Having an entry in the fstab for a file I want a user (but no one else) to mount using "noauto,loop,owner" options still require root access even if the file is owned by the user, the problem I think is mount checks the ownership of the loop device instead of the file. I consider that as a bad behaviour. Worst of all, I tried another way and, if chown the file to the owner and chmod it to 0700 using the "user" mount option, any user can still mount it as mount won't check the ownership of the file! As I didn't know where to post such a bug, I posted it in Gentoo, but it is not a Gentoo only related bug. Thanks. Reproducible: Always Steps to Reproduce: First method: 1. cd in /tmp, create an empty file (test_file) and format it in ext2 or something, also create a directory (test_mount) to mount it. 2. chown the file and directory to a non-root user. 3. add an entry in fstab for that file like /tmp/test_file /tmp/test_mount ext2 noauto,loop,owner 0 0 4. login as the user and try to mount /tmp/test_mount 5. look at the error message and get angry trying to mount it any way possible Second method: 1. repeat step 1 and 2 of first method. 2. chmod the file to 0600 ( u=rw,g=,o= ) 3. add an entry in fstab for that file like (notice user instead of owner) /tmp/test_file /tmp/test_mount ext2 noauto,loop,user 0 0 4. login as ANOTHER user, not the one you chmoded the file 5. mount /tmp/test_mount and notice that you can happyly mount the other user's file even if you don't have permission to Actual Results: First method: I couldn't mount the file, requiring root access. Second method: I could mount a file not owned by the right user and which I didn't have permission too. Expected Results: First method: The file should be mounted if it is owned by the right user (and don't care about the loop device ownership) and only allow the owner to access/umount the file. Second method: Refuse access to mount the file if the user isn't granted the right access to read the file. First method: jerome@router ~ $ mksquashfs .gaim gaim.sqfs -b 32768 -noappend -keep-as-directory <filesystem creation succesfully ended> jerome@router ~ $ mkdir gaim.bak jerome@router ~ $ chmod 0600 gaim.bak gaim.sqfs jerome@router ~ $ su - <entering root pass> router jerome # nano -w /etc/fstab <adding the following line:> /home/jerome/gaim.sqfs /home/jerome/gaim.bak squashfs noauto,loop,owner 0 0 <save and exit> router jerome # exit jerome@router ~ $ mount gaim.bak mount: only root can mount /home/jerome/gaim.sqfs on /home/jerome/gaim.bak jerome@router ~ $ ls -l ... drwx------ 2 jerome root 6 Jul 23 19:25 gaim.bak -rwx------ 1 jerome root 22151168 Jul 23 19:23 gaim.sqfs ... Second method: <resuming last session as root editing last fstab line to:> /home/jerome/gaim.sqfs /home/jerome/gaim.bak squashfs noauto,loop,user 0 0 router jerome # su - andre andre@router jerome $ mount gaim.bak andre@router jerome $ ls -al gaim.bal total 1 drwxr-xr-x 1 jerome root 159 Jul 23 19:13 .gaim andre@router jerome $ exit router jerome # exit jerome@router ~ $ umount gaim.bak umount: only andre can unmount /home/jerome/gaim.sqfs from /home/jerome/gaim.bak
works fine for me vapier@vapier 0 ~ $ dd if=/dev/zero of=img count=5120 5120+0 records in 5120+0 records out vapier@vapier 0 ~ $ mke2fs -F -q img vapier@vapier 0 ~ $ mkdir loopmnt vapier@vapier 0 ~ $ grep img /etc/fstab /home/vapier/img /home/vapier/loopmnt ext2 loop,user 0 0 vapier@vapier 0 ~ $ mount loopmnt vapier@vapier 0 ~ $ ls loopmnt/ lost+found vapier@vapier 0 ~ $ mount | grep img /home/vapier/img on /home/vapier/loopmnt type ext2 (rw,noexec,nosuid,nodev,loop=/dev/loop0,user=vapier) vapier@vapier 0 ~ $ umount loopmnt/ vapier@vapier 0 ~ $ ls loopmnt/ vapier@vapier 0 ~ $
You didn't use "owner" option in fstab.
indeed not sure what exactly mount is checking ... if i change the permissions of /dev/loop0 to vapier it still errors out as you describe
From the manpage: ------ The owner option is similar to the user option, with the restriction that the user must be the owner of the special file. This may be useful e.g. for /dev/fd if a login script makes the console user owner of this device. ----- So as far as I can see, the behaviour of the 'owner' option is fine. The only way I can see how you can do this (without patching a new option for mount), is like Mike did to have the mountpoint to some restricted place (although they might still be able to mount it, if not access). Reopen if you have a patch or something.
