0

I have a device I want to mount for root with full permissions and for everyone else as readonly. The man page tells me this is possible.

So:

  • sudo mkdir /mnt/foo
  • sudo mkdir /mnt/fooReadOnly
  • sudo chmod 700 /mnt/foo (rw for root only)
  • sudo chmod 555 /mnt/fooReadOnly (ro / browse for everyone)
  • ensure device /dev/sdaX is mounted as /mnt/foo

Then I did what the man page suggested:

  • sudo mount --bind /mnt/foo /mnt/fooReadOnly
  • sudo mount -o remount,bind,ro /mnt/foo /mnt/fooReadOnly

Now to test:

  • ls /mnt/foo --> Permission denied ...CORRECT
  • sudo ls /mnt/foo works ..CORRECT
  • ls /mnt/fooReadOnly --> Permission denied ...INCORRECT?

I cannot change anything on that bind mount, it tells me Read-only file system.

How do I fix this?

Also, how do I add this to /etc/fstab so that it will automatically remount on boot?

  • P.S. welcome to Unix StackExchange :-). – sourcejedi May 16 '18 at 18:43
  • Once you mount on top of a directory, the permissions of that directory are ignored - we can only see the permissions of the directory which is mounted on top of it. – sourcejedi May 16 '18 at 18:48
0

I have a device I want to mount for root with full permissions and for everyone else as readonly.

  • sudo mkdir /root/mnt/foo
  • sudo mkdir /mnt/fooReadOnly
  • mount -oro /dev/sdaX /mnt/foo
    • This ensures device /dev/sdaX is mounted readonly on /mnt/foo. I set this up first, because it is not possible to create a read-only bind mount in a single step. I don't want to let users access a read-write bind mount, even for an instant.
  • ls -ld /root - double-check this shows the mode dr-xr-x--- and owner root root.
  • sudo mount --bind /mnt/fooReadOnly /root/mnt/foo
  • sudo mount -oremount,rw /root/mnt/foo

Try the above commands. After each mount command, you can run grep foo /proc/self/mountinfo, which shows the per-filesystem and per-mountpoint flags in separate columns.

To understand this, know that mount -oremount,rw (or mount -oremount,ro) changes both the per-filesystem flag and the per-mountpoint flag at the same time. But it does not affect the per-mountpoint flag of the other mount point(s).


It is not possible to try the above commands inside a user namespace (unshare -rm), even if you switch to mounting a tmpfs instead of sdaX. It fails with "permission denied" at mount -oremount,rw. Instead you would have to use the following sequence:

  • mount tmp -ttmpfs /root/mnt/foo
  • mount --bind /root/mnt/foo /root/mnt/fooReadOnly
  • mount -oremount,bind,ro /root/mnt/fooReadOnly
  • mount --bind /root/mnt/fooReadOnly /mnt/fooReadOnly

Also, how do I add this to /etc/fstab so that it will automatically remount on boot?

I would recommend not adapting the first sequence to fstab, because it is too much of a hack. You can adapt the second ordering instead.

/dev/sdaX /root/mnt/foo ...
/root/mnt/foo /root/mnt/fooReadOnly none bind,ro
/root/fooReadOnly /mnt/fooReadOnly none bind
  • Lots to digest... new to this! I still have trouble getting the RO mount to work. Once I do mount -oro /dev/sdaX /mnt/foo I try ls /mnt/foo but get "Permission denied" which shouldn't happen, as it's intended to be RO by anyone? – lonix May 18 '18 at 8:24
  • @lonix I suspect you unintentionally set strict permissions on the root directory of the /dev/sdaX filesystem. Check ls -ld /mnt/foo (after mounting it). – sourcejedi May 18 '18 at 9:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.