From owner-freebsd-fs@freebsd.org Wed Aug 16 13:03:50 2017 Return-Path: Delivered-To: freebsd-fs@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 9B815DDACB6 for ; Wed, 16 Aug 2017 13:03:50 +0000 (UTC) (envelope-from mike@sentex.net) Received: from smarthost2.sentex.ca (smarthost2.sentex.ca [205.211.164.50]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (Client CN "smarthost.sentex.ca", Issuer "smarthost.sentex.ca" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 3F2BA82948; Wed, 16 Aug 2017 13:03:49 +0000 (UTC) (envelope-from mike@sentex.net) Received: from lava.sentex.ca (lava.sentex.ca [IPv6:2607:f3e0:0:5::11]) by smarthost2.sentex.ca (8.15.2/8.15.2) with ESMTPS id v7GD3h1Q023713 (version=TLSv1 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO); Wed, 16 Aug 2017 09:03:43 -0400 (EDT) (envelope-from mike@sentex.net) Received: from [192.168.43.26] (saphire3.sentex.ca [192.168.43.26]) by lava.sentex.ca (8.15.2/8.15.2) with ESMTP id v7GD3fcH000649; Wed, 16 Aug 2017 09:03:41 -0400 (EDT) (envelope-from mike@sentex.net) Subject: Re: protecting zfs snapshot info To: Borja Marcos Cc: "freebsd-fs@freebsd.org" , Andriy Gapon References: <52984307-2C6C-454C-A69B-15FB4AE01E1B@sarenet.es> <5e3145ab-246a-f213-80b0-000dd801fbef@sentex.net> <003E0B0C-95C5-4D0B-91DB-393877480BDE@sarenet.es> From: Mike Tancsa Organization: Sentex Communications Message-ID: <2b83528d-55a0-7c40-c11d-d341f8f46e47@sentex.net> Date: Wed, 16 Aug 2017 09:03:40 -0400 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.2.1 MIME-Version: 1.0 In-Reply-To: <003E0B0C-95C5-4D0B-91DB-393877480BDE@sarenet.es> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit X-Scanned-By: MIMEDefang 2.78 X-BeenThere: freebsd-fs@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Filesystems List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Aug 2017 13:03:50 -0000 cc'ing Andriy who knows a lot of ZFS... Andriy, is there any chance something like this is in the works in ZFS ? ---Mike On 8/16/2017 6:12 AM, Borja Marcos wrote: > >> On 15 Aug 2017, at 14:20, Mike Tancsa wrote: >> >> On 8/14/2017 8:57 AM, Mike Tancsa wrote: >>> On 8/14/2017 2:47 AM, Borja Marcos wrote: >>>> >>>>> On 12 Aug 2017, at 19:14, Mike Tancsa wrote: >>>>> >>>>> >>>>> Is there a way in zfs to protect non root users from seeing snapshots ? >> >>>> Good question and it’s a problem indeed. The .zfs directory is always created >>>> and it can be hidden but it’s still accessible. It’s a security problem that prevents >>>> an effective access revocation for a directory/file, I guess that’s what you mean. >>> >>> Yes, something like an extra option >>> hidden | visible | unmounted >> >> I did come across this thread >> >> https://github.com/zfsonlinux/zfs/issues/3963 >> >> but it seems Linux specific or at least I dont see how its done on FreeBSD. > > Yes, it seems to be Linux specific and as far as I know there’s no way to do it on FreeBSD right now. > > I would vouch for a third state added to the “snapdir” variable, but I wouldn’t call it “disabled”. “unmounted” or > maybe “noauto” is much better in my opinion. The .zfs directory should still be created (maybe hidden when > in “noauto” state in order to prevent it from being created by a user. > > I don’t think a new permission is needed to control that variable, though. The “snapshot” permission > implies that “mount” should be allowed as well at least in the current versions. So it’s redundant. Or, > actually, the “noauto” value for “snapdir” would eliminate the requirement for “mount” permissions. > > I mean: Right now the “snapshot” permission requires “mount” because the snapshot is mounted upon creation > like it or not. If the snapshot was not automatically mounted thanks to the “noauto” value for “snapdir” it would be > possible to have a user authorized to manage snapshots but unable to mount them. > > Given the very sensible nature of “mount” in Unix it makes sense. > > > > > > > > Borja. > > > > -- ------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike@sentex.net Providing Internet services since 1994 www.sentex.net Cambridge, Ontario Canada http://www.tancsa.com/