Can't get setuid/suiddir to work on a ZFS share: my mistake or bug?

Status
Not open for further replies.

Stilez

Guru
Joined
Apr 8, 2016
Messages
529
Here's what I have tried, to get owner inheritance working on my dataset.
man zfs says it works for zfs if the setuid=on property has been set (although man mount says that it isn't available except for UFS?)
Test results shown below with comments interspersed.

Looking for feedback if this is correct, if it's reproducible, or if I'm doing something wrong.

Code:
# id
uid=0(root) gid=0(wheel) groups=0(wheel),1002(data_managers)

# su -l temp_user

% id
uid=1003(temp_user) gid=65533(nogroup) groups=65533(nogroup),1002(data_managers)

############################# Okay, we're definitely a new user and not root

% zfs get setuid test_pool/test_dataset
NAME						PROPERTY  VALUE   SOURCE
test_pool/test_dataset  setuid	on	  default

% zfs get setuid test_pool/test_dataset/test_dataset2
NAME						PROPERTY  VALUE   SOURCE
test_pool/test_dataset/test_dataset2  setuid	on	  default

% mount | grep 'test_dataset'
test_pool/test_dataset on /mnt/test_pool/test_dataset (zfs, local, noatime, suiddir, nfsv4acls)
test_pool/test_dataset/test_dataset2 on /mnt/test_pool/test_dataset/test_dataset2 (zfs, local, noatime, suiddir, nfsv4acls)

% ls -lt /mnt/test_pool/test_dataset
drwsrwxrwx  5 data_user  wheel  9 Apr  3 22:30 test_dataset

% ls -lt /mnt/test_pool/test_dataset/test_dataset2
drwsrwxrwx  5 data_user wheel  9 Apr  3 22:30 test_dataset2

############################# The dataset and its parent both have zfs setuid=on, mounted with suiddir,
############################# setuid bit set in permissions, and owned by an unprivileged account "data_user"
############################# but (below) we still aren't getting owner inheritance.

% cd /mnt/test_pool/test_dataset/test_dataset2

% touch test0

% ls -lt test0
-rw-r--r--  1 temp_user  wheel  0 Apr  3 22:32 test0


Am I doing something wrong or something else needed, or is setuid on dirs not implemented for ZFS despite what man zfs says?
 
Last edited:

Stilez

Guru
Joined
Apr 8, 2016
Messages
529
Were you able to figure this out?
Yes - and the answer isn't entirely satisfactory. I asked on the FreeBSD-fs list and Andriy (list member) clarified. He seems to know most about it. The short answer is, on FreeBSD the " setuid=on" property is implemented on ZFS - but only in its original, historical sense (on files). It doesn't operate on directories, so it cannot mediate ownership or ownership inheritance.

That's pretty misleading of FreeBSD's man pages, since man zfs states that the setuid bit will be respected (without any stated limitation) if this setting is enabled, and man chmod makes clear that when the setuid bit is enabled, it moderates files and dirs. The man page is apparently imported without being corrected for differences between FreeBSD and other Unixes, in which presumably the statement would have been true (because the source Unix didn't actually implement setuid for directories so the issue never came up).

TL;DR - man zfs page imported but hasn't been critically reviewed for discrepancies. Functional differences between setuid effect on other Unixes vs FreeBSD meant that the page is misleading for FreeBSD as it stands because the setuid bit whose behaviour it comments on, has a wider effect on FreeBSD (file+dir) compared to the source OS (file only).

In effect, absolutely cannot procure/enforce inherited ownership on directories in a ZFS dataset right now. No means provided in the OS to do so.
If you know a workaround or a "Summer of Code" style enhancement that reliably does so, I'd love to hear of it.
 
Status
Not open for further replies.
Top