From ef352e5401b276b155a93cba39e6a02ac2d7ebfc Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Mon, 1 Jun 2026 19:54:38 +0200 Subject: [PATCH 1/8] nixos/fuse: disable by default This change disables the fuse module by default and shifts the obligation to enable it to consumers. --- nixos/doc/manual/release-notes/rl-2611.section.md | 2 ++ nixos/modules/profiles/bashless.nix | 2 -- nixos/modules/programs/fuse.nix | 4 +--- 3 files changed, 3 insertions(+), 5 deletions(-) diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md index 0252bcb370ea..2a79a0500d3a 100644 --- a/nixos/doc/manual/release-notes/rl-2611.section.md +++ b/nixos/doc/manual/release-notes/rl-2611.section.md @@ -58,4 +58,6 @@ - `security.polkit.settings` added for RFC42 style configuration of the polkitd daemon. +- The `programs.fuse` module, which provides the `fusermount3` executable and the `/etc/fuse.conf` config file, is now opt-in. The obligation to enable it has been shifted to its various consumers (e.g. gvfs, flatpak, appimage, sshfs). This can break fuse consumers at runtime, that don't explicitly declare that dependency with a module, e.g the mounting functionality in various backup tools (borg, restic, rclone, ...). + - The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`. diff --git a/nixos/modules/profiles/bashless.nix b/nixos/modules/profiles/bashless.nix index 501563b97b3d..20f2f7256f07 100644 --- a/nixos/modules/profiles/bashless.nix +++ b/nixos/modules/profiles/bashless.nix @@ -15,8 +15,6 @@ environment.corePackages = lib.mkForce [ ]; # Contains bash completions nix.enable = lib.mkDefault false; - # The fuse{,3} package contains a runtime dependency on bash. - programs.fuse.enable = lib.mkDefault false; documentation.man.man-db.enable = lib.mkDefault false; # autovt depends on bash console.enable = lib.mkDefault false; diff --git a/nixos/modules/programs/fuse.nix b/nixos/modules/programs/fuse.nix index e7e317d7ef9b..07026cbd33db 100644 --- a/nixos/modules/programs/fuse.nix +++ b/nixos/modules/programs/fuse.nix @@ -12,9 +12,7 @@ in meta.maintainers = [ ]; options.programs.fuse = { - enable = lib.mkEnableOption "fuse" // { - default = true; - }; + enable = lib.mkEnableOption "fuse"; mountMax = lib.mkOption { # In the C code it's an "int" (i.e. signed and at least 16 bit), but From 5a7a109c5ac4e41c5d508ddfd45129cd9d1f1319 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Mon, 1 Jun 2026 19:56:50 +0200 Subject: [PATCH 2/8] nixos/gvfs: enable fuse --- nixos/modules/services/desktops/gvfs.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/modules/services/desktops/gvfs.nix b/nixos/modules/services/desktops/gvfs.nix index 004810327798..cebfb0820229 100644 --- a/nixos/modules/services/desktops/gvfs.nix +++ b/nixos/modules/services/desktops/gvfs.nix @@ -40,6 +40,8 @@ in environment.systemPackages = [ cfg.package ]; + programs.fuse.enable = true; + services.dbus.packages = [ cfg.package ]; systemd.packages = [ cfg.package ]; From bd44b6318872853768665494351ad5fe75e83f0d Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 2 Jun 2026 01:43:26 +0200 Subject: [PATCH 3/8] nixos/kubo: enable programs.fuse --- nixos/modules/services/network-filesystems/kubo.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/network-filesystems/kubo.nix b/nixos/modules/services/network-filesystems/kubo.nix index 3c75423f3ffa..4e676b80a1aa 100644 --- a/nixos/modules/services/network-filesystems/kubo.nix +++ b/nixos/modules/services/network-filesystems/kubo.nix @@ -332,8 +332,9 @@ in boot.kernel.sysctl."net.core.rmem_max" = lib.mkDefault 7500000; boot.kernel.sysctl."net.core.wmem_max" = lib.mkDefault 7500000; - programs.fuse = lib.mkIf (cfg.autoMount && cfg.settings.Mounts.FuseAllowOther) { - userAllowOther = true; + programs.fuse = { + enable = lib.mkIf cfg.autoMount true; + userAllowOther = lib.mkIf cfg.settings.Mounts.fuseAllowOther true; }; users.users = lib.mkIf (cfg.user == "ipfs") { From 69a96a84d616f8075fb03c4c233d11ee994cc2d8 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 2 Jun 2026 02:05:22 +0200 Subject: [PATCH 4/8] nixos/flatpak: enable fuse --- nixos/modules/services/desktops/flatpak.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/modules/services/desktops/flatpak.nix b/nixos/modules/services/desktops/flatpak.nix index 5756738c9fda..e874cbac7a4f 100644 --- a/nixos/modules/services/desktops/flatpak.nix +++ b/nixos/modules/services/desktops/flatpak.nix @@ -40,6 +40,8 @@ in pkgs.fuse3 ]; + programs.fuse.enable = true; + security.polkit.enable = true; fonts.fontDir.enable = true; From 28c15019478ea63cb4484f6e819993d9a43f6fb4 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 2 Jun 2026 02:06:30 +0200 Subject: [PATCH 5/8] nixos/appimage: enable fuse --- nixos/modules/programs/appimage.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/modules/programs/appimage.nix b/nixos/modules/programs/appimage.nix index c0379557c97a..4662a6c3d8cc 100644 --- a/nixos/modules/programs/appimage.nix +++ b/nixos/modules/programs/appimage.nix @@ -43,6 +43,8 @@ in } ); environment.systemPackages = [ cfg.package ]; + + programs.fuse.enable = true; }; meta.maintainers = with lib.maintainers; [ From ab51f0dbef1ff1b7ba0fc1b59b3a366117eaefd2 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 2 Jun 2026 02:43:40 +0200 Subject: [PATCH 6/8] nixos/sshfs: enable fuse --- nixos/modules/tasks/filesystems/sshfs.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/modules/tasks/filesystems/sshfs.nix b/nixos/modules/tasks/filesystems/sshfs.nix index f070779ecc54..917ceea7b691 100644 --- a/nixos/modules/tasks/filesystems/sshfs.nix +++ b/nixos/modules/tasks/filesystems/sshfs.nix @@ -10,6 +10,8 @@ lib.mkIf (config.boot.supportedFilesystems.sshfs or config.boot.supportedFilesystems."fuse.sshfs" or false) { + programs.fuse.enable = true; + system.fsPackages = [ pkgs.sshfs ]; }; } From 99ed707074f5a579998e1072a3b83fd9f9d16e97 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Fri, 5 Jun 2026 13:56:54 +0200 Subject: [PATCH 7/8] nixos/test/gocryptfs: enable fuse --- nixos/tests/gocryptfs.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/tests/gocryptfs.nix b/nixos/tests/gocryptfs.nix index d0e5df5e40b5..763e1c1407fa 100644 --- a/nixos/tests/gocryptfs.nix +++ b/nixos/tests/gocryptfs.nix @@ -13,6 +13,8 @@ pkgs.openssl ]; + programs.fuse.enable = true; + specialisation.fstab-test.configuration = { # This can't be fileSytems, as the qemu machinery doesn't honor it. virtualisation.fileSystems."/plain" = { From a92efa870c547481956055a2011475aee39b1ae1 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Mon, 15 Jun 2026 17:51:15 +0200 Subject: [PATCH 8/8] nixos/plasma6: opt into fuse Used by the kio-* stack. --- nixos/modules/services/desktop-managers/plasma6.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/modules/services/desktop-managers/plasma6.nix b/nixos/modules/services/desktop-managers/plasma6.nix index 0813b1b6b84c..f6106d3e83fe 100644 --- a/nixos/modules/services/desktop-managers/plasma6.nix +++ b/nixos/modules/services/desktop-managers/plasma6.nix @@ -274,6 +274,7 @@ in services.power-profiles-daemon.enable = mkDefault true; services.system-config-printer.enable = mkIf config.services.printing.enable (mkDefault true); + programs.fuse.enable = true; services.udisks2.enable = true; services.upower.enable = config.powerManagement.enable; services.libinput.enable = mkDefault true;