Mount a volume with different ownership permissions with bindfs

Written by - 0 comments

Published on - Listed in Linux


Today I got asked by a colleague, if it were possible to mount a volume where certain ownerships (in this case www-data owner) are automatically adapted to his own user, so he can modify files belonging to www-data.

One way to solve the file permission write issue is to put the local user to the same group of www-data and change the permissions that the group www-data is able to write. On the other hand this also requires, that the www-data group also exists on the localhost, not only inside the container. With www-data this is the case (because it is already a fixed part of an Ubuntu installation), but for special users this won't work or requires further modifications.

Another possibility is to use bindfs. Bindfs allows you to "remap" ownerships and creates a virtual mount point.

sudo bindfs --map=www-data/claudio /var/lib/lxc/container001/rootfs /tmp/container001

The above command explained:

--map: Allows to "remap" the ownership permissions. In this example, the www-data owner is rewritten to the user claudio (meaning: claudio becomes the new owner on the bindfs mounted path)

/var/lib/lxc/container001/rootfs: The original folder/path

/tmp/container001: The destination path, where the remapping happens. This is a virtual path and the mountpoint (/tmp/container001) must exist.

So if I look into the original folder, the owner is www-data for the cache files of this web application:

ll /var/lib/lxc/container001/rootfs/srv/webapp/cache/
total 40
-rw-r--r-- 1 www-data 1005   469 Apr  2 13:39 clear_cache.sh
drwxr-xr-x 5 www-data 1005  4096 Apr  2 13:39 doctrine
drwxr-xr-x 6 www-data 1005  4096 Jul 10 11:55 general
drwxr-xr-x 2 www-data 1005  4096 Apr  2 13:40 html
drwxr-xr-x 4 www-data 1005  4096 Apr  2 13:39 mpdf
drwxr-xr-x 2 www-data 1005  4096 Apr  2 13:40 productexport
drwxr-xr-x 2 www-data 1005 12288 Jul 11 09:10 proxies
drwxr-xr-x 3 www-data 1005  4096 Jul 10 11:55 templates

In the bindfs mountpoint, where the ownerships were remapped, the file structure looks like this:

ll /tmp/container001/srv/webapp/cache/
total 40
-rw-r--r-- 1 claudio 1005   469 Apr  2 13:39 clear_cache.sh
drwxr-xr-x 5 claudio 1005  4096 Apr  2 13:39 doctrine
drwxr-xr-x 6 claudio 1005  4096 Jul 10 11:55 general
drwxr-xr-x 2 claudio 1005  4096 Apr  2 13:40 html
drwxr-xr-x 4 claudio 1005  4096 Apr  2 13:39 mpdf
drwxr-xr-x 2 claudio 1005  4096 Apr  2 13:40 productexport
drwxr-xr-x 2 claudio 1005 12288 Jul 11 09:10 proxies
drwxr-xr-x 3 claudio 1005  4096 Jul 10 11:55 templates

So now my local user "claudio" is able to modify files in the bindfs mount which belong to www-data in the original path:

claudio@mymachine:~$ touch /tmp/container001/srv/webapp/cache/claudiofile.php

claudio@mymachine:~$ ll /tmp/test/srv/shopware/cache/
total 40
-rw-rw-r-- 1 claudio claudio     0 Jul 16 11:39 claudiofile.php
-rw-r--r-- 1 claudio  1005   469 Apr  2 13:39 clear_cache.sh
drwxr-xr-x 5 claudio  1005  4096 Apr  2 13:39 doctrine
drwxr-xr-x 6 claudio  1005  4096 Jul 10 11:55 general
drwxr-xr-x 2 claudio  1005  4096 Apr  2 13:40 html
drwxr-xr-x 4 claudio  1005  4096 Apr  2 13:39 mpdf
drwxr-xr-x 2 claudio  1005  4096 Apr  2 13:40 productexport
drwxr-xr-x 2 claudio  1005 12288 Jul 11 09:10 proxies
drwxr-xr-x 3 claudio  1005  4096 Jul 10 11:55 templates

In the original path the file was created, too, but belongs to www-data:

ll /var/lib/lxc/container001/rootfs/srv/webapp/cache/
total 40
-rw-rw-r-- 1 www-data claudio     0 Jul 16 11:39 claudiofile.php
-rw-r--r-- 1 www-data  1005   469 Apr  2 13:39 clear_cache.sh
drwxr-xr-x 5 www-data  1005  4096 Apr  2 13:39 doctrine
drwxr-xr-x 6 www-data  1005  4096 Jul 10 11:55 general
drwxr-xr-x 2 www-data  1005  4096 Apr  2 13:40 html
drwxr-xr-x 4 www-data  1005  4096 Apr  2 13:39 mpdf
drwxr-xr-x 2 www-data  1005  4096 Apr  2 13:40 productexport
drwxr-xr-x 2 www-data  1005 12288 Jul 11 09:10 proxies
drwxr-xr-x 3 www-data  1005  4096 Jul 10 11:55 templates




Add a comment

Show form to leave a comment

Comments (newest first)

No comments yet.

RSS feed

Blog Tags:

  AWS   Android   Ansible   Apache   Apple   Atlassian   BSD   Backup   Bash   Bluecoat   CMS   Chef   Cloud   Coding   Consul   Containers   CouchDB   DB   DNS   Database   Databases   Docker   ELK   Elasticsearch   Filebeat   FreeBSD   Galera   Git   GlusterFS   Grafana   Graphics   HAProxy   HTML   Hacks   Hardware   Icinga   Icingaweb   Icingaweb2   Influx   Internet   Java   KVM   Kibana   Kodi   Kubernetes   LVM   LXC   Linux   Logstash   Mac   Macintosh   Mail   MariaDB   Minio   MongoDB   Monitoring   Multimedia   MySQL   NFS   Nagios   Network   Nginx   OSSEC   OTRS   Office   PGSQL   PHP   Perl   Personal   PostgreSQL   Postgres   PowerDNS   Proxmox   Proxy   Python   Rancher   Rant   Redis   Roundcube   SSL   Samba   Seafile   Security   Shell   SmartOS   Solaris   Surveillance   Systemd   TLS   Tomcat   Ubuntu   Unix   VMWare   VMware   Varnish   Virtualization   Windows   Wireless   Wordpress   Wyse   ZFS   Zoneminder   


Update cookies preferences