in my log
results that sshfs was updated:

root@itek:~# grep -i --color sshfs upgrade-trixie_1.script
libixml11t64 libtdb1 sshfs
Get:113 http://deb.debian.org/debian trixie/main amd64 sshfs amd64 3.7.3-1.2~deb13u1 [46.7 kB]
Fetched 571 MB in 2min 56s (3240 kB/s)

Preparing to unpack .../90-sshfs_3.7.3-1.2~deb13u1_amd64.deb ...
Unpacking sshfs (3.7.3-1.2~deb13u1) over (3.7.3-1.1+b2) ...
Setting up sshfs (3.7.3-1.2~deb13u1) ...

earlier sshfs read all symlinks in that directory (/media/raspberrypi/etc/alternatives/). The ssh server is on
old-old-stable version: "OpenSSH_8.4p1 Debian-5+deb11u6, OpenSSL 1.1.1w
11 Sep 2023".

Maybe some misbehavior it was introduced with the new version of sshfs.

Kind regards,
--
Franco Martelli

--- PyGate Linux v1.5.19
* Origin: Dragon's Lair, PyGate NNTP<>Fido Gate (3:633/10)

On 27/07/26 at 16:03, Andy Smith wrote:

Without the option "follow_symlinks" isn't it the case that sshfs can't follow symlinks at all?

nope, with "follow_symlinks" the symlink is replaced by the file pointed
by the symlink:

root@itek:~# sshfs -o follow_symlinks rpi:/ /media/raspberrypi
root@itek:~# LC_ALL=C.UTF-8 ls -l -a -h /media/raspberrypi/etc/alternatives/rsh
-rwxr-xr-x 1 root root 771K Apr 16 18:19 /media/raspberrypi/etc/alternatives/rsh
root@itek:~# /bin/fusermount -u /media/raspberrypi/

I don't want that.

Also note that without the option "transform_symlinks", symlinks to
absolute paths (such as all the ones in/etc/alternatives/) will be
pointing to paths on your source system, not the paths they would
ordinarily point to on the remote system.

With "transform_symlinks" in addiction I got a warning, but the same
error message, sadly it doesn't work:

root@itek:~# sshfs -o transform_symlinks rpi:/ /media/raspberrypi
warning: transform_symlinks with contain_symlinks may reject transformed
links containing '..' - consider adding -o no_contain_symlinks
root@itek:~# LC_ALL=C.UTF-8 ls -l -a -h /media/raspberrypi/etc/alternatives/rsh
ls: cannot read symbolic link '/media/raspberrypi/etc/alternatives/rsh': Operation not permitted
lrwxrwxrwx 1 root root 12 Nov 27 2019
/media/raspberrypi/etc/alternatives/rsh
root@itek:~# /bin/fusermount -u /media/raspberrypi/

it works with "no_contain_symlinks" see my other email to Eduardo.
I tar.gzipped the symlinks and then extracted "etc/alternatives/rsh" in another directory, it seems OK to me, do you suggest other options
together "no_contain_symlinks" ?

kind regards,
--
Franco Martelli

--- PyGate Linux v1.5.19
* Origin: Dragon's Lair, PyGate NNTP<>Fido Gate (3:633/10)

On 27/07/26 at 16:51, nwe wrote:

I just ran into something like this recently. I sshfs mounted remote directory /home/remote-user locally on /home/local-user/mnt

A symlink in the remote directory pointing at /usr/lib/my-app appeared broken. I assumed this was a result of the symlink pointing outside of
the shared path.

As I only temporarily needed to access it, my quick and dirty fix was to copy the remote small directory /usr/lib/my-app into /home/remote-user/ my-app then I could easily access those files over sshfs. After I was finished, I deletedÿ/home/remote-user/my-app

This isn't viable for me, I use sshfs to mount the root filesystem of a
device for backup purpose, I cannot deal with copying a directory from
/etc to other directory.

Kind regards,
--
Franco Martelli

--- PyGate Linux v1.5.19
* Origin: Dragon's Lair, PyGate NNTP<>Fido Gate (3:633/10)

On Mon, Jul 27, 2026 at 21:49:54 +0200, Franco Martelli wrote:

This isn't viable for me, I use sshfs to mount the root filesystem of a device for backup purpose, I cannot deal with copying a directory from /etc to other directory.

OK, now I understand what behavior you want.

The sshfs changelog has

* add contain_symlinks option to prevent symlink escape attacks
(CVE-2026-47187) (Closes: #1138293)

The man page says this is enabled by default. So, I think what you want
to do is turn this off.

-o no_contain_symlinks
disable symlink containment and allow all symlink targets through
unchanged, including absolute paths and paths containing ...
Only use this with fully trusted servers.

I believe that'll do what you want.

--- PyGate Linux v1.5.19
* Origin: Dragon's Lair, PyGate NNTP<>Fido Gate (3:633/10)