Google Cloud中FUSE挂载GCS桶遇403及权限禁止错误求助

Hey there, let's work through this frustrating permission error you're hitting when trying to mount your GCS bucket to the uploads directory. That fusermount: mount failed: Operation not permitted message usually boils down to permission misconfigurations—either with your user account, the mount point, or GCS FUSE itself. Here are the steps to resolve it:

• Add your user to the fuse group
  Fusermount requires users to be in the fuse group to perform mounts without root. Run this command to add your user, then log out and back in (or run newgrp fuse to apply changes immediately):

  sudo usermod -aG fuse $USER
  

• Fix mount point permissions
  Make sure the target directory has the right ownership and permissions for your user to write to it. I noticed a typo "porject" in your path—double-check it matches your actual directory, then run:

  sudo chown $USER:$USER /var/www/html/project/app/webroot/uploads
  sudo chmod 755 /var/www/html/project/app/webroot/uploads
  

• Enable cross-user access (if needed)
  If you need other processes (like your web server) to access the mounted bucket, edit the fuse config to allow this:

  sudo nano /etc/fuse.conf
  

  Remove the # comment from the line user_allow_other, save the file, then mount with the -o allow_other flag:

  gcsfuse -o allow_other your-bucket-name /var/www/html/project/app/webroot/uploads
  

• Verify VM service account permissions
  Ensure the service account attached to your GCP VM has necessary GCS roles (like Storage Object Admin or Storage Bucket Admin). You can check this in the GCP Console: go to your VM instance > Details > Service account, then confirm the roles assigned to that account.

• Test with security modules disabled
  Tools like AppArmor (Ubuntu/Debian) or SELinux (CentOS/RHEL) might block the mount. Temporarily disable them to rule this out:

  • For AppArmor:

    sudo systemctl stop apparmor
    

  • For SELinux:

    sudo setenforce 0
    

  If the mount works, create custom rules to allow GCS FUSE instead of keeping these modules disabled long-term.

If none of these steps fix the issue, check system logs for more details—use journalctl -u gcsfuse or look in /var/log/syslog for specific errors from the gcsfuse daemon.

内容的提问来源于stack exchange，提问作者Eldhose Elias