0

I am trying to grant read permissions to group grafana-cloud to files under /var/lib/docker/containers:

#> ls  /var/lib/docker/containers/ | head -n1
0515ccad974eb0e4577c7b35a0c517ab889db95d996e6188e9d0377cfa2265d4

#> setfacl -Rdm g:grafana-agent:rx /var/lib/docker/containers
#> setfacl -Rm g:grafana-agent:rx /var/lib/docker/containers

Executing this snippet, it grants permissions to all the files and folders that already exists.

#> getfacl /var/lib/docker/containers/0515ccad974eb0e4577c7b35a0c517ab889db95d996e6188e9d0377cfa2265d4
getfacl: Removing leading '/' from absolute path names
# file: var/lib/docker/containers/0515ccad974eb0e4577c7b35a0c517ab889db95d996e6188e9d0377cfa2265d4
# owner: root
# group: root
user::rwx
group::---
group:grafana-agent:r-x
mask::r-x
other::---
default:user::rwx
default:group::---
default:group:grafana-agent:r-x
default:mask::r-x
default:other::---

If I create a new file or folder inside /var/lib/docker/containers, the acls are correctly kept:

#> mkdir /var/lib/docker/containers/foo
#> getfacl /var/lib/docker/containers/foo
getfacl: Removing leading '/' from absolute path names
# file: var/lib/docker/containers/foo
# owner: root
# group: root
user::rwx
group::---
group:grafana-agent:r-x
mask::r-x
other::---
default:user::rwx
default:group::---
default:group:grafana-agent:r-x
default:mask::r-x
default:other::---

The problem comes when a new container is created, where the acls seems that are not applied as I'm expecting:

#> docker run -d busybox
70216a6debce117563d2273da01a1219edc9e1357864cde5026076548b7169e8
#> getfacl /var/lib/docker/containers/70216a6debce117563d2273da01a1219edc9e1357864cde5026076548b7169e8/
getfacl: Removing leading '/' from absolute path names
# file: var/lib/docker/containers/70216a6debce117563d2273da01a1219edc9e1357864cde5026076548b7169e8/
# owner: root
# group: root
user::rwx
group::---
group:grafana-agent:r-x     #effective:---
mask::---
other::---
default:user::rwx
default:group::---
default:group:grafana-agent:r-x
default:mask::r-x
default:other::---

#> su - grafana-agent -c "ls /var/lib/docker/containers/70216a6debce117563d2273da01a1219edc9e1357864cde5026076548b7169e8/"
ls: cannot open directory '/var/lib/docker/containers/70216a6debce117563d2273da01a1219edc9e1357864cde5026076548b7169e8/': Permission denied

If now I run again the setfacl command, the acls are applied to the new container file tree and user can read the files:

#> setfacl -Rm g:grafana-agent:rx /var/lib/docker/containers/70216a6debce117563d2273da01a1219edc9e1357864cde5026076548b7169e8/
#> su - grafana-agent -c "ls /var/lib/docker/containers/70216a6debce117563d2273da01a1219edc9e1357864cde5026076548b7169e8/"
70216a6debce117563d2273da01a1219edc9e1357864cde5026076548b7169e8-json.log  checkpoints  config.v2.json  hostconfig.json  hostname  hosts  mounts  resolv.conf  resolv.conf.hash
#> getfacl /var/lib/docker/containers/70216a6debce117563d2273da01a1219edc9e1357864cde5026076548b7169e8
getfacl: Removing leading '/' from absolute path names
# file: var/lib/docker/containers/70216a6debce117563d2273da01a1219edc9e1357864cde5026076548b7169e8
# owner: root
# group: root
user::rwx
user:grafana-agent:r-x
group::---
group:grafana-agent:r-x
mask::r-x
other::---
default:user::rwx
default:user:grafana-agent:r-x
default:group::---
default:group:grafana-agent:r-x
default:mask::r-x
default:other::---

Is there something wrong in my process? It seems acls are not applied in first place as we can read #effective:--- next to the grafana-agent user, but I could not find any I've tried granting the acls to the users instead of the group with same results.

Thank you.

Javier Cortejoso
  • 103
  • 4

1 Answers1

2

ACLs only extend the standard POSIX permissions. The effective permission here is --- because the POSIX permissions for the group are --- and the (default) ACL mask is also ---.

You could instead do the following:

  1. Change the ownership of the directory: e.g. chown root:grafana-agent /var/lib/docker/containers
  2. Set its permissions with the s bit such that all new files (and directories) created inside will belong to the same group which is the owner of the directory: e.g. chmod g+rs /var/lib/docker/containers

You may need to change the group permissions for /var/lib/docker too: chmod o+x /var/lib/docker (this will allow every "other" user to list files in the directory and thus to access the containers subfolder)

julid
  • 36
  • 1