How to grant non root user wrote permissions on kubernetes SBM flexvolume mount?

Question

Please help! I'm struggling with this for a few days now...

I'm trying to write to a mount in a Kubernetes pod with a non-root user and getting access denied.

In the Kubernetes manifest, I am mounting a windows shared folder like this:

kind: Deployment
apiVersion: apps/v1
metadata:
  name: centos-deployment
spec:
  template:
    spec:
      volumes:
        - name: windows-mount
          flexVolume:
            driver: microsoft.com/smb
            secretRef:
              name: centos-credentials
            options:
              mountOptions: 'cifs,dir_mode=0777,file_mode=0777'
              source: //100.200.300.400/windows-share
      containers:
        - name: centos-pod
