btrfs send non-root

btrfs send non-root

[Sam Bull]

[-- Attachment #1: Type: text/plain, Size: 1227 bytes --]

I'm getting an error when trying to send a subvolume. I only seem to be
able to do this as root. The subvolume was created by the user account,
and not root. Could anybody shed some light on why this is failing? Is
there a way to get it working?

$ btrfs send /var/spool/backups/hacking/2017-03-10 > something
ERROR: cannot open '/': Operation not permitted

Also appears I cannot even use btrfs subvolume show:

$ btrfs subvolume show /var/spool/backups/hacking/2017-03-10
ERROR: can't perform the search - Operation not permitted
ERROR: can't find 'var/spool/backups/hacking/2017-03-10'

$ sudo btrfs subvolume show /var/spool/backups/hacking/2017-03-10
/var/spool/backups/hacking/2017-03-10
	Name: 			2017-03-10
	UUID: 			c3a92646-bd6b-7a4f-ae10-
8bd12e569772
	Parent UUID: 		38b66de9-84d3-4848-ae53-
9a2fe861618c
	Received UUID: 		-
	Creation time: 		2017-03-10 19:11:22 +0000
	Subvolume ID: 		564
	Generation: 		753377
	Gen at creation: 	753377
	Parent ID: 		257
	Top level ID: 		257
	Flags: 			readonly
	Snapshot(s):


$ uname -a
Linux sam-laptop 4.4.0-66-generic #87-Ubuntu SMP Fri Mar 3 15:29:05 UTC
2017 x86_64 x86_64 x86_64 GNU/Linux

$ btrfs --version
btrfs-progs v4.4

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

Re: btrfs send non-root

[David Sterba]

On Sat, Mar 11, 2017 at 02:54:45PM +0000, Sam Bull wrote:
> I'm getting an error when trying to send a subvolume. I only seem to be
> able to do this as root. The subvolume was created by the user account,
> and not root. Could anybody shed some light on why this is failing? Is
> there a way to get it working?
> 
> $ btrfs send /var/spool/backups/hacking/2017-03-10 > something
> ERROR: cannot open '/': Operation not permitted

The send operation for non-root would need a full evaluation whether it
does not cross the permissions/security boundaries.

> Also appears I cannot even use btrfs subvolume show:
> 
> $ btrfs subvolume show /var/spool/backups/hacking/2017-03-10
> ERROR: can't perform the search - Operation not permitted
> ERROR: can't find 'var/spool/backups/hacking/2017-03-10'

The reason here is that the TREE_SEACH ioctl is used, that gives full
access to the internal structures and therefore is root-only. Many
'btrfs' subcommands utilize the flexibility of the ioctl as we don't
have tons of specialized ioctls, but this comes at some cost.