Module fuse_abuse 

FUSE filesystem abuse detection.

Functions

is_suspicious_fuse_mount

Classify whether a FUSE mount is suspicious based on the daemon’s UID and whether the mounted filesystem has the setuid bit honoured.

scan_fuse_abuse

Scan for FUSE filesystem abuse (mounted over sensitive paths, root daemon with allow_other).