Is there a way to make mount point not writable by root?

[Abssenta]

Hi.

The problem I am facing with JuiceFS is that the mount point is writable by root by default. We normally avoid this for security reasons. In normal nfs sharing, it should suffice to use root_squash in the export options. However, I don't think JuiceFS has that feature. Are there any options for mounting juicefs without root write permissions?

Thanks in advance.

[xiaogaozi]

Sorry, JuiceFS currently does not support this feature.

2023.06.09 Update: The JuiceFS v1.1.0 Beta 1 already supports --root-sqush option to map root user to another user.

[davies]

@Abssenta When JuiceFS is mounted by non-root user and without allow-other option, only the user who mount it can access it, even root can't access it.

[Abssenta]

@davies Thanks for your answer. I am aware of that. However, our intention is to have a scratch directory where each user will have a personal directory with write access just for them and read access for users belonging to the same group. So, unfortunately, this is not an option.

[davies]

Understood, let's create a issue to track it.

[Abssenta]

@davies Thanks a lot. I have another concern. I don't know if I should post a different thread, but here we go. I have mounted JuiceFS using /etc/fstab but I am concerned about the DB password being readable by others (fstab is readable by others by default and it needs to be like that for some other commands to work). Any person with access to that password would have access to JuiceFS DB and cause a lot of damage. I couldn't find a way to grab the DB credentials from a file. Is there any? Thanks in advance.

[davies]

The secret could be passed using environment variable, but we can use that together with /etc/fstab. Can you try systemd or other ways to manage juicefs as a service or startup job?

[Abssenta]

@davies Thanks a lot. I followed your advice and I managed to pass the secret as a variable to the systemd configuration file.