ambiser
/
btrbk
mirror of https://github.com/digint/btrbk
9
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ssh_filter_btrbk.sh: exclude "btrfs subvolume show|list" from restrict-path 

btrbk requires "btrfs subvolume list|show" queries from the mount
point in order to build btrfs trees. This conflicts with tightly set
--restrict-path.
pull/334/head
Axel Burri 2019-11-19 22:07:37 +01:00
parent 5407b863df
commit c03e960d90
2 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
doc/ssh_filter_btrbk.1.asciidoc
View File

@ -34,8 +34,8 @@ The accepted commands are specified by the "--source", "--target",
The following commands are always allowed: The following commands are always allowed:
- "btrfs subvolume show" - "btrfs subvolume show" (not affected by "--restrict-path")
- "btrfs subvolume list" - "btrfs subvolume list" (not affected by "--restrict-path")
- "readlink" - "readlink"
- "cat /proc/self/mountinfo" - "cat /proc/self/mountinfo"
- pipes through "gzip", "pigz", "bzip2", "pbzip2", "xz", "lzop", - pipes through "gzip", "pigz", "bzip2", "pbzip2", "xz", "lzop",
@ -80,7 +80,8 @@ OPTIONS
Allow btrfs receive command: "btrfs receive". Allow btrfs receive command: "btrfs receive".
-p, --restrict-path <path>:: -p, --restrict-path <path>::
Restrict btrfs commands to <path>. Restrict commands to <path>. Note that "btrfs subvolume show",
"btrfs subvolume list" are NOT affected by this option.
-l, --log:: -l, --log::
Log ACCEPT and REJECT messages to the system log. Log ACCEPT and REJECT messages to the system log.

5
ssh_filter_btrbk.sh
View File

@ -161,8 +161,9 @@ while [[ "$#" -ge 1 ]]; do
shift shift
done done
allow_cmd "${sudo_prefix}btrfs subvolume show"; # subvolume queries are always allowed # NOTE: subvolume queries no NOT affected by "--restrict-path":
allow_exact_cmd "${sudo_prefix}btrfs subvolume list ${file_match}"; # subvolume queries are always allowed # btrbk also calls show/list on the mount point of the subvolume
allow_exact_cmd "${sudo_prefix}btrfs subvolume (show|list)( ${option_match})* ${file_match}";
allow_cmd "${sudo_prefix}readlink" # used to resolve mountpoints allow_cmd "${sudo_prefix}readlink" # used to resolve mountpoints
allow_exact_cmd "cat /proc/self/mountinfo" # used to resolve mountpoints allow_exact_cmd "cat /proc/self/mountinfo" # used to resolve mountpoints
allow_exact_cmd "cat /proc/self/mounts" # legacy, for btrbk < 0.27.0 allow_exact_cmd "cat /proc/self/mounts" # legacy, for btrbk < 0.27.0