Join Log in
Score:0
Wojciechgc avatar Server

Can't change file owner as root

gh flag
Wojciechgc

I can't change the owner of a file (I'm logged in as root).

Output of chown root Shrek.avi:

chown: changing ownership of 'Shrek.avi': Operation not permitted

Output of chattr -i Shrek.avi:

chattr: Permission denied while reading flags on Shrek.avi

Output of strace chattr -i Shrek.avi:

execve("/usr/bin/chattr", ["chattr", "-i", "Shrek.avi"], 0x7ffd5a2a56f0 /* 24 vars */) = 0
brk(NULL)                               = 0x55a268bd4000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=32282, ...}) = 0
mmap(NULL, 32282, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fd25ebeb000
close(3)                                = 0
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libe2p.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p3\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=44976, ...}) = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd25ebe9000
mmap(NULL, 47680, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fd25ebdd000
mprotect(0x7fd25ebe0000, 28672, PROT_NONE) = 0
mmap(0x7fd25ebe0000, 16384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x7fd25ebe0000
mmap(0x7fd25ebe4000, 8192, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x7000) = 0x7fd25ebe4000
mmap(0x7fd25ebe7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x9000) = 0x7fd25ebe7000
close(3)                                = 0
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libcom_err.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\"\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=18344, ...}) = 0
mmap(NULL, 20648, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fd25ebd7000
mmap(0x7fd25ebd9000, 4096, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7fd25ebd9000
mmap(0x7fd25ebda000, 4096, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x7fd25ebda000
mmap(0x7fd25ebdb000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x7fd25ebdb000
close(3)                                = 0
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libpthread.so.0", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 l\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=149520, ...}) = 0
mmap(NULL, 136304, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fd25ebb5000
mmap(0x7fd25ebbb000, 65536, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x6000) = 0x7fd25ebbb000
mmap(0x7fd25ebcb000, 24576, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x16000) = 0x7fd25ebcb000
mmap(0x7fd25ebd1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1b000) = 0x7fd25ebd1000
mmap(0x7fd25ebd3000, 13424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fd25ebd3000
close(3)                                = 0
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@>\2\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=1905632, ...}) = 0
mmap(NULL, 1918592, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fd25e9e0000
mmap(0x7fd25ea02000, 1417216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x22000) = 0x7fd25ea02000
mmap(0x7fd25eb5c000, 323584, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x17c000) = 0x7fd25eb5c000
mmap(0x7fd25ebab000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1ca000) = 0x7fd25ebab000
mmap(0x7fd25ebb1000, 13952, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fd25ebb1000
close(3)                                = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd25e9de000
arch_prctl(ARCH_SET_FS, 0x7fd25e9deb80) = 0
mprotect(0x7fd25ebab000, 16384, PROT_READ) = 0
mprotect(0x7fd25ebd1000, 4096, PROT_READ) = 0
mprotect(0x7fd25ebdb000, 4096, PROT_READ) = 0
mprotect(0x7fd25ebe7000, 4096, PROT_READ) = 0
mprotect(0x55a266c1c000, 4096, PROT_READ) = 0
mprotect(0x7fd25ec1d000, 4096, PROT_READ) = 0
munmap(0x7fd25ebeb000, 32282)           = 0
set_tid_address(0x7fd25e9dee50)         = 1259
set_robust_list(0x7fd25e9dee60, 24)     = 0
rt_sigaction(SIGRTMIN, {sa_handler=0x7fd25ebbb690, sa_mask=[], sa_flags=SA_RESTORER|SA_SIGINFO, sa_restorer=0x7fd25ebc8140}, NULL, 8) = 0
rt_sigaction(SIGRT_1, {sa_handler=0x7fd25ebbb730, sa_mask=[], sa_flags=SA_RESTORER|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fd25ebc8140}, NULL, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
brk(NULL)                               = 0x55a268bd4000
brk(0x55a268bf5000)                     = 0x55a268bf5000
lstat("Shrek.avi", {st_mode=S_IFREG|0400, st_size=2302464000, ...}) = 0
openat(AT_FDCWD, "Shrek.avi", O_RDONLY|O_NONBLOCK|O_NOFOLLOW) = -1 EACCES (Permission denied)
write(2, "chattr", 6chattr)                   = 6
write(2, ": ", 2: )                       = 2
write(2, "Permission denied", 17Permission denied)       = 17
write(2, " ", 1 )                        = 1
write(2, "while reading flags on Shrek.avi", 32while reading flags on Shrek.avi) = 32
ioctl(2, TCGETS, {B38400 opost isig icanon echo ...}) = 0
ioctl(2, TCGETS, {B38400 opost isig icanon echo ...}) = 0
write(2, "\n", 1
)                       = 1
exit_group(1)                           = ?
+++ exited with 1 +++

I'm running Turnkey Core 17.1 as an LXC container in Proxmox. The filesystem is ext4. I've been trying to fix this for 2 days. Can somebody help, please?

570
2 + 0
Score:1
njpdx avatar Server
jp flag
njpdx

Check if the file

  • is being used by another process using the lsof command.

  • is on a filesystem that supports extended attributes using the df command.

  • has been set to be immutable by some other means, such as through SELinux policies or through filesystem permissions.

If none of these steps help, you may need to consult the system logs.

+ 0
Score:1
Nikita Kipriyanov avatar Server
za flag
Nikita Kipriyanov

TL;DR: Maybe your file has a permissions outside the range provided to the Turnkey's container. Change the owner on the host to be 100000:100000, then try from the container again.

Explanation:

Your container is probably unprivileged so UIDs/GIDs that you see in the container in the range 0÷65535 are mapped to the 100000÷165535 in the host. This is done so no container's user has any privileges on the host, for instance, the root (UID 0) of the container is nobody particular (UID 100000) on the host and therefore it is not a real root and it can't do much harm to the system. In particular the container root has the control over files with UID 100000 but has no authority over files with UID 0. (I never looked at the code, but I believe the ability of 100000 to control owners of files with UIDs 100000÷165535 was added artificially.)

ext4 stores IDs as 32-bit integers, not user names for its file attributes, and it doesn't know anything about kernel's user namespaces. You can easily create the file with owner UID 0 or 100 in the container's file system by mounting it in the host (in PVE: pct mount <CTID>) and copying file there.

You may notice that host's UID 0 or 100 has no counterpart to map into in the container. If such file appears within the reach of the filesystem view presented to the container (like I just described), what the system should do? It will behave exactly how you are observing it: the container will see that file and allow access to it in line with file's "others" privileges, even to the container's root.

Fix is only possible from the "host" system, who is the only who can see the "real" UIDs and has the full authority over all of them, including those presented to containers.

+ 1
Wojciechgc avatar
gh flag
Wojciechgc
Thank you, this solved my problem!
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.