Skip to content

Fork of kdave/btrfs-progs, allowing to build distinct binaries for specific btrfs subcommands with elevated privileges (fscaps, setuid)

License

Notifications You must be signed in to change notification settings

digint/btrfs-progs-btrbk

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Btrfs-progs-btrbk

This is a patchset on top of btrfs-progs, allowing to build distinct binaries for specific btrfs subcommands, e.g. "btrfs-subvolume-show" which would be identical to "btrfs subvolume show".

This is especially useful for btrbk, using the backend btrbk-progs-btrbk configuration option.

License: GPLv2.

Motivation

While btrfs-progs offer the all-inclusive "btrfs" command, it gets pretty cumbersome to restrict privileges to the subcommands. Common approaches are to either setuid root for "/sbin/btrfs" (which is not recommended at all), or to write sudo rules for each subcommand.

Separating the subcommands into distinct binaries makes it easy to set elevated privileges using capabilities(7) or setuid. A typical use case where this is needed is when it comes to automated scripts, e.g. btrbk creating snapshots and send/receive them via ssh.

Installation

This is a short overview for the cmds-separated-fscaps patchset, please refer to the INSTALL documentation for more information.

$ ./autogen.sh
$ ./configure --enable-btrfs-separated --enable-setcap-install
$ make separated

This will build all separated binaries btrfs-*.separated. If you want to install the binaries with setuid, use --enable-setuid-install instead.

If you want to install all separated binaries, type:

$ make SETCAP_GROUP=btrfs install-separated

This will install the binaries along with elevated file capabilities (setcap) for users in the btrfs group.

Alternatively, select specific binaries to install:

$ make SETCAP_GROUP=btrfs \
       install-btrfs-subvolume-show.separated \
       install-btrfs-subvolume-list.separated \
       install-btrfs-send.separated \
       [...]

The result should be something like this:

$ sudo getcap -r /usr/local/bin/
/usr/local/bin/btrfs-send = cap_dac_read_search,cap_fowner,cap_sys_admin+ep
/usr/local/bin/btrfs-receive = cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_sys_admin,cap_mknod+ep
/usr/local/bin/btrfs-subvolume-delete = cap_dac_override,cap_sys_admin+ep
/usr/local/bin/btrfs-subvolume-list = cap_dac_read_search,cap_fowner,cap_sys_admin+ep
/usr/local/bin/btrfs-subvolume-show = cap_dac_read_search,cap_fowner,cap_sys_admin+ep
/usr/local/bin/btrfs-subvolume-snapshot = cap_dac_override,cap_dac_read_search,cap_fowner,cap_sys_admin+ep

Note that for btrbk, you will need:

Purpose Binaries
always btrfs-subvolume-show, btrfs-subvolume-list
source btrfs-subvolume-snapshot, btrfs-send
target btrfs-receive
delete btrfs-subvolume-delete
info btrfs-filesystem-usage

Gentoo Linux

If you're on gentoo, grab the digint portage overlay from: https://dev.tty0.ch/portage/digint-overlay.git

Install selected binaries, e.g. for backup source:

$ echo sys-fs/btrfs-progs-btrbk filecaps btrbk-source >> /etc/portage/package.use
$ emerge sys-fs/btrfs-progs-btrbk

Development

If you would like to contribute or have found bugs:

References

About

Fork of kdave/btrfs-progs, allowing to build distinct binaries for specific btrfs subcommands with elevated privileges (fscaps, setuid)

Topics

Resources

License

Stars

Watchers

Forks

Packages

No packages published