WinFsp service mountpoint is public or overlaps the lease re

Error message

WinFsp service mountpoint is public or overlaps the lease resource

What it means

The mountpoint must be a private location that does not collide with anything sensitive. This error fires if the mountpoint is a public/well-known location (is_public_mountpoint), has no parent (a drive root), equals the lease resource_path, or nests inside it / contains it. Mounting into a public location or overlapping the provider's own private lease directory would expose or corrupt private state, so the launch is rejected.

Source

Thrown at crates/astrid-storage-provider-winfsp/src/win.rs:304

        serde_json::from_slice(&manifest).context("decode WinFsp lease manifest")?;
    if admitted != *lease {
        bail!("WinFsp launch lease does not match the kernel manifest");
    }
    if !launch.mountpoint.is_absolute()
        || launch
            .mountpoint
            .components()
            .any(|component| matches!(component, std::path::Component::ParentDir))
    {
        bail!("WinFsp service mountpoint is malformed");
    }
    if is_public_mountpoint(&launch.mountpoint)
        || launch.mountpoint.parent().is_none()
        || launch.mountpoint == lease.resource_path
        || launch.mountpoint.starts_with(&lease.resource_path)
        || lease.resource_path.starts_with(&launch.mountpoint)
    {
        bail!("WinFsp service mountpoint is public or overlaps the lease resource");
    }
    platform_fs::validate_private_directory(&launch.mountpoint)
        .context("validate private WinFsp mountpoint")?;
    platform_fs::verify_no_redirects(&launch.mountpoint)
        .context("reject redirected WinFsp mountpoint")?;
    if std::fs::read_dir(&launch.mountpoint)?.next().is_some() {
        bail!("WinFsp service mountpoint is not empty");
    }
    if !launch.control_path.is_absolute()
        || launch
            .control_path
            .components()
            .any(|component| matches!(component, std::path::Component::ParentDir))
        || launch.control_path != lease.resource_path.join("process-control.sock")
    {
        bail!("WinFsp service control path is malformed");
    }
    let control_parent = launch

View on GitHub (pinned to affd8760f4)

Solutions

Choose a dedicated private mountpoint directory (e.g. under the user's private app-data area) that is not a drive root, public folder, or inside the lease resource_path.
Keep resource_path and mountpoint in disjoint directory trees; assert non-overlap in the launcher before spawning.
If users pass custom mountpoints, validate them in your UI/config layer against is_public_mountpoint and the resource_path before launch.
Copy-paste check: ensure mountpoint was not accidentally set to (or derived from) lease.resource_path.

Example fix

// before
mountpoint: lease.resource_path.clone(),
// after
mountpoint: private_area.join("mounts").join(&mount_id), // disjoint from resource_path

Defensive patterns

Strategy: validation

Validate before calling

let mp = dunce::canonicalize(&mountpoint)?;
let rp = dunce::canonicalize(&lease.resource_path)?;
if is_public_mountpoint(&mp)
    || mp.parent().is_none()
    || mp == rp
    || mp.starts_with(&rp)
    || rp.starts_with(&mp)
{
    return Err(anyhow!("choose a private mountpoint disjoint from the lease resource_path"));
}

Prevention

Default mountpoints to a per-mount private directory named by mount_id
Never point mounts at drive roots, public folders, or the provider's own state tree
Enforce non-overlap of resource_path and mountpoint in the launcher
Screen user-supplied mountpoints with is_public_mountpoint in your config/UI layer

When it happens

Trigger: service_main -> validate_service_launch when is_public_mountpoint(&launch.mountpoint) is true, or mountpoint.parent() is None (e.g. "C:\"), or mountpoint == lease.resource_path, or either path starts_with the other (ancestor/descendant overlap).

Common situations: Users configuring a mount at a drive root or a shared/public folder (C:\Public, Desktop) for convenience; pointing the mountpoint at the provider's own state directory by copy-paste; deriving mountpoint from resource_path with a typo; relocation logic that nests mounts under the lease directory.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/16b2d98d6e93142e. Report an issue: GitHub.