At least on Ubuntu Lucid the fusermount tool contains a timerace mounting a user filesystem and updating mtab using the standard mount command. Since the mount command is called using exec, the window of opportunity is rather large. The mount command will also normalize the target path so that moving the real fuse mountpoint and replacing it with a symlink will make mount update mtab using the path where the symlink points to, e.g. /proc. The result is, that the real mount entry and mtab entry differ, which makes the fuse-mounted filesystem non-unmountable by an unprivileged user. Crafted mtab entries can then be used to trick fusermount to believe that some part of the filesystem is a user space filesystem and the program will unmount them normally.
Last modified 20171228
Contact e-mail: me (%) halfdog.net