Permissions of Mounted Filesystems

[Chuck Moreland]

We currently are having a discussion where I work as to what the standard permissions of a mounted file system should be.

1) Set the ownership of root, and give users permissions via a group.

2) Give ownership of the mount point to the application account, and give permissions to users via the group.

So the question at hand is: are there any security issues if a root mounted file system (ie: /oracle) is owned by root? The prefrence is to have the application account own the mount, so the application owner can manage the filesystem.

Any help or thoughts. . .

[Tibi Baraboi_1]

The application might check the UID of the owner. This is what informix is doing. So, for us the owner is informix not root.

Check with oracle to see what they need.

Regards,
Tibi Baraboi

[Ashwani Kashyap · Accepted solution]

Oracle says that mount point should be owned by oracle .

[Chuck Moreland]

That is great. Do you have a doc number or white paper from oracle that recomends this?

[MANOJ SRIVASTAVA]

We have the structure like this

The Database mount points are owned by database like oracle/informix

The application owned bu application ids , and the connection of logins to the database are managed by the DB admins , ideally the mount points hsould be owned by the respective groups so that the upkeep si done by them and everything doesnt fall on teh admins.

Also note that preferable the lost+found should still be owned by root !

Manoj Srivastava

[Andrew Cowan]

I always create all mount-points as root.system 0777, then change the ownerships and permissions on the mounted-directory. In my experience with several versions of Unix, is that if you don't do this, strange problems can-arise.

It may seem insecure, but the mount-point is only exposed when there is no filesystem mounted over it, and since most filesystems tend to be mounted during boot, it never seems to cause me a problem.