Security

The authors of this library tried their best to make sure that nothing bad happens, but they are only human. Thus:

Warning

Use this library at your own risk.

Running as root

The library goes to great length to make sure everything passed to the operating system is safe. Due to the nature of operating systems, many tasks can only be carried out with elevated privileges, commonly running with the privileges of the user root. This means that care must be taken when using it with elevated privileges!

Thankfully, ZFS allows to delegate permission to some extend, allowing a user or a group on the local system to carry out administrative tasks. One exception is mounting, which is handled in the next paragraph.

It is suggested to take a look at the zfs(8) manpage, especially the part that covers zfs allow.

The mount problem

On Linux, only root is allowed to manipulate the global namespace. This means that no amount of zfs allow will allow any other user to mount a fileset. They can be created with the mountpoint property set, but can’t be mounted. One workaround is to specify legacy, and using /etc/fstab to mount it, the other is to install and use a special privilege escalation (PE) helper.

Elevated privileges are required for the following tasks:

• mount or unmount a fileset without the use of /etc/fstab and legacy mountpoints

• set or change the mountpoint property, which results in changing the mountpoint

• ZPool import or export

Whether the helper is installed setuid root or uses sudo internally or any other way is up to the user. Head over to Privilege Escalation Helper for more info.