[6.8.3] [6.9.0] [6.9.1] shfs seems to ignore permissions

@limetech Any thoughts?

I just retested with 6.9.0 and the same issue still exists

root@MediaStore:~# docker run --rm --name box -d -v /mnt/cache/Downloads:/media alpine sleep 3600
520f6d86f848a8558c1ac66f01107f0c02b63bad8481af71491aee5523000b0b
root@MediaStore:~# docker exec -u 1002 -it box sh -c 'id; ls -ld /media; touch /media/a_file && ls -l /media/a_file'
uid=1002 gid=0(root)
drwxrws---    1 99       users       245858 Mar  7 23:56 /media
touch: /media/a_file: Permission denied
root@MediaStore:~# docker stop box
box
root@MediaStore:~# docker run --rm --name box -d -v /mnt/user/Downloads:/media alpine sleep 3600
4c5815e3e8d5b43c0d6b667dcf88cea7eb2d6b842a67125c606660c0613d22fe
root@MediaStore:~# docker exec -u 1002 -it box sh -c 'id; ls -ld /media; touch /media/a_file && ls -l /media/a_file && rm -v /media/a_file'
uid=1002 gid=0(root)
drwxrws---    1 99       users       245858 Mar  8 14:03 /media
-rw-r--r--    1 1002     root             0 Mar  8 14:04 /media/a_file
removed '/media/a_file'

 

@limetech

Seems like a bug with shfs itself:

root@MediaStore:/mnt/user/Downloads# echo x > a
root@MediaStore:/mnt/user/Downloads# chmod 600 a
root@MediaStore:/mnt/user/Downloads# ls -l a
-rw------- 1 root root 2 Mar 23 21:44 a
root@MediaStore:/mnt/user/Downloads# ls -l /mnt/cache/Downloads/a
-rw------- 1 root root 2 Mar 23 21:44 /mnt/cache/Downloads/a
root@MediaStore:/mnt/user/Downloads# cat a
x
root@MediaStore:/mnt/user/Downloads# su nobody -s /bin/sh
nobody@MediaStore:/mnt/user/Downloads$ cat a
x
nobody@MediaStore:/mnt/user/Downloads$ cat /mnt/cache/Downloads/a
cat: /mnt/cache/Downloads/a: Permission denied
nobody@MediaStore:/mnt/user/Downloads$ echo y > a
nobody@MediaStore:/mnt/user/Downloads$ cat a
y

 

I hope this is not directly caused by Limetech's stance that Unraid is an appliance and should only have the root user.

As this can cause breakage with NFS shares, ransomware protection and general stuff and use cases that expect file permissions to protect stuff

Edited March 23, 2021 by ken-ji

Very interesting.  To fix, open a Terminal window and type:

echo 'shfsExtra="-o default_permissions"' > /boot/config/extra.cfg

Then you must Stop/Start array.  Also this will persist across reboots, hence to undo you must delete the file.

 

This is a mount option that tells FUSE to let the kernel handle file system permissions.  This used to be how FUSE worked by default and somewhere along the line it got changed, probably in transition from FUSE v2 to v3.  This bug will get fixed in Unraid OS 6.10 where we can have a little beta testing before wider deployment.

 

 

This seems to have fixed the issue.

Changed Status to Solved