Mount a volume with different ownership permissions with bindfs

Written by Claudio Kuenzler - 0 comments

Published on July 16th 2015 - Listed in Linux

---

Today I got asked by a colleague, if it were possible to mount a volume where certain ownerships (in this case www-data owner) are automatically adapted to his own user, so he can modify files belonging to www-data.

One way to solve the file permission write issue is to put the local user to the same group of www-data and change the permissions that the group www-data is able to write. On the other hand this also requires, that the www-data group also exists on the localhost, not only inside the container. With www-data this is the case (because it is already a fixed part of an Ubuntu installation), but for special users this won't work or requires further modifications.

Another possibility is to use bindfs. Bindfs allows you to "remap" ownerships and creates a virtual mount point.

sudo bindfs --map=www-data/claudio /var/lib/lxc/container001/rootfs /tmp/container001

The above command explained:

--map: Allows to "remap" the ownership permissions. In this example, the www-data owner is rewritten to the user claudio (meaning: claudio becomes the new owner on the bindfs mounted path)

/var/lib/lxc/container001/rootfs: The original folder/path

/tmp/container001: The destination path, where the remapping happens. This is a virtual path and the mountpoint (/tmp/container001) must exist.

So if I look into the original folder, the owner is www-data for the cache files of this web application:

ll /var/lib/lxc/container001/rootfs/srv/webapp/cache/
total 40
-rw-r--r-- 1 www-data 1005   469 Apr  2 13:39 clear_cache.sh
drwxr-xr-x 5 www-data 1005  4096 Apr  2 13:39 doctrine
drwxr-xr-x 6 www-data 1005  4096 Jul 10 11:55 general
drwxr-xr-x 2 www-data 1005  4096 Apr  2 13:40 html
drwxr-xr-x 4 www-data 1005  4096 Apr  2 13:39 mpdf
drwxr-xr-x 2 www-data 1005  4096 Apr  2 13:40 productexport
drwxr-xr-x 2 www-data 1005 12288 Jul 11 09:10 proxies
drwxr-xr-x 3 www-data 1005  4096 Jul 10 11:55 templates

In the bindfs mountpoint, where the ownerships were remapped, the file structure looks like this:

ll /tmp/container001/srv/webapp/cache/
total 40
-rw-r--r-- 1 claudio 1005   469 Apr  2 13:39 clear_cache.sh
drwxr-xr-x 5 claudio 1005  4096 Apr  2 13:39 doctrine
drwxr-xr-x 6 claudio 1005  4096 Jul 10 11:55 general
drwxr-xr-x 2 claudio 1005  4096 Apr  2 13:40 html
drwxr-xr-x 4 claudio 1005  4096 Apr  2 13:39 mpdf
drwxr-xr-x 2 claudio 1005  4096 Apr  2 13:40 productexport
drwxr-xr-x 2 claudio 1005 12288 Jul 11 09:10 proxies
drwxr-xr-x 3 claudio 1005  4096 Jul 10 11:55 templates

So now my local user "claudio" is able to modify files in the bindfs mount which belong to www-data in the original path:

claudio@mymachine:~$ touch /tmp/container001/srv/webapp/cache/claudiofile.php

claudio@mymachine:~$ ll /tmp/test/srv/shopware/cache/
total 40
-rw-rw-r-- 1 claudio claudio     0 Jul 16 11:39 claudiofile.php
-rw-r--r-- 1 claudio  1005   469 Apr  2 13:39 clear_cache.sh
drwxr-xr-x 5 claudio  1005  4096 Apr  2 13:39 doctrine
drwxr-xr-x 6 claudio  1005  4096 Jul 10 11:55 general
drwxr-xr-x 2 claudio  1005  4096 Apr  2 13:40 html
drwxr-xr-x 4 claudio  1005  4096 Apr  2 13:39 mpdf
drwxr-xr-x 2 claudio  1005  4096 Apr  2 13:40 productexport
drwxr-xr-x 2 claudio  1005 12288 Jul 11 09:10 proxies
drwxr-xr-x 3 claudio  1005  4096 Jul 10 11:55 templates

In the original path the file was created, too, but belongs to www-data:

ll /var/lib/lxc/container001/rootfs/srv/webapp/cache/
total 40
-rw-rw-r-- 1 www-data claudio     0 Jul 16 11:39 claudiofile.php
-rw-r--r-- 1 www-data  1005   469 Apr  2 13:39 clear_cache.sh
drwxr-xr-x 5 www-data  1005  4096 Apr  2 13:39 doctrine
drwxr-xr-x 6 www-data  1005  4096 Jul 10 11:55 general
drwxr-xr-x 2 www-data  1005  4096 Apr  2 13:40 html
drwxr-xr-x 4 www-data  1005  4096 Apr  2 13:39 mpdf
drwxr-xr-x 2 www-data  1005  4096 Apr  2 13:40 productexport
drwxr-xr-x 2 www-data  1005 12288 Jul 11 09:10 proxies
drwxr-xr-x 3 www-data  1005  4096 Jul 10 11:55 templates

Add a comment

Show form to leave a comment

Comments (newest first)

No comments yet.