search

amazonlinux / amazon-linux-2023

Amazon Linux 2023
https://aws.amazon.com/linux/amazon-linux-2023/
Other
540 stars 40 forks source link

[Feature Request] - enable acl for btrfs - BTRFS_FS_POSIX_ACL #793

Open danie-dejager opened 2 months ago

danie-dejager commented 2 months ago

Is your feature request related to a problem? Please describe. I am creating some mounts using btrfs to ensure that /var/log is off the root volume. I also harden access to /var/log and need acl enabled for services like chronyd to access /var/log/chronyd but the Amazon Linux default is not to enable BTRFS ACL. [23036.735024] BTRFS error (device nvme4n1: state M): support for ACL not compiled in!

Describe the solution you'd like Would it be possible to review and revert if the kernel can be compiled with ACLs enabled for btrfs? Enabled ACL is the default value and there was a decision made to disable a security control.

→ grep BTRFS_FS_POSIX_ACL /boot/config-$(uname -r)
# CONFIG_BTRFS_FS_POSIX_ACL is not set

/dev/nvme4n1 on /var/log type btrfs (rw,relatime,seclabel,compress=zstd:3,ssd,noacl,space_cache=v2,subvolid=259,subvol=/var_log)
/dev/nvme4n1 on /var/log/audit type btrfs (rw,relatime,seclabel,compress=zstd:3,ssd,noacl,space_cache=v2,subvolid=260,subvol=/var_log_audit)

I can't mount the volumes with ACL. 

mount -o remount /var/log
mount: /var/log: mount point not mounted or bad option.

The error for instance with setfacl: setfacl: /var/log/: Operation not supported

elsaco commented 2 months ago

@daniejstriata AL2023 is using XFS and it supports ACL by default. Is there any advantage in using brtfs instead of xfs, besides the I want it!?

danie-dejager commented 2 months ago

@elsaco I can add multiple subvolumes to one volume. I can create /home. /root, /var/log, /var/log/audit, /tmp and /var/tmp on one volume. Rather than 3. If I use XFS I have to use multiple volumes with most of the volumes more than 90% empty. I enable compression so I get better mileage. BTRFS is already complied/active for the current AL2023 kernel. It's not a big ask. I'm asking to enable ACLs for BTRFS which is already there but not configured with the default value. I want to be able to granularity configure who has access to directories on the host.

So no, I want it to improve my configuration's security.

https://btrfs.readthedocs.io/en/latest/Administration.html#mount-options (default: on)

bjoernd commented 1 month ago

As AL2023 is compiled with BTRFS support, this is a fair ask. I'm relaying this to the AL kernel team. Cannot give an ETA.