0

I have a folder with a file

/path/to/data/one/it_works.txt

And I have an empty folder:

/path/to/user/bob

I have a script which should be executed by a web app in Tomcat which is:

#!/bin/sh

Source="$1"
Target="$2"

/bin/mkdir "$Target"
/bin/touch "$Target/it_failed.txt"
sudo /bin/mount --bind "$Source" "$Target" || exit 1
ls "$Target"
exit 1

(The exit 1 is to get the output logged by the web application. I remove it once this works.)

Sudo seems properly set up.

When I execute sudo -u tomcat ./the-script.sh /path/to/data/one /path/to/user/bob/one it prints it_works.txt as expected. If I then cd /path/to/user/bob/one and ls, I find it_works.txt as well. (Then, umount and rmdir $Target.) When I execute the script from the web application, I also get it_works.txt logged (expectable). But, if I then cd /path/to/user/bob/one and ls, I find it_failed.txt. Same is true for other processes (WebDAV in my case; that’s why I can’t use symlinks because WebDAV doesn’t support them).

It looks like the mount bind only applies to the process it executed it (even though sudo), but not to the rest of the system.

I first thought that this effect is caused by systemd’s sandboxing, but I set ProtectSystem=false and the same thing still happens...

How can I get mount bind to effect outside the scope of the Tomcat process?

(Distro is Debian 10.10)

0

1 Answer 1

0

The behavior was caused by systemd, which launches services in an unshare(1) environment if any of the directives InaccessiblePaths, PrivateMounts, PrivateTmp, PrivateDevices, ProtectSystem, ProtectHome, ReadOnlyPaths, or ReadWritePaths is enabled in the tomcat9.service file.

I got out of this by commenting out any of them. This is what the security part of the [Service] now looks like:

# Security
User=tomcat
Group=tomcat
# PrivateTmp=yes
AmbientCapabilities=CAP_NET_BIND_SERVICE
NoNewPrivileges=false
CacheDirectory=tomcat9
CacheDirectoryMode=750
# ProtectSystem=strict
# ReadWritePaths=/etc/tomcat9/Catalina/
# ReadWritePaths=/var/lib/tomcat9/webapps/
# ReadWritePaths=/var/log/tomcat9/
# ReadWritePaths=/path/to/data/
# ReadWritePaths=/path/to/user/

(NoNewPrivileges=false is needed for successful sudo.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .