Mount home directory read only permission denied

genesis96839 · February 16, 2021, 12:01pm

Hi,

I am trying to mount my home directory to the /home/ubuntu directory in my LXD container.

I want it to be read only i.e. I want to read the data inside the container but not write or modify it. But when I do try to even access a file for example with cat command, I get permission denied error.

This is how I am doing it right now:

lxc init ubuntu classifier
lxc config device add  classifier homedir disk source=$HOME path=/home/ubuntu
lxc start classifier

Then I go inside the container to let’s say read a file as follows:

cat /home/ubuntu/sample.txt

It gives permission denied. Due to the fact that all the files are owned by nogroup nobody. Is there any way that I can read them but not modify them from within the container?

tomp · February 16, 2021, 12:26pm

Try setting shift=true on the disk device you’re attaching.

genesis96839 · February 16, 2021, 12:49pm

Thanks @tomp, I tried but it returns “shiftfs is required by disk entry but isn’t supported on system”. Is there any workaround for this?

tomp · February 16, 2021, 1:27pm

What OS is your host and are you using the snap?

genesis96839 · February 16, 2021, 1:28pm

Ubuntu 18.04 and yes, using snap lxd

tomp · February 16, 2021, 1:29pm

Try doing:

sudo snap set lxd shiftfs.enable=true
sudo systemctl reload snap.lxd.daemon

genesis96839 · February 16, 2021, 9:29pm

Thanks @tomp for the suggestion. I tried and I am able to access/read the contents of home directory that was mounted. But I am also able to modify the contents from within my container and they are getting modified on host directory too.

I believe this is enabling read and write method. Where as I am exploring read only method.

tomp · February 16, 2021, 11:09pm

You should be able to use the readonly=true disk device setting to mount readonly.

See https://linuxcontainers.org/lxd/docs/master/instances#type-disk

genesis96839 · February 17, 2021, 9:20am

I added readonly=true option to the mount command and launched a new container. But still I was able to modify the files inside the container and thus the files were eventually modified on the host as well.

tomp · February 17, 2021, 9:41am

Interesting. I’ve tried disabling the shift mode by setting shift=false, and then created a directory which is owned by the container’s UID, and then shared that using a readonly=true disk device and it behaves as expected, I can see the files, but I cannot create or modify them.

But with shift=true I can modify the files, and create new files, although they do appear to have the read-only property set on them (there is a warning when I come to delete them on the host).

@stgraber @brauner could this be a shiftfs behavior/issue?

tomp · February 17, 2021, 9:43am

In the meantime, if all you’re trying to do is read files in your home directory, if you’re comfortable making your home directory globally readable then disabling the shift mode will allow you to access files (albeit they’ll appear to be owned by nobody inside the container).

brauner · February 17, 2021, 9:48am

That would be a bug yes. I’ll try and reproduce.

brauner · February 17, 2021, 9:50am

What’s your output of findmnt from inside the container for that directory?

tomp · February 17, 2021, 10:00am

mkdir /home/user/test
lxc config device add ctest mydisk disk source=/home/user/test path=/mnt/test shift=true readonly=true

