Is it possible to set a custom uid and gid for the mount point?

[ruanformigoni]

Greetings,

I've used something similar with squashfuse, squashfuse -o uid=1001,gid=1001 fs.sqfs mount , is it possible to do something similar here?

Thanks

[mhx]

uid and gid are actually options provided by libfuse (not squashfuse). However, the options are only provided for file systems implemented using the high-level API. DwarFS uses the low-level API (at least on Linux), so these options are not available.

That being said, it should be trivial to provide these options if there's a use case.

[ruanformigoni]

Thanks for the info, for the use case, recently bubblewrap merged --overlay related options, now it is possible to use the kernel overlayfs with dwarfs without superuser privileges, however, compared to fuse-overlayfs, this does not offer an option to modify the uid and gid of the mount point. This leads to a mismatch between the uid and gid of the dwarfs filesystems and the host, which breaks things with permission issues if they do not match. In squashfuse this is resolved with the uid and gid parameters, configured to match the host's.

[ruanformigoni]

I've modified the filesystem to always use the current uid and gid in this patch ruanformigoni@84e4b83 , seems to work so far.

[VHSgunzo]

I also think it would be great to have this functionality. This would speed up the operation of portable unprivileged containers based on bubblewrap and DWARFS rootfs image by using bubblewrap overlay, rather than fuse-overlay or union-fuse.

[mhx]

I'm totally fine with adding support for this.

One question, though: @ruanformigoni, When you're saying

[...] option to modify the uid and gid of the mount point [...]

do you mean just the mountpoint itself or rather everything below the mountpoint? I expect you mean everything, as that's what your change is doing, and that's also what libfuse would do according to the manpage:

uid=N  Override the st_uid field set by the filesystem (N is
       numeric).
gid=N  Override the st_gid field set by the filesystem (N is
       numeric).

So I guess I'd add uid and gid options to dwarfs that can be used with (at least) numeric IDs, just as with libfuse.

[ruanformigoni]

Hi @mhx, I do mean everything under it.

[mhx]

Implemented in fb74c44. Feel free to check if this works for you with the binaries from the CI pipeline.

[VHSgunzo]

Thank you so much for adding this functionality! Now the bubblewrap overlay works as it should.

[ruanformigoni]

Thank you for implementing this so quickly 😄

[VHSgunzo]

@mhx
Hi! I seem to have found a bug related to access when trying to create an image from an image already mounted with these options. Here is an example of the errors:

E 13:26:36.916762 cannot access /tmp/.r1000/mnt/QsvthGXg/rootfs/usr/share/factory/etc/audit/plugins.d/af_unix.conf, creating empty file
E 13:26:36.917440 cannot access /tmp/.r1000/mnt/QsvthGXg/rootfs/usr/share/factory/etc/audit/plugins.d/au-remote.conf, creating empty file
E 13:26:36.918041 cannot access /tmp/.r1000/mnt/QsvthGXg/rootfs/usr/share/factory/etc/audit/plugins.d/audispd-zos-remote.conf, creating empty file
E 13:26:36.918240 cannot access /tmp/.r1000/mnt/QsvthGXg/rootfs/usr/share/factory/etc/audit/plugins.d/filter.conf, creating empty file
E 13:26:36.918643 cannot access /tmp/.r1000/mnt/QsvthGXg/rootfs/usr/share/factory/etc/audit/plugins.d/syslog.conf, creating empty file

These errors don't occur if i add read permissions for others ( --chmod=o+r) when creating DwarFS image, but I wouldn't want to do that.

$ stat /tmp/.r1000/mnt/*/rootfs/usr/share/factory/etc/audit/plugins.d/syslog.conf
  File: /tmp/.r1000/mnt/iByRiJy5/rootfs/usr/share/factory/etc/audit/plugins.d/syslog.conf
  Size: 524             Blocks: 1          IO Block: 131072 regular file
Device: 0,63    Inode: 8467        Links: 1
Access: (0640/-rw-r-----)  Uid: ( 1000/    user)   Gid: (  985/   users)
Access: 2024-10-13 23:33:44.000000000 +0300
Modify: 2024-10-13 23:33:44.000000000 +0300
Change: 2024-10-13 23:33:44.000000000 +0300
 Birth: -

Also, when trying to create a DwarFS image from a mounted SquashFS image with similar mount options and the same initial file permissions, no errors occur.

And indeed, the files are readable under the user I want to create the DwarFS image.

[mhx]

A few more thoughts.

I just went back to check if using access() in mkdwarfs was something I introduced because of a bug report. It turns out that it's been implemented that way since the very beginning. I might look into changing that, but not as a priority. Especially on Windows, I'll have to do more careful tests before concluding that changing this is safe.

However, I'll very likely drop the implementation of access() in the FUSE driver. That has also been implemented since the initial release of DwarFS, but it's very likely overkill, maybe even counterproductive. FUSE will generally do a good job at emulating access() and it will give you the choice to have "loose" permission checking (default) or "strict" permission checking (using -o default_permissions). I've checked that if the dwarfs FUSE driver doesn't implement access(), it behaves very much like an image mounted using squashfuse.

This will be a change in behaviour, so I'll save this for the next release (0.11.0).

[VHSgunzo]

Great! I am ready to test these changes as soon as they appear.

[mhx]

Feel free to try the builds from the CI pipeline.

[VHSgunzo]

@mhx
Yes, now these errors are gone. Thanks for adding this fix so quickly ;-)

[mhx]

You're welcome. It's going to take a while before this will make it into an official release, though.