6

Apologies for the title, the setup is actually quite simple. I have a host with a user called oli and a directory called /media/steve/incoming that oli can read-write-execute in. Within that I have a privileged LXC container running under root. /media/steve/incoming is mounted in the container as /incoming/ with:

lxc.mount.entry = /media/steve/incoming incoming none bind 0 0

Within the container I have a webserver running as www-data. It needs to be able to write to /incoming/.

What are my options here? I can think of a few ideas but they either have pretty serious downsides or I don't know how to implement them:

  • I could change my daemon to run as root within the container but I'd rather it didn't. Root write files strangely in the directory (they come out as root:oli-owned on the host).

  • Can I map container-www-data to have host-oli privs on the filesystem? Would this grant them access to the host? oli is not an unprivaliged account. It can do real damage.

  • Can I just bind-mount it in such a way that anybody in the container can write to /incoming and the access looks like it's coming from host-oli?

  • ACL any help here?

  • I have temporarily used a NFS share. This gives me fast-enough write speeds but it's a silly layer to have to use for this. I'd appreciate a proper LXC answer. – Oli Dec 3 '15 at 18:13
  • what does this mean here of you : "I could change my daemon to run as root but I'd rather it didn't have root even in the container." - are you rooted by someone or is container rooted ? – dschinn1001 Dec 11 '15 at 19:02
  • @dschinn1001 Huh? I'm saying I don't want to give my containerised application root in the container because I'd prefer it wasn't allowed to trash the container. I just want to give the application's user write permissions. – Oli Dec 11 '15 at 19:16
  • then log into container there and set there with chmod the specific permissions (without write access ?) for example with chmod 505 -R * ?! and out of the container back in your home you can simply watch the users ?! Or am I behind the moon ?! – dschinn1001 Dec 11 '15 at 19:21
3
+200

ACL can do it successfully because it makes files to be shared for multiple users based on username rather than userid number.

It's converted to userid number inside of file's attribute.

Can I map container-www-data to have host-oli privs on the filesystem? Would this grant them access to the host? oli is not an unprivaliged account. It can do real damage.

You can run following command on host to make lxc container's www-data user can write the /incoming folder.

$ sudo chown oli /media/steve/incoming
$ sudo setfacl -m u:www-data:rwx /media/steve/incoming

/media/steve/incoming is binded one for /incoming of the lxc container.

And /media/steve/incoming's owner is already owned by oli.

So host's oli can write it directly and the container's www-data user also can write it directly.

And if setfacl command is not exists at the host, you can install it with following command.

$ sudo apt-get install acl

Host's www-data and containter's www-data can use difference user id number, So you can share /media/steve/incoming for Container's www-data user id as following.

At first, get userid number of www-data on container.

$ cat /etc/passwd | grep "^www-data:" | awk -F ":" '{print $3}'

Then it'll show an number if container has a user named www-data, userid of www-data. At second, set file attribute with acl as following on host.

$ sudo setfacl -m u:<got_number_above>:rwx /media/steve/incoming

Then it'll work for container.

You can get more help for ACL from FilePermissionsACLs

  • The host doesn't know about the container's users though. www-data on the host will map to a UID that's completely different to something running in the container. – Oli Dec 14 '15 at 15:02
  • you're right. So i added some lines to make acl works for container's www-data on host. – xiaodongjie Dec 14 '15 at 15:48
  • This still has the problem that the files written are under the wrong UID. On one system they look like www-data on another they read out as rtkit and on another they read as usbmux – Oli Dec 15 '15 at 9:31
  • yes, but it'll work for container's www-data user because it's related to UID – xiaodongjie Dec 15 '15 at 9:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.