nixos/fuse: disable by default (#528369)

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -58,4 +58,6 @@
 
 - `security.polkit.settings` added for RFC42 style configuration of the polkitd daemon.
 
+- The `programs.fuse` module, which provides the `fusermount3` executable and the `/etc/fuse.conf` config file, is now opt-in. The obligation to enable it has been shifted to its various consumers (e.g. gvfs, flatpak, appimage, sshfs). This can break fuse consumers at runtime, that don't explicitly declare that dependency with a module, e.g the mounting functionality in various backup tools (borg, restic, rclone, ...).
+
 - The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.

nixos/modules/profiles/bashless.nix

@@ -15,8 +15,6 @@
   environment.corePackages = lib.mkForce [ ];
   # Contains bash completions
   nix.enable = lib.mkDefault false;
-  # The fuse{,3} package contains a runtime dependency on bash.
-  programs.fuse.enable = lib.mkDefault false;
   documentation.man.man-db.enable = lib.mkDefault false;
   # autovt depends on bash
   console.enable = lib.mkDefault false;

nixos/modules/programs/appimage.nix

@@ -43,6 +43,8 @@ in
       }
     );
     environment.systemPackages = [ cfg.package ];
+
+    programs.fuse.enable = true;
   };
 
   meta.maintainers = with lib.maintainers; [

nixos/modules/programs/fuse.nix

@@ -12,9 +12,7 @@ in
   meta.maintainers = [ ];
 
   options.programs.fuse = {
-    enable = lib.mkEnableOption "fuse" // {
-      default = true;
-    };
+    enable = lib.mkEnableOption "fuse";
 
     mountMax = lib.mkOption {
       # In the C code it's an "int" (i.e. signed and at least 16 bit), but

nixos/modules/services/desktop-managers/plasma6.nix

@@ -274,6 +274,7 @@ in
 
     services.power-profiles-daemon.enable = mkDefault true;
     services.system-config-printer.enable = mkIf config.services.printing.enable (mkDefault true);
+    programs.fuse.enable = true;
     services.udisks2.enable = true;
     services.upower.enable = config.powerManagement.enable;
     services.libinput.enable = mkDefault true;

nixos/modules/services/desktops/flatpak.nix

@@ -40,6 +40,8 @@ in
       pkgs.fuse3
     ];
 
+    programs.fuse.enable = true;
+
     security.polkit.enable = true;
 
     fonts.fontDir.enable = true;

nixos/modules/services/desktops/gvfs.nix

@@ -40,6 +40,8 @@ in
 
     environment.systemPackages = [ cfg.package ];
 
+    programs.fuse.enable = true;
+
     services.dbus.packages = [ cfg.package ];
 
     systemd.packages = [ cfg.package ];

nixos/modules/services/network-filesystems/kubo.nix

@@ -332,8 +332,9 @@ in
     boot.kernel.sysctl."net.core.rmem_max" = lib.mkDefault 7500000;
     boot.kernel.sysctl."net.core.wmem_max" = lib.mkDefault 7500000;
 
-    programs.fuse = lib.mkIf (cfg.autoMount && cfg.settings.Mounts.FuseAllowOther) {
-      userAllowOther = true;
+    programs.fuse = {
+      enable = lib.mkIf cfg.autoMount true;
+      userAllowOther = lib.mkIf cfg.settings.Mounts.fuseAllowOther true;
     };
 
     users.users = lib.mkIf (cfg.user == "ipfs") {

nixos/modules/tasks/filesystems/sshfs.nix

@@ -10,6 +10,8 @@
     lib.mkIf
       (config.boot.supportedFilesystems.sshfs or config.boot.supportedFilesystems."fuse.sshfs" or false)
       {
+        programs.fuse.enable = true;
+
         system.fsPackages = [ pkgs.sshfs ];
       };
 }

nixos/tests/gocryptfs.nix

@@ -13,6 +13,8 @@
         pkgs.openssl
       ];
 
+      programs.fuse.enable = true;
+
       specialisation.fstab-test.configuration = {
         # This can't be fileSytems, as the qemu machinery doesn't honor it.
         virtualisation.fileSystems."/plain" = {