0

I have a zpool from a system with different users than the machine I am working on that I want to copy data from. Therefore, I need to import and mount the zpool with read permissions. However, since the UIDs don't match, I don't have permissions for many files.

I don't want to change the permissions on the zpool, just read from it. I could read the files as root and transfer ownership of the local copies to the desired local user, but I don't have sudo cp or sudo chown permissions on this (multi-user) system.

I do have sudo mount and sudo zpool/sudo zfs permissions though. With a non-zfs system, I would

  1. sudo mount -o uid=$UID,gid=$GID,umask=0770[,ro] <device> <mountpoint> or something like that,
  2. cp <mountpoint>/<source> <target> the files I need, and
  3. sudo umount <mountpoint>

How can I achieve the same for a zfs system?

I could not find any similar option for zpool import. I already tried to

  1. sudo zpool import -N <pool>,
  2. sudo zfs set mountpoint=legacy <pool>,
  3. sudo mount -t zfs -o uid=$UID,gid=$GID,umask=0770[,ro] <pool> ,<mountpoint>
  4. cp <mountpoint>/<source> <target> the files I need,
  5. sudo umount <mountpoint>,
  6. `sudo zfs set mountpoint= , and
  7. sudo zpool export <pool>,

but mount.zfs does not support these options either.

2

With a non-zfs system

No, just with a small subset of filesystems which traditionally don't store POSIX-compatible permissions. You cannot do that with ext4 or XFS or ReiserFS, either.

I do have sudo mount

If you use Linux and also happen to have FUSE available, install the bindfs overlay filesystem (e.g. compile in your home directory) and mount it using:

sudo mount -t fuse./home/mschilli/bindfs \
           -o [ro,]mirror=mschilli \
           /zfs_mountpoint /new_mountpoint

The bindfs daemon will itself have root privileges to freely access the 'source' mountpoint, and will present all files as owned by you under the 'target' mountpoint. (That's the purpose of -o mirror=…)


Interestingly, both -t fuse.<type> and the old way of specifying <type>#<source> as the mount source allow the filesystem type to contain slashes, i.e. be an absolute path to the desired FUSE daemon.

In fact, using this method you could execute arbitrary binaries, so long as they don't mind receiving useless command-line arguments. (And that's not even counting the many privilege escalations that mount --bind could provide.)

Check with your system administrator before doing any of the above. Maybe they'll just grant you sudo cp rights if you ask them nicely. Maybe they'll have you fired if they catch you trying to bypass security on your own.

  • 1
    In short: If you have sudo mount, you're one step away from unlimited root privileges. – grawity Sep 14 '18 at 18:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.