[PATCH] findmnt: add option to list all statvfs f_flags

[PATCH] findmnt: add option to list all statvfs f_flags

[Roberto Bergantinos Corpas]

It might be useful for security auditing purposes list all possible
mount flags/options including default set which are normally not listed.

Given that we already call statvfs to retrieve i.e. filesystem size,
add an extra column to list all possible f_flags, default or not.

Signed-off-by: Roberto Bergantinos Corpas <rbergant@redhat.com>
---
 misc-utils/findmnt.c | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/misc-utils/findmnt.c b/misc-utils/findmnt.c
index 43b4dc7d6..da9f42020 100644
--- a/misc-utils/findmnt.c
+++ b/misc-utils/findmnt.c
@@ -56,6 +56,7 @@ enum {
 	COL_FSTYPE,
 	COL_OPTIONS,
 	COL_VFS_OPTIONS,
+	COL_MNT_OPTIONS,
 	COL_FS_OPTIONS,
 	COL_LABEL,
 	COL_UUID,
@@ -101,6 +102,7 @@ static struct colinfo infos[] = {
 	[COL_FSTYPE]       = { "FSTYPE",       0.10, SCOLS_FL_TRUNC, N_("filesystem type") },
 	[COL_OPTIONS]      = { "OPTIONS",      0.10, SCOLS_FL_TRUNC, N_("all mount options") },
 	[COL_VFS_OPTIONS]  = { "VFS-OPTIONS",  0.20, SCOLS_FL_TRUNC, N_("VFS specific mount options") },
+	[COL_MNT_OPTIONS]  = { "MNT-OPTIONS",  0.20, SCOLS_FL_TRUNC, N_("All statvfs f_flags from mount") },
 	[COL_FS_OPTIONS]   = { "FS-OPTIONS",   0.10, SCOLS_FL_TRUNC, N_("FS specific mount options") },
 	[COL_LABEL]        = { "LABEL",        0.10, 0, N_("filesystem label") },
 	[COL_UUID]         = { "UUID",           36, 0, N_("filesystem UUID") },
@@ -490,6 +492,26 @@ static char *get_vfs_attr(struct libmnt_fs *fs, int sizetype)
 				(double)(buf.f_blocks - buf.f_bfree) /
 				buf.f_blocks * 100);
 		return sizestr;
+	case COL_MNT_OPTIONS:
+		if (mnt_fs_get_vfs_options(fs)) {
+			sizestr = xstrdup(mnt_fs_get_vfs_options(fs));
+			if (!(buf.f_flag & MS_NOEXEC))
+				mnt_optstr_append_option(&sizestr, "exec", NULL);
+			if (!(buf.f_flag & MS_NOSUID))
+				mnt_optstr_append_option(&sizestr, "suid", NULL);
+			if (!(buf.f_flag & MS_NODEV))
+				mnt_optstr_append_option(&sizestr, "dev", NULL);
+			if (!(buf.f_flag & MS_SYNCHRONOUS))
+				mnt_optstr_append_option(&sizestr, "async", NULL);
+			if (!(buf.f_flag & MS_MANDLOCK))
+				mnt_optstr_append_option(&sizestr, "nomand", NULL);
+			if (!(buf.f_flag & MS_NOATIME))
+				mnt_optstr_append_option(&sizestr, "atime", NULL);
+			if (!(buf.f_flag & MS_NODIRATIME))
+				mnt_optstr_append_option(&sizestr, "diratime", NULL);
+			return sizestr;
+		} else
+			return NULL;
 	}
 
 	if (!vfs_attr)
@@ -585,6 +607,7 @@ static char *get_data(struct libmnt_fs *fs, int num)
 	case COL_AVAIL:
 	case COL_USED:
 	case COL_USEPERC:
+	case COL_MNT_OPTIONS:
 		str = get_vfs_attr(fs, col_id);
 		break;
 	case COL_FSROOT:
-- 
2.21.0

Re: [PATCH] findmnt: add option to list all statvfs f_flags

[Karel Zak]

On Wed, Nov 25, 2020 at 10:45:11AM +0100, Roberto Bergantinos Corpas wrote:
> It might be useful for security auditing purposes list all possible
> mount flags/options including default set which are normally not listed.
> 
> Given that we already call statvfs to retrieve i.e. filesystem size,
> add an extra column to list all possible f_flags, default or not.

(Sorry Roberto I forgot reply to our private email.)

I understand the goal, but I'm not sure with implementation ;-)

* statvfs() requires access to the mount point, it's better to avoid
  it if possible due to issue with permissions for non-root users and
  due to inaccessible NFS, etc.

  The mount options are already accessible for everyone in /proc/self/mountinfo. 
  It's possible to use mnt_optstr_get_flags() to convert the string
  from mnt_fs_get_vfs_options() to flags.

* your implementation hardcodeds the flags to findmnt.c. This is
  fragile in terms of future development. And for example right now
  your list does not include dirsync, sub, silent, strictatime,
  lazytime, relatime and symfollow options.

  It would be better to use libmount options map where we maintain the
  option flags and strings, something like

     const struct libmnt_optmap *ent;
     const struct libmnt_optmap *map;

     map = mnt_get_builtin_optmap(MNT_LINUX_MAP);

     for (ent = map; ent && ent->name; ent++) {
        if (flags & ent->id)
            ...
     }

 Maybe we can add a function to return all (including default) options
 to libmount to make it easy to use for all applications (something
 like mnt_fs_get_vfs_alloptions()).

> +	[COL_MNT_OPTIONS]  = { "MNT-OPTIONS",  0.20, SCOLS_FL_TRUNC, N_("All statvfs f_flags from mount") },

 Not sure, but do we really need a new column for this purpose?

 It's still about VFS-OPTIONS, the difference is that you need default
 build-in options too. What about to add --vfs-show-default (or so)
 command line options to modify VFS-OPTIONS output?


 I can implement it next week (if you don't want play with
 libmount, etc.).

    Karel

-- 
 Karel Zak  <kzak@redhat.com>
 http://karelzak.blogspot.com

Re: [PATCH] findmnt: add option to list all statvfs f_flags

[Roberto Bergantinos Corpas]

Hi Karel!

thanks for inputs, appreciate it.

Yes i agree with your objections, in fact first i thought about
extending VFS-OPTIONS via some flag,
and check agains options map, thought i guess i took easy path at some point ;-)

I'll try to see if i can make some work based on your suggestions
before next week.

On Wed, Nov 25, 2020 at 12:21 PM Karel Zak <kzak@redhat.com> wrote:
>
> On Wed, Nov 25, 2020 at 10:45:11AM +0100, Roberto Bergantinos Corpas wrote:
> > It might be useful for security auditing purposes list all possible
> > mount flags/options including default set which are normally not listed.
> >
> > Given that we already call statvfs to retrieve i.e. filesystem size,
> > add an extra column to list all possible f_flags, default or not.
>
> (Sorry Roberto I forgot reply to our private email.)
>
> I understand the goal, but I'm not sure with implementation ;-)
>
> * statvfs() requires access to the mount point, it's better to avoid
>   it if possible due to issue with permissions for non-root users and
>   due to inaccessible NFS, etc.
>
>   The mount options are already accessible for everyone in /proc/self/mountinfo.
>   It's possible to use mnt_optstr_get_flags() to convert the string
>   from mnt_fs_get_vfs_options() to flags.
>
> * your implementation hardcodeds the flags to findmnt.c. This is
>   fragile in terms of future development. And for example right now
>   your list does not include dirsync, sub, silent, strictatime,
>   lazytime, relatime and symfollow options.
>
>   It would be better to use libmount options map where we maintain the
>   option flags and strings, something like
>
>      const struct libmnt_optmap *ent;
>      const struct libmnt_optmap *map;
>
>      map = mnt_get_builtin_optmap(MNT_LINUX_MAP);
>
>      for (ent = map; ent && ent->name; ent++) {
>         if (flags & ent->id)
>             ...
>      }
>
>  Maybe we can add a function to return all (including default) options
>  to libmount to make it easy to use for all applications (something
>  like mnt_fs_get_vfs_alloptions()).
>
> > +     [COL_MNT_OPTIONS]  = { "MNT-OPTIONS",  0.20, SCOLS_FL_TRUNC, N_("All statvfs f_flags from mount") },
>
>  Not sure, but do we really need a new column for this purpose?
>
>  It's still about VFS-OPTIONS, the difference is that you need default
>  build-in options too. What about to add --vfs-show-default (or so)
>  command line options to modify VFS-OPTIONS output?
>
>
>  I can implement it next week (if you don't want play with
>  libmount, etc.).
>
>     Karel
>
> --
>  Karel Zak  <kzak@redhat.com>
>  http://karelzak.blogspot.com
>