From f74b821a6696fef9e9953aae05941e99bf83800e Mon Sep 17 00:00:00 2001 From: Brian Behlendorf Date: Tue, 7 Jun 2016 09:16:52 -0700 Subject: Add `zfs allow` and `zfs unallow` support ZFS allows for specific permissions to be delegated to normal users with the `zfs allow` and `zfs unallow` commands. In addition, non- privileged users should be able to run all of the following commands: * zpool [list | iostat | status | get] * zfs [list | get] Historically this functionality was not available on Linux. In order to add it the secpolicy_* functions needed to be implemented and mapped to the equivalent Linux capability. Only then could the permissions on the `/dev/zfs` be relaxed and the internal ZFS permission checks used. Even with this change some limitations remain. Under Linux only the root user is allowed to modify the namespace (unless it's a private namespace). This means the mount, mountpoint, canmount, unmount, and remount delegations cannot be supported with the existing code. It may be possible to add this functionality in the future. This functionality was validated with the cli_user and delegation test cases from the ZFS Test Suite. These tests exhaustively verify each of the supported permissions which can be delegated and ensures only an authorized user can perform it. Two minor bug fixes were required for test-running.py. First, the Timer() object cannot be safely created in a `try:` block when there is an unconditional `finally` block which references it. Second, when running as a normal user also check for scripts using the both the .ksh and .sh suffixes. Finally, existing users who are simulating delegations by setting group permissions on the /dev/zfs device should revert that customization when updating to a version with this change. Signed-off-by: Brian Behlendorf Signed-off-by: Tony Hutter Closes #362 Closes #434 Closes #4100 Closes #4394 Closes #4410 Closes #4487 --- man/man8/zfs.8 | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'man') diff --git a/man/man8/zfs.8 b/man/man8/zfs.8 index 30660a60d..4e3fa54a8 100644 --- a/man/man8/zfs.8 +++ b/man/man8/zfs.8 @@ -2933,6 +2933,11 @@ Force a rollback of the file system to the most recent snapshot before performin .sp .6 .RS 4n Displays permissions that have been delegated on the specified filesystem or volume. See the other forms of \fBzfs allow\fR for more information. +.sp +Delegations are supported under Linux with the exception of \fBmount\fR, +\fBunmount\fR, \fBmountpoint\fR, \fBcanmount\fR, \fBrename\fR, and \fBshare\fR. +These permissions cannot be delegated because the Linux \fBmount(8)\fR command +restricts modifications of the global namespace to the root user. .RE .sp @@ -3584,9 +3589,6 @@ If you are using \fBDNS\fR for host name resolution, specify the fully qualified .LP \fBExample 17 \fRDelegating ZFS Administration Permissions on a ZFS Dataset .sp -.LP -This is not currently supported on Linux. -.sp The following example shows how to set permissions so that user \fBcindys\fR can create, destroy, mount, and take snapshots on \fBtank/cindys\fR. The permissions on \fBtank/cindys\fR are also displayed. .sp -- cgit v1.2.3