From 00b706423481e5a62cb08b5aa6912819c7d0d66b Mon Sep 17 00:00:00 2001 From: svalouch Date: Thu, 19 Dec 2019 07:27:05 +0100 Subject: [PATCH] docs: security: lay down list of actions/commands requiring root permissions on linux --- docs/security.rst | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/docs/security.rst b/docs/security.rst index f6e6a9d..33593b8 100644 --- a/docs/security.rst +++ b/docs/security.rst @@ -61,3 +61,31 @@ Reporting If all went well, the helper shall return ``0`` as exit code. Otherwise, the exit code denotes the nature of the problem. Text output to stdout/stderr is captured and logged as info (if the exit code is ``0``) or error (otherwise). The logger is either called ``simplezfs.zfs.pe_helper`` or ``simplezfs.zpool.pe_helper``, depending on the usage. + +When to use +=========== +The helper is generally only required on Linux, where, according to the ``zfs(8)`` manpage on ``zfs allow``, the +``mount(8)`` "command restricts modifications of the global namespace to the root user". + +The permissions that require ``root`` are: + +* ``mount`` +* ``unmount`` +* ``canmount`` +* ``rename`` +* ``share`` + +As some commands manipulate the namespace, the following actions require root permission: + +* ``clone`` +* ``create`` (:func:`~simplezfs.ZFS.create_fileset` because it mounts it right away) +* ``destroy`` (:func:`~simplezfs.ZFS.destroy_dataset`) +* ``mount`` +* ``promote`` +* ``receive`` +* ``rename`` +* ``rollback`` +* ``share`` +* ``snapshot`` (:func:`~simplezfs.ZFS.create_snapshot`) + +Additionally, changing the ``mountpoint`` property on filesets (:func:`~simplezfs.ZFS.set_mountpoint`)