lxc shell ctest
root@ctest:/mnt/test# findmnt
TARGET                                SOURCE         FSTYPE    OPTIONS
/                                     /var/lib/lxd/storage-pools/zfs/containers/ctest/rootfs
│                                                    shiftfs   rw,relatime,passthrough=3
├─/run                                tmpfs          tmpfs     rw,nosuid,nodev,size=802760k,mode=755,uid=
│ ├─/run/lock                         tmpfs          tmpfs     rw,nosuid,nodev,noexec,relatime,size=5120k
│ └─/run/user/0                       tmpfs          tmpfs     rw,nosuid,nodev,relatime,size=802756k,mode
├─/dev                                none           tmpfs     rw,relatime,size=492k,mode=755,uid=1000000
│ ├─/dev/shm                          tmpfs          tmpfs     rw,nosuid,nodev,uid=1000000,gid=1000000
│ ├─/dev/fuse                         udev[/fuse]    devtmpfs  rw,nosuid,noexec,relatime,size=3981636k,nr
│ ├─/dev/net/tun                      udev[/net/tun] devtmpfs  rw,nosuid,noexec,relatime,size=3981636k,nr
│ ├─/dev/pts                          devpts         devpts    rw,nosuid,noexec,relatime,gid=1000005,mode
│ ├─/dev/mqueue                       mqueue         mqueue    rw,nosuid,nodev,noexec,relatime
│ ├─/dev/lxd                          tmpfs          tmpfs     rw,relatime,size=100k,mode=755
│ ├─/dev/.lxd-mounts                  tmpfs[/ctest]  tmpfs     rw,relatime,size=100k,mode=711
│ ├─/dev/full                         udev[/full]    devtmpfs  rw,nosuid,noexec,relatime,size=3981636k,nr
│ ├─/dev/null                         udev[/null]    devtmpfs  rw,nosuid,noexec,relatime,size=3981636k,nr
│ ├─/dev/random                       udev[/random]  devtmpfs  rw,nosuid,noexec,relatime,size=3981636k,nr
│ ├─/dev/tty                          udev[/tty]     devtmpfs  rw,nosuid,noexec,relatime,size=3981636k,nr
│ ├─/dev/urandom                      udev[/urandom] devtmpfs  rw,nosuid,noexec,relatime,size=3981636k,nr
│ ├─/dev/zero                         udev[/zero]    devtmpfs  rw,nosuid,noexec,relatime,size=3981636k,nr
│ ├─/dev/console                      devpts[/3]     devpts    rw,nosuid,noexec,relatime,gid=5,mode=620,p
│ └─/dev/ptmx                         devpts[/ptmx]  devpts    rw,nosuid,noexec,relatime,gid=1000005,mode
├─/proc                               proc           proc      rw,nosuid,nodev,noexec,relatime
│ ├─/proc/sys/kernel/random/boot_id   none[/.lxc-boot-id]
│ │                                                  tmpfs     ro,nosuid,nodev,noexec,relatime,size=492k,
│ └─/proc/sys/fs/binfmt_misc          binfmt_misc    binfmt_mi rw,nosuid,nodev,noexec,relatime
├─/sys                                sysfs          sysfs     rw,relatime
│ ├─/sys/fs/cgroup                    tmpfs          tmpfs     ro,nosuid,nodev,noexec,mode=755,uid=100000
│ │ ├─/sys/fs/cgroup/unified          cgroup2        cgroup2   rw,nosuid,nodev,noexec,relatime,nsdelegate
│ │ ├─/sys/fs/cgroup/systemd          cgroup         cgroup    rw,nosuid,nodev,noexec,relatime,xattr,name
│ │ ├─/sys/fs/cgroup/pids             cgroup         cgroup    rw,nosuid,nodev,noexec,relatime,pids
│ │ ├─/sys/fs/cgroup/cpu,cpuacct      cgroup         cgroup    rw,nosuid,nodev,noexec,relatime,cpu,cpuacc
│ │ ├─/sys/fs/cgroup/devices          cgroup         cgroup    rw,nosuid,nodev,noexec,relatime,devices
│ │ ├─/sys/fs/cgroup/blkio            cgroup         cgroup    rw,nosuid,nodev,noexec,relatime,blkio
│ │ ├─/sys/fs/cgroup/freezer          cgroup         cgroup    rw,nosuid,nodev,noexec,relatime,freezer
│ │ ├─/sys/fs/cgroup/net_cls,net_prio cgroup         cgroup    rw,nosuid,nodev,noexec,relatime,net_cls,ne
│ │ ├─/sys/fs/cgroup/cpuset           cgroup         cgroup    rw,nosuid,nodev,noexec,relatime,cpuset
│ │ ├─/sys/fs/cgroup/memory           cgroup         cgroup    rw,nosuid,nodev,noexec,relatime,memory
│ │ ├─/sys/fs/cgroup/rdma             cgroup         cgroup    rw,nosuid,nodev,noexec,relatime,rdma
│ │ ├─/sys/fs/cgroup/hugetlb          cgroup         cgroup    rw,nosuid,nodev,noexec,relatime,hugetlb
│ │ └─/sys/fs/cgroup/perf_event       cgroup         cgroup    rw,nosuid,nodev,noexec,relatime,perf_event
│ ├─/sys/firmware/efi/efivars         efivarfs       efivarfs  rw,nosuid,nodev,noexec,relatime
│ ├─/sys/fs/fuse/connections          fusectl        fusectl   rw,nosuid,nodev,noexec,relatime
│ ├─/sys/fs/pstore                    pstore         pstore    rw,nosuid,nodev,noexec,relatime
│ ├─/sys/kernel/config                configfs       configfs  rw,nosuid,nodev,noexec,relatime
│ ├─/sys/kernel/debug                 debugfs        debugfs   rw,nosuid,nodev,noexec,relatime
│ ├─/sys/kernel/security              securityfs     securityf rw,nosuid,nodev,noexec,relatime
│ └─/sys/kernel/tracing               tracefs        tracefs   rw,nosuid,nodev,noexec,relatime
└─/mnt/test                           /dev/.lxd-mounts/lxdmount_369224129
                                                     shiftfs   rw,relatime,passthrough=3

Looks like the mount is still rw in the container.

Also I would like to clarify that with shift=true and readonly=true it appears that I can create, rename and delete files, but I cannot actually edit the contents.

touch /mnt/test/hello.txt
ls -la /mnt/test/
total 5
drwxrwxr-x 2 ubuntu ubuntu 4096 Feb 17 10:03 .
drwxr-xr-x 3 root   root      3 Feb 17 09:56 ..
-rw-r--r-- 1 root   root      0 Feb 17 10:03 hello.txt
echo "hello" > /mnt/test/hello.txt
-bash: /mnt/test/hello.txt: Read-only file system

And on the host directory:

user@user-MS-7821:~$ ls -la /home/user/test/
total 8
drwxrwxr-x  2 user user 4096 Feb 17 10:03 .
drwxr-xr-x 31 user user 4096 Feb 17 09:56 ..
-rw-r--r--  1 root root    0 Feb 17 10:03 hello.txt

genesis96839 · February 17, 2021, 10:07am

I didn’t make it globally readable, removed shift=true and just added readonly=true. This works.

brauner · February 17, 2021, 10:14am

Fix is here:

brauner · February 17, 2021, 10:15am

Look at the “/mnt/test” mount entry in your mount table, it hasn’t been turned readonly.

tomp · February 17, 2021, 10:18am

Yeah I noticed that. Is that something that root inside the container can remount back to rw (once it is being passed as ro) or is that prevented?

brauner · February 17, 2021, 10:24am

They don’t own the original mount so container root shouldn’t be able to remount rw.