Workaround for mounting a filesystem to a local directory without elevated privileges on Linux

Question

I've got an ext3 filesystem sitting in a file, and I'd like to mount it to a local directory without sudo or any elevated permissions. Why? I'm creating a small filesystem for automated testing purposes. The automated tests run on machines I do not control, so there are some barriers to adding mount to sudoers.

Here's how I created the filesystem:

$ dd if=/dev/zero of=./50MB_partition count=102400
$ mkfs.ext3 -F 50MB_partition

Had I had permission, I could now mount it like so:

$ mkdir small_partition
$ sudo mount 50MB_partition ./small_partition

It seems that, because I own the filesystem and the mount point, there is no security risk associated with allowing me to mount this. I understand what is limiting me from calling mount without sudo; no explanation needed there. What I want to know is, is there a workaround that allows me to use my filesystem for testing purposes?

Answer 1

mount requires mount() [defined in sys/mount.h] which, in turn, requires CAP_SYS_ADMIN, so you can't use mount() without a fstab entry or sudo.

might want to look into fuse (filesystem in userspace) [ http://fuse.sourceforge.net/ ]

Answer 2

There is an option to mount to do this, owner, which also implies other options to prevent security violations.

owner

Allow an ordinary (i.e., non-root) user to mount the filesystem if he is the owner of the device. This option implies the options nosuid and nodev (unless overridden by subsequent options, as in the option line owner,dev,suid).

The problem is that it requires the "device" to be owned by you. There is no device in this case. The device (/dev/loopx) is automatically setup by mount, which requires root privileges, and then the device isn't owned by you.

Not sure how to work around that, unless, you can get a root user to use losetup and then chown the loop device to you.

It's also possible that this needs to be mentioned in /etc/fstab for the owner option to be accepted. Not sure since it isn't documented in the man page I have and I haven't tried it.