Sample Header Ad - 728x90

On Debian, XFS, I can edit a file of another user with permissions 644 without ACL

4 votes
1 answer
390 views
today to my surprise I have noticed that I may delete a file that was created by a user with UID 100024 while being logged to my normal user (UID 1000) shell. The UID 100024 is a subuid, it is how the user inside the rootless podman container looks in top processes, also in ls -l output. The cat /etc/subuid out is myuser:100000:65536, same for the subgid. The sudo sysctl kernel.unprivileged_userns_clone out is kernel.unprivileged_userns_clone = 1 the getfacl /the/file shows
user::rw-
group::r--
other::r--
The grep CONFIG_USER_NS /boot/config-$(uname -r) out is CONFIG_USER_NS=y. To even a bigger surprise, I was able to edit a file created by UID 1000 user in the volume mapped folder, from inside the container! The file had 644 permissions and was owned by nobody:nogroup. I'm pretty sure I could not do these operations in the past. Anything has happened to my 6.1.0-32-amd64 Debian? The filesystem is xfs. ls -hal for the directory returns:
drwxrwxr-x+ 12 pod_yt      root        4.0K Jul 19 17:09 name_of_the_dir
and the getfacl for the dir returns
user::rwx user:myuser:rwx 
user:name_of_the_user_for_uid_100024:rwx 
group::r-x mask::rwx other::r-x
Asked by Václav (153 rep)
Jul 29, 2025, 02:14 PM
Last activity: Jul 30, 2025, 03:40 PM