1

Initially I thought that what I'm trying to do was simple. But the more I look at FreeBSD man pages, the more confused I'm getting about whether it's even possible.

I have a zfs pool that is used for data files only. I want to set fairly tight uniformity and control over anything written/stored on it. One aspect is that I want all "static" files held, to have a uniform owner/group (I've had it be a real pain in the neck, previously, when non-executable files written by various users become split among different accounts).

Based on this InfoSec SE question it seemed simplest to have that single user be the root user, since no scripts or OS files reference the data pool and execute permission is easily left unset.

So I thought this sounded pretty easy. Use the chmod setuid bit and all's good. Except that man chmod says this can't be done unless the dataset is mounted using -o suiddir (see "modes"). Okay, that's a bit of a pain since it's not the default, but doable.

man mount then adds that execute bits are removed (good) but says "and it will not be given to root" which is a unexpected, although technically I could give the files to a "dummy" non-root user I create.

Except it then adds "Only UFS file systems support this option", so apparently I can't use the setiud bit after all, because my mounted file system is ZFS.

I'm using NFSv4 ACLs but I can't see anything in those that would help inherit ownership, either. It seems that they can only be used to prevent a user from changing an existing owner.

So what can I do? I just want to enforce a single file owner on all files created/modified within my dataset, but it looks from these pages as if it can't be done.

Is there a way to achieve it?

Updates:

@Raphael Ahrens - by static files I just mean that the files on the entire dataset aren't being executed or called by any system process - they're just data files and directory hierarchies created/moved/modified anywhere within the dataset by users.

I tried the command you gave. I didn't notice that setuid is a valid zfs property, which would solve the issue if it works. But when I tried, it seemed to report enabled/inherited but actually ignore the flag? Am I doing something wrong, or do I need to enable something else? This was the output, maybe I'm wrong:

# id
uid=0(root) gid=0(wheel) groups=0(wheel),1002(data_managers)

# su -l temp_user

% id
uid=1003(temp_user) gid=65533(nogroup) groups=65533(nogroup),1002(data_managers)

% cd /mnt/test_pool

% ls -lt
drwsrwxrwx  11 root  data_managers  12 Apr  3 15:25 test_dataset

% zfs get setuid test_pool/test_dataset
NAME            PROPERTY  VALUE   SOURCE
test_pool/test_dataset  setuid    on      default

% cd test_dataset

% ls -lt
drwsrwxrwx  11 root  data_managers  12 Apr  3 15:26 test_dataset2

% zfs get setuid test_pool/test_dataset/test_dataset2
NAME                            PROPERTY  VALUE   SOURCE
test_pool/test_dataset/test_dataset2  setuid    on      default

% cd test_dataset2

% touch testfile
% ls -lt testfile
-rw-r--r--  1 temp_user  data_managers  0 Apr  3 15:27 testfile

The dir+dataset, and also its parent dir+dataset show setuid + inheritance as being set, but the file created in them gets created with owner = invoking user (temp_user) not owner of parent dir (root).

Update 2:

See output below,which shows the issue clearly.

The dataset has setuid on in ZFS. It's mounted with suiddir option. long dir output shows setuid bit is set. dir is owned by root and invoking user is 'temp_user'. But as described in the OP and man pages quoted in the OP, the newly-created file within it (test0) is created with owner=temp_user not root.

That's the problem I'm trying to work around - getting file ownership to inherit for ZFS files, if it's at all possible, or a workaround if not.

# id
uid=0(root) gid=0(wheel) groups=0(wheel),1002(data_managers)

# su -l temp_user

% id
uid=1003(temp_user) gid=65533(nogroup) groups=65533(nogroup),1002(data_managers)

% zfs get setuid test_pool/test_dataset/test_dataset2
NAME                        PROPERTY  VALUE   SOURCE
test_pool/test_dataset/test_dataset2  setuid    on      default

% mount | grep 'test_dataset2'
test_pool/test_dataset/test_dataset2 on /mnt/test_pool/test_dataset/test_dataset2 (zfs, local, noatime, suiddir, nfsv4acls)

% cd /mnt/test_pool/test_dataset

% ls -lt
drwsrwxrwx  5 root  wheel  9 Apr  3 22:30 test_dataset2

% cd test_dataset2

% touch test0

% ls -lt test0
-rw-r--r--  1 temp_user  wheel  0 Apr  3 22:32 test0
  • What is it the users are not allowed to do? Are your "static" files in a specific part of the file system tree? – Raphael Ahrens Apr 3 '18 at 11:25
  • what is the value of zfs get setuid "$ZFS_Volume" ? – Raphael Ahrens Apr 3 '18 at 11:49
  • Updated to answer both of these – Stilez Apr 3 '18 at 14:43
  • Ok you only want that users should not be able to execute files, this could be done via zfs set exec=off test_pool/test_dataset. About "called by any system process", do you also mean execute? Or read by a system process? – Raphael Ahrens Apr 3 '18 at 19:45
  • Sorry if I wasn't clear. I want the owner for all files and dirs created in the dataset, to inherit from the dataset's owner. Exec=off is separate, that's easy with ACLs or standard permissions. Updated again with short CLI output to show the exact problem and steps to reproduce. – Stilez Apr 3 '18 at 21:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.