0

for a mobile backup-solution (rpi) I need to mount devices controlled by a webinterface (apache/php7.4). I know, there is a risk, but I added www-data to the sodoers.

My problem is, mounting seems to work, seen from webinterface, from commandline the device seems not to be mounted. And my backup-scripts can not access the devices.

To reproduce I have a test-script lsblk.php:

<?php
        echo (shell_exec("whoami"));
        echo (shell_exec("sudo whoami"));

        echo ("\n\numount\n");
        echo (shell_exec("sudo umount /media/storage"));
        echo (shell_exec("sudo lsblk"));

        echo ("\n\nmount\n");
        echo (shell_exec("sudo mount /dev/sda1 /media/storage"));
        echo (shell_exec("sudo lsblk"));
?>

Called by webinterface I get this back to the browser:

www-data
root


umount
NAME        MAJ:MIN RM   SIZE RO TYPE MOUNTPOINT
sda           8:0    0 931.5G  0 disk 
`-sda1        8:1    0 931.5G  0 part 
mmcblk0     179:0    0  29.7G  0 disk 
|-mmcblk0p1 179:1    0   256M  0 part /boot
`-mmcblk0p2 179:2    0  29.5G  0 part /


mount
NAME        MAJ:MIN RM   SIZE RO TYPE MOUNTPOINT
sda           8:0    0 931.5G  0 disk 
`-sda1        8:1    0 931.5G  0 part /media/storage
mmcblk0     179:0    0  29.7G  0 disk 
|-mmcblk0p1 179:1    0   256M  0 part /boot
`-mmcblk0p2 179:2    0  29.5G  0 part /

/media/storage seems to be mounted. But lsblk (as pi, root or www-data) always gives back:

NAME        MAJ:MIN RM   SIZE RO TYPE MOUNTPOINT
sda           8:0    0 931.5G  0 disk 
└─sda1        8:1    0 931.5G  0 part 
mmcblk0     179:0    0  29.7G  0 disk 
├─mmcblk0p1 179:1    0   256M  0 part /boot
└─mmcblk0p2 179:2    0  29.5G  0 part /

So it's not mounted?

sudo -u www-data php ./lsblk.php shows the same like the webinterface:

www-data
root


umount
umount: /media/storage: not mounted.
NAME        MAJ:MIN RM   SIZE RO TYPE MOUNTPOINT
sda           8:0    0 931.5G  0 disk 
└─sda1        8:1    0 931.5G  0 part 
mmcblk0     179:0    0  29.7G  0 disk 
├─mmcblk0p1 179:1    0   256M  0 part /boot
└─mmcblk0p2 179:2    0  29.5G  0 part /


mount
NAME        MAJ:MIN RM   SIZE RO TYPE MOUNTPOINT
sda           8:0    0 931.5G  0 disk 
└─sda1        8:1    0 931.5G  0 part /media/storage
mmcblk0     179:0    0  29.7G  0 disk 
├─mmcblk0p1 179:1    0   256M  0 part /boot
└─mmcblk0p2 179:2    0  29.5G  0 part /

But lsblk from commandline now shows the mounted device:

NAME        MAJ:MIN RM   SIZE RO TYPE MOUNTPOINT
sda           8:0    0 931.5G  0 disk 
└─sda1        8:1    0 931.5G  0 part /media/storage
mmcblk0     179:0    0  29.7G  0 disk 
├─mmcblk0p1 179:1    0   256M  0 part /boot
└─mmcblk0p2 179:2    0  29.5G  0 part /

Now I can access the storage: ls /media/storage/

test.txt

This was not possible after webinterface-based mounting.

I am out of ideas, any help? Thank you!

Steven
  • 1
  • 1
  • Crazy, apache-web-applications can access the mounted storage while other processes can't.I use filebrowser (https://github.com/filebrowser/filebrowser) (running as root) and it doesn't see any files while mejiro (https://github.com/dmpop/mejiro) has read/write access! – Steven Nov 21 '21 at 14:10
  • Running filebrowser as www-data changes nothing. If I mount by commandline, it works, if I mount by apache/php it is like not mounted for non-apache... – Steven Nov 21 '21 at 14:19
  • This should not be on [Super User](https://superuser.com/) ? – Elikill58 Nov 25 '21 at 09:20

1 Answers1

0

The main issue here is presumably an systemd option in the service settings. apache2 example: /lib/systemd/system/apache2.service: PrivateTmp=true causes this behaviour, see details here.

In short: If PrivateTmp is enabled in the systemd settings for a service, a file system namespace is being set up for the service.

IR Works
  • 49
  • 6