Re: subvolumes as partitions and mount options

[Andrei Borzenkov <arvidjaar@gmail.com>]

On 27.03.2023 21:48, Matt Zagrabelny wrote:
> Greetings,
> 
> I have a root partition btrfs file system.
> 
> I need to have /tmp, /var, /var/tmp, /var/log, and other directories
> under separate partitions so that certain mount options can be set for
> those partitions/directories.
> 
> I'm testing out a subvolume mount with the subvolume /subv_content
> mounted at /subv_mnt.
> 
> For instance, the noexec mount option can be circumvented:

"exec/noexec" option applies to mount instance, it is not persistent 
property of underlying filesystem. It is not specific to btrfs at all.

bor@bor-Latitude-E5450:/tmp/tst$ ./bin/foo.sh
Hello, world!
bor@bor-Latitude-E5450:/tmp/tst$ mkdir exec noexec
bor@bor-Latitude-E5450:/tmp/tst$ sudo mount -o bind,exec bin exec
bor@bor-Latitude-E5450:/tmp/tst$ sudo mount -o bind,noexec bin noexec
bor@bor-Latitude-E5450:/tmp/tst$ ./exec/foo.sh
Hello, world!
bash: ./noexec/foo.sh: Permission denied
bor@bor-Latitude-E5450:/tmp/tst$




> root@ziti:/# findmnt --kernel /subv_mnt
> TARGET    SOURCE                                FSTYPE OPTIONS
> /subv_mnt /dev/nvme0n1p2[/@rootfs/subv_content] btrfs
> rw,nosuid,nodev,noexec,relatime,ssd,space_cache=v2,subvolid=257,subvol=/@rootfs/subv_content
> 
> root@ziti:/# echo '#!/usr/bin/bash' > /subv_mnt/foo ; echo 'echo foo'
>>> /subv_mnt/foo ; chmod 0755 /subv_mnt/foo
> root@ziti:/# /subv_mnt/foo
> bash: /subv_mnt/foo: Permission denied
> root@ziti:/# /subv_content/foo
> foo
> root@ziti:/#
> 
> Am I missing some mechanism to restrict subvolume with mount options
> that cannot be worked around by accessing the files in the subvolume
> as opposed to the mount point?
> 
> Thanks for any help!
> 
> -m