35

In Linux, is there a way to access files on a mounted filesystem that have been "shadowed" when another file system was mounted over a subdirectory?

E.g.

cd /
mkdir /foo
touch /foo/bar
mount /dev/sda1 /foo
# now, can I still get to /foo/bar on the / filesystem?

The solution of my dreams would not require elevated permissions or be specific to a certain file system, but I'll take whatever scraps I can get without risking a corrupted file system.

0

3 Answers 3

41

You can use the mount command to access the underlying filesystem.

$ mkdir /mnt/root
$ sudo mount --bind / /mnt/root
$ cat /mnt/root/foo/bar

There is no issue with corruption with doing this, but it does require permission to mount the file system.

6
  • +1, I thought that mount --bind was the answer. But I wasn't sure.
    – Dan D.
    Feb 13, 2012 at 9:38
  • 1
    +0.95, I completely forgot about binds being nonrecursive by default. However, last time I bindmounted / elsewhere, I could not umount it without rebooting; might have been some GUI component grabbing it though. Have you tested that? Feb 13, 2012 at 9:41
  • Thanks! I thought about bind mounts for a second, but thought they'd work based on path name rewriting and thus be recursive...
    – themel
    Feb 13, 2012 at 9:51
  • I don't understand why it is accepted. After I mount over /, /mnt/root points to newly mounted location, not previous one. Linux Mint 20.2. The solution could be hard linking, but it is not allowed on my system, might require tweeking the kernel something... Oct 19, 2021 at 6:29
  • @alexie It was accepted because it works, it is the purpose of the --bind directive. Are you perhaps doing something different to the OP?
    – Paul
    Oct 20, 2021 at 8:04
6

If you have root, you can mount --move the mounted filesystem on top of a temporary directory, then move it back afterwards.

mkdir /bar
mount --move /foo /bar

Having root also allows accessing the underlying block devices, if any, directly. For ext4, you can use debugfs to export files.

Read-only access can never corrupt the filesystem.


Directories can have handles, or file descriptors, obtained for them. The "current directory" is a handle too, not a path. If you have a handle to a directory, you can access files inside even if that location has been mounted over. This does not need special privileges, only special preparation.

0

I know that this question is old, but it's the first one that pops up on Google. There is another way to access the 'hidden' filesystem, using a separate unshare. It creates a separate namespace with different mounts, and runs something in there. (It's also possible to make it persistent - see the manpage.)

mkdir /tmp/above /tmp/below
touch /tmp/above/a /tmp/below/b
mount -o bind /tmp/above /tmp/below
ls below
unshare --mount sh -c 'umount /tmp/below ; ls /tmp/below'

The first ls wil see 'a', and the second will see 'b'.

It does require elevated permissions, but should work on any kind of filesystem.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .