Allow mounting to inherited fuse fd (part of #150)

[vladem]

Description of change

• This change allows passing /dev/fd/N as a mount_dir, which will make mountpoint to bypass mounting and serve fuse requests at the provided file descriptor;
• This allows mountpoint being executed without CAP_SYS_ADMIN and with no_new_privs flag, which corresponds to k8s's allowPrivilegeEscalation=false and is enabled by default;
• Similar feature is provided by mount.fuse3 command and by gcs-fuse;
• Changes are mostly located in vendor/fuser, making fuser::mnt::Mount struct public is required for testing and may be avoided.

Relevant issues: #150

Does this change impact existing behavior?

This is not a breaking change.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and I agree to the terms of the Developer Certificate of Origin (DCO).

[vladem]

Hey, noticed a test fuse_tests::readdir_test::readdir_mock failing with error 'called `Result::unwrap()` on an `Err` value: Os { code: 22, kind: InvalidInput, message: "Invalid argument" }', mountpoint-s3/tests/fuse_tests/mod.rs:124:10. While it occurs in the altered part of code, not sure if it's caused by my changes, as I am not able to reproduce it locally:

$ cargo test --features fuse_tests -- readdir_mock --nocapture
<...>
running 1 test
test fuse_tests::readdir_test::readdir_mock ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 96 filtered out; finished in 0.11s
<...>

Any ideas of how to reproduce error happening in CI?

Also let me know your thoughts about altering fuser fork kept at vendor/, I expect it can be burden to merge from upstream afterwards, but also don't see a better way of achieving the result we need.

[antoniomdk]

Awesome work! this is a feature I'm really interested in using. Any chance this can get reviewed and merged?

[jamesbornholt]

@antoniomdk we're still evaluating whether we actually need this or not. Could you tell us a little more about your use case?

[antoniomdk]

@jamesbornholt thanks for the heads up. We are using mountpoint-s3 to load ML training data efficiently in K8s, but it requires a sidecar container with CAP_SYS_ADMIN capabilities. Probably this PR would resolve that. The other alternative we are considering is using a device plugin to register the /dev/fuse device and make it available without elevated permissions.

[jamesbornholt]

Gotcha. We're actively working on a CSI driver that wraps Mountpoint, which you can track the progress of here: #150. The sidecar container permissions issue is definitely on our radar there.