6

I want to enable ACLs for a FreeBSD 11 system. According to the FreeBSD Handbook this can be done in two ways:

  1. By using a mount option -- mount -o acls

  2. By modifying a superblock -- tunefs -a enable

It says that it is preferable to use the second option, because:

The mount-time ACLs flag cannot be changed by a remount (mount(8) -u), only by means of a complete umount(8) and fresh mount(8). This means that ACLs cannot be enabled on the root file system after boot. It also means that you cannot change the disposition of a file system once it is in use.

Setting the superblock flag will cause the file system to always be mounted with ACLs enabled even if there is not an fstab entry or if the devices re-order. This prevents accidental mounting of the file system without ACLs enabled, which can result in ACLs being improperly enforced, and hence security problems.

From the tunefs man page:

The tunefs utility is designed to change the dynamic parameters of a UFS file system which affect the layout policies. The tunefs utility cannot be run on an active file system. To change an active file system, it must be downgraded to read-only or unmounted.

The problem is that rootfs (/) can't be unmounted.

How can I run tunefs on the root filesystem?

  • 3
    Is it out of question booting from another filesystem/USB? – Rui F Ribeiro Apr 22 '17 at 12:28
  • Yeah, it's running a server to which I don't have physical access. – Brandon Bradley Apr 22 '17 at 12:30
  • Reboot the Server and set your flags for the Filesystem. Perhaps some tweaking is needed to fit your needs. I would have just comment on your question but i do not have enough reputation to do that. <gist.github.com/bdrewery/1826994> – datasmurf Jun 28 '17 at 7:14
1

You can forcibly remount the filesystem read-only:

mount -fur /
tunefs -a enable /
reboot

The reboot step seems to be neccessary: first, remounting read-write (mount -uw /) doesn't pick up the ACL enable flag, and second, remounting read-only will break everything that wanted to write to disk (eg syslogd), so you're better off just rebooting at that point.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.