On Debian, XFS, I can edit a file of another user with permissions 644 without ACL
4
votes
1
answer
390
views
today to my surprise I have noticed that I may delete a file that was created by a user with UID 100024 while being logged to my normal user (UID 1000) shell. The UID 100024 is a subuid, it is how the user inside the rootless podman container looks in top processes, also in
ls -l
output. The cat /etc/subuid
out is myuser:100000:65536
, same for the subgid. The sudo sysctl kernel.unprivileged_userns_clone
out is kernel.unprivileged_userns_clone = 1
the getfacl /the/file shows
user::rw-
group::r--
other::r--
The grep CONFIG_USER_NS /boot/config-$(uname -r)
out is CONFIG_USER_NS=y
.
To even a bigger surprise, I was able to edit a file created by UID 1000 user in the volume mapped folder, from inside the container! The file had 644 permissions and was owned by nobody:nogroup
. I'm pretty sure I could not do these operations in the past. Anything has happened to my 6.1.0-32-amd64 Debian? The filesystem is xfs.
ls -hal
for the directory returns:
drwxrwxr-x+ 12 pod_yt root 4.0K Jul 19 17:09 name_of_the_dir
and the getfacl
for the dir returns
user::rwx user:myuser:rwx
user:name_of_the_user_for_uid_100024:rwx
group::r-x mask::rwx other::r-x
Asked by Václav
(153 rep)
Jul 29, 2025, 02:14 PM
Last activity: Jul 30, 2025, 03:40 PM
Last activity: Jul 30, 2025, 03:40 PM