1

Running Debian Buster on Kernel 4.20.17 with systemd 241:

+PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD -IDN2 +IDN -PCRE2 default-hierarchy=hybrid

I have two ubifs volumes on a nand (/dev/mtd3) partition:

ubi0:rootfs on / type ubifs (ro,relatime,assert=read-only,ubi=0,vol=1)
/dev/ubi0_2 on /var type ubifs (rw,relatime,assert=read-only,ubi=0,vol=2)

and I get the following error:

systemd-journald[747]: Failed to set ACL on /var/log/journal/2f572c0abab24e2fafc1b969aba78f1f/user-1000.journal, ignoring: Operation not supported

Can I set UBIFS as ACL and if so how do I tweak my fstab to enable it?

/dev/ubi0_2 /var ubifs defaults,auto 0 0
1

No, according to the UBIFS documentation, ACL support is not implemented in UBIFS:

Extended attributes

UBIFS supports extended attributes if the corresponding configuration option is enabled (no additional mount options are required). It supports the user, trusted, and security name-spaces. However, access control lists (ACL) support is not implemented.

Note, currently mkfs.ubifs ignores extended attributes and does not write them to the target file-system image.

Likewise, the kernel source states that ACL support is not implemented.

Filesystems implementing ACL usually have an acl.c file in sources. JFFS2 has such a file and supports ACLs (eg: its mkfs.jffs2 command has a --with-posix-acl option).

If the ACL feature is really needed, and your system can afford it (eg: JFFS2 might use more RAM and have a longer mount time if big) maybe a small separate JFFS2 filesystem where this feature is needed could be considered. Using JFFS2 over UBI (to improve wear levelling) appears to be fine and has been studied when comparing various solutions, so this could perhaps be a workaround.

refs:

  • Thanks, very insightful. So the other option would be to turn off ACL support for systemd? – cajjed Mar 20 at 14:05
  • probably. I didn't even know systemd had options to set acls – A.B Mar 20 at 15:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.