Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Suppose that I have only non-root access on a desktop Linux machine.

I want to work with an external, pluggable storage device (hdd, flash drive or memory card) with an ext{2,3,4} file system.

Since I have physical control over the storage device, it seems that I should be able to do whatever I want with it, regardless of my privileges on the current system.

I can mount it using pmount. But how do I access files that have such permissions that I wouldn't be able to access them if they were on a local file system? (For example, files owned by root with permissions 0600)

share|improve this question
    
Anything that lets you do this on an external drive will also allow you to do the same thing on any drive, because there is no inherent difference between internal and external storage. Sounds like a bad idea to enable that. –  Michael Kjörling Feb 6 '13 at 10:40
    
As many things in Unix, it's a matter of policy. The sysadmin should be able to define such a policy (e.g.: treat these particular filesystems as local, everything else as external). –  Roman Cheplyaka Feb 6 '13 at 10:51
    
He can. That's the point of fstab and udev. –  Gael Feb 6 '13 at 12:11
add comment

3 Answers

Whilst you may think you can do what you want, you are still limited by the current system's definition of user permissions. You have physical access to the computer, it doesn't mean you can do what you want through the operating system, you have to do it some other way. The operating system will simply not allow you to do this without the appropriate permissions.

share|improve this answer
    
But there's no inherent reason for the OS to conflate its own permissions (including permissions on the local file systems) with permissions on the external drive. –  Roman Cheplyaka Feb 6 '13 at 10:14
    
@RomanCheplyaka I don't see why you would expect anything different for an external filesystem. –  Chris Down Feb 6 '13 at 11:30
add comment

There is one "inherent reason for the OS to conflate its own permissions": permissions are defined by the filesystem itself.

When a user writes a file on a disk, the OS uses the default umask to set read/write/execute permissions. It also associates the file with an owner and a group. System-wise, the user is a number (UID) and the group is also a number (GID).

FAT is an exception: it does not support permissions at all. That's why anybody (I mean anybody) can write to a FAT disk once it is connected.

If you want to write on an ext*-formated external disk, you can chmod it to 777 or chown it to your own UID and/or GID. You can do it on any computer on which you have root access.

There are ways to change this behavior on your current computer, but all needs you to be root.

share|improve this answer
    
Why can't the OS ignore FS's permissions in cases when this can't compromise the system's security (like in this case)? E.g. if users have r/w permissions to raw devices corresponding to external storage (which is possible to do with udev), they can use libext2fs to manipulate the file system on those devices ignoring the permissions. So I'm just asking about a more convenient interface to do that. –  Roman Cheplyaka Feb 6 '13 at 10:44
    
"FAT is an exception: it does not support permissions at all. That's why anybody (I mean anybody) can write to a FAT disk once it is connected." -- actually usually it is only writeable by root, unless you set uid/gid on mount. –  Chris Down Feb 6 '13 at 11:31
    
True, but actually, you can specify such flags and all the userspace utilities I know that allows mounting do it by default. Even if you can determine that a HDD is plugged in a USB port, these same tools can't do that by default with any other FS I know. What I meant is that any FAT formatted device is accessible by anybody in all the Linux distros I know. The hard part, if needed, is only to unplug/plug the drive. –  Gael Feb 6 '13 at 11:58
    
The OS can ignore it, but not by default. You can never tell what will compromise the system security. The kernel dev rational is quite sensible: YOU want to use an external drive to handle nonsensitive data. Other might just use the same drive to backup users' /home and credentials. If you don't care about who do what on your external disk, just chmod it to 777, end of the story. If you want something better on the computer you are using, you need root access. –  Gael Feb 6 '13 at 12:10
add comment

Yes, if you aren't accessing the filesystem from the system its permissions were designed for, the permissions are purely indicative.

However, this is a somewhat uncommon case, so typical tools aren't set up for that. Usually, if you want to access some external media, the simplest way is to mount it and browse it as the root user.

If all you have is pmount and no root access, then the partitions are binding for you. This is only relevant for security in rare scenarios (e.g. permanently-connected but not permanently-mounted backup drive that you have no physical access to).

If you have access to the raw device, you can use a FUSE filesystem (if available). Alternatively, you can try accessing the device from a virtual machine; for example, you may be allowed to use VirtualBox with USB device forwarding (let the guest, with an OS that you control, handle that USB device).

If you have root access but would prefer to browse as an unprivileged user, mount the filesystem normally, then apply a permission translation filesystem layer. Bindfs can do this:

bindfs --perms=a+rX:a-w /media/sdz99 ~roman/mnt/myview
share|improve this answer
    
Thanks. Bindfs looks very relevant, although, as you say, it requires root (because it works with already mounted file systems, not raw devices). Are there FUSE file systems that can work with devices and can alter permissions? –  Roman Cheplyaka Feb 7 '13 at 6:04
    
As I previously said... root... BTW, "if you aren't accessing the filesystem from the system its permissions were designed for, the permissions are purely indicative" doesn't mean anything. Permissions are set filesystem-wise but the one who enforces it is always the OS, not the disk itself. Therefore, there is not "indicative" permission, there is no "My OS name and uniq ID"-flag in the filesystem that the OS could use to determine if the permissions were "designed" for it (this would be a serious security flaw). FUSE mounts with user privilege, not root privilege. –  Gael Feb 7 '13 at 9:49
    
@RomanCheplyaka IIRC there's a FUSE filesystem for ext2 but it hasn't been maintained in a while, it doesn't support ext3 or ext4 (it can read ext3, I guess). You still need to have access to the raw device. In that case a VM where you're root is often the most convenient way. –  Gilles Feb 7 '13 at 11:15
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.