Initially I thought that what I'm trying to do was simple. But the more I look at FreeBSD
man pages, the more confused I'm getting about whether it's even possible.
I have a zfs pool that is used for data files only. I want to set fairly tight uniformity and control over anything written/stored on it. One aspect is that I want all "static" files held, to have a uniform owner/group (I've had it be a real pain in the neck, previously, when non-executable files written by various users become split among different accounts).
Based on this InfoSec SE question it seemed simplest to have that single user be the root user, since no scripts or OS files reference the data pool and execute permission is easily left unset.
So I thought this sounded pretty easy. Use the chmod
setuid bit and all's good. Except that
man chmod says this can't be done unless the dataset is mounted using
-o suiddir (see "modes"). Okay, that's a bit of a pain since it's not the default, but doable.
man mount then adds that execute bits are removed (good) but says "and it will not be given to root" which is a unexpected, although technically I could give the files to a "dummy" non-root user I create.
Except it then adds "Only UFS file systems support this option", so apparently I can't use the setiud bit after all, because my mounted file system is ZFS.
I'm using NFSv4 ACLs but I can't see anything in those that would help inherit ownership, either. It seems that they can only be used to prevent a user from changing an existing owner.
So what can I do? I just want to enforce a single file owner on all files created/modified within my dataset, but it looks from these pages as if it can't be done.
Is there a way to achieve it?
@Raphael Ahrens - by static files I just mean that the files on the entire dataset aren't being executed or called by any system process - they're just data files and directory hierarchies created/moved/modified anywhere within the dataset by users.
I tried the command you gave. I didn't notice that
setuid is a valid zfs property, which would solve the issue if it works. But when I tried, it seemed to report enabled/inherited but actually ignore the flag? Am I doing something wrong, or do I need to enable something else? This was the output, maybe I'm wrong:
# id uid=0(root) gid=0(wheel) groups=0(wheel),1002(data_managers) # su -l temp_user % id uid=1003(temp_user) gid=65533(nogroup) groups=65533(nogroup),1002(data_managers) % cd /mnt/test_pool % ls -lt drwsrwxrwx 11 root data_managers 12 Apr 3 15:25 test_dataset % zfs get setuid test_pool/test_dataset NAME PROPERTY VALUE SOURCE test_pool/test_dataset setuid on default % cd test_dataset % ls -lt drwsrwxrwx 11 root data_managers 12 Apr 3 15:26 test_dataset2 % zfs get setuid test_pool/test_dataset/test_dataset2 NAME PROPERTY VALUE SOURCE test_pool/test_dataset/test_dataset2 setuid on default % cd test_dataset2 % touch testfile % ls -lt testfile -rw-r--r-- 1 temp_user data_managers 0 Apr 3 15:27 testfile
The dir+dataset, and also its parent dir+dataset show setuid + inheritance as being set, but the file created in them gets created with owner = invoking user (
temp_user) not owner of parent dir (
See output below,which shows the issue clearly.
The dataset has setuid on in ZFS. It's mounted with suiddir option. long dir output shows setuid bit is set. dir is owned by root and invoking user is 'temp_user'. But as described in the OP and man pages quoted in the OP, the newly-created file within it (
test0) is created with owner=temp_user not root.
That's the problem I'm trying to work around - getting file ownership to inherit for ZFS files, if it's at all possible, or a workaround if not.
# id uid=0(root) gid=0(wheel) groups=0(wheel),1002(data_managers) # su -l temp_user % id uid=1003(temp_user) gid=65533(nogroup) groups=65533(nogroup),1002(data_managers) % zfs get setuid test_pool/test_dataset/test_dataset2 NAME PROPERTY VALUE SOURCE test_pool/test_dataset/test_dataset2 setuid on default % mount | grep 'test_dataset2' test_pool/test_dataset/test_dataset2 on /mnt/test_pool/test_dataset/test_dataset2 (zfs, local, noatime, suiddir, nfsv4acls) % cd /mnt/test_pool/test_dataset % ls -lt drwsrwxrwx 5 root wheel 9 Apr 3 22:30 test_dataset2 % cd test_dataset2 % touch test0 % ls -lt test0 -rw-r--r-- 1 temp_user wheel 0 Apr 3 22:32 test0