0

I have a device I want to mount for root with full permissions and for everyone else as readonly. The man page tells me this is possible.

So:

  • sudo mkdir /mnt/foo
  • sudo mkdir /mnt/fooReadOnly
  • sudo chmod 700 /mnt/foo (rw for root only)
  • sudo chmod 555 /mnt/fooReadOnly (ro / browse for everyone)
  • ensure device /dev/sdaX is mounted as /mnt/foo

Then I did what the man page suggested:

  • sudo mount --bind /mnt/foo /mnt/fooReadOnly
  • sudo mount -o remount,bind,ro /mnt/foo /mnt/fooReadOnly

Now to test:

  • ls /mnt/foo --> Permission denied ...CORRECT
  • sudo ls /mnt/foo works ..CORRECT
  • ls /mnt/fooReadOnly --> Permission denied ...INCORRECT?

I cannot change anything on that bind mount, it tells me Read-only file system.

How do I fix this?

Also, how do I add this to /etc/fstab so that it will automatically remount on boot?

1
  • Once you mount on top of a directory, the permissions of that directory are ignored - we can only see the permissions of the directory which is mounted on top of it.
    – sourcejedi
    May 16, 2018 at 18:48

1 Answer 1

2

I have a device I want to mount for root with full permissions and for everyone else as readonly.

  • sudo mkdir /root/mnt/foo
  • sudo mkdir /mnt/fooReadOnly
  • mount -oro /dev/sdaX /mnt/foo
    • This ensures device /dev/sdaX is mounted readonly on /mnt/foo. I set this up first, because it is not possible to create a read-only bind mount in a single step. I don't want to let users access a read-write bind mount, even for an instant.
  • ls -ld /root - double-check this shows the mode dr-xr-x--- and owner root root.
  • sudo mount --bind /mnt/fooReadOnly /root/mnt/foo
  • sudo mount -oremount,rw /root/mnt/foo

Try the above commands. After each mount command, you can run grep foo /proc/self/mountinfo, which shows the per-filesystem and per-mountpoint flags in separate columns.

To understand this, know that mount -oremount,rw (or mount -oremount,ro) changes both the per-filesystem flag and the per-mountpoint flag at the same time. But it does not affect the per-mountpoint flag of the other mount point(s).


It is not possible to try the above commands inside a user namespace (unshare -rm), even if you switch to mounting a tmpfs instead of sdaX. It fails with "permission denied" at mount -oremount,rw. Instead you would have to use the following sequence:

  • mount tmp -ttmpfs /root/mnt/foo
  • mount --bind /root/mnt/foo /root/mnt/fooReadOnly
  • mount -oremount,bind,ro /root/mnt/fooReadOnly
  • mount --bind /root/mnt/fooReadOnly /mnt/fooReadOnly

Also, how do I add this to /etc/fstab so that it will automatically remount on boot?

I would recommend not adapting the first sequence to fstab, because it is too much of a hack. You can adapt the second ordering instead.

/dev/sdaX /root/mnt/foo ...
/root/mnt/foo /root/mnt/fooReadOnly none bind,ro
/root/fooReadOnly /mnt/fooReadOnly none bind
2
  • Lots to digest... new to this! I still have trouble getting the RO mount to work. Once I do mount -oro /dev/sdaX /mnt/foo I try ls /mnt/foo but get "Permission denied" which shouldn't happen, as it's intended to be RO by anyone?
    – lonix
    May 18, 2018 at 8:24
  • @lonix I suspect you unintentionally set strict permissions on the root directory of the /dev/sdaX filesystem. Check ls -ld /mnt/foo (after mounting it).
    – sourcejedi
    May 18, 2018 at 9:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .