topic Re: Permissions of Mounted Filesystems in Operating System - HP-UX

Permissions of Mounted Filesystems

Chuck Moreland — Tue, 15 Oct 2002 13:53:11 GMT

We currently are having a discussion where I work as to what the standard permissions of a mounted file system should be.

1) Set the ownership of root, and give users permissions via a group.

2) Give ownership of the mount point to the application account, and give permissions to users via the group.

So the question at hand is: are there any security issues if a root mounted file system (ie: /oracle) is owned by root? The prefrence is to have the application account own the mount, so the application owner can manage the filesystem.

Any help or thoughts. . .

Re: Permissions of Mounted Filesystems

Tibi Baraboi_1 — Tue, 15 Oct 2002 13:58:17 GMT

The application might check the UID of the owner. This is what informix is doing. So, for us the owner is informix not root.

Check with oracle to see what they need.

Regards,
Tibi Baraboi

Re: Permissions of Mounted Filesystems

Ashwani Kashyap — Tue, 15 Oct 2002 14:04:01 GMT

Oracle says that mount point should be owned by oracle .

Re: Permissions of Mounted Filesystems

Chuck Moreland — Tue, 15 Oct 2002 14:07:26 GMT

That is great. Do you have a doc number or white paper from oracle that recomends this?

Re: Permissions of Mounted Filesystems

MANOJ SRIVASTAVA — Tue, 15 Oct 2002 14:11:41 GMT

We have the structure like this

The Database mount points are owned by database like oracle/informix

The application owned bu application ids , and the connection of logins to the database are managed by the DB admins , ideally the mount points hsould be owned by the respective groups so that the upkeep si done by them and everything doesnt fall on teh admins.

Also note that preferable the lost+found should still be owned by root !

Manoj Srivastava

Re: Permissions of Mounted Filesystems

Andrew Cowan — Wed, 16 Oct 2002 07:37:05 GMT

I always create all mount-points as root.system 0777, then change the ownerships and permissions on the mounted-directory. In my experience with several versions of Unix, is that if you don't do this, strange problems can-arise.

It may seem insecure, but the mount-point is only exposed when there is no filesystem mounted over it, and since most filesystems tend to be mounted during boot, it never seems to cause me a problem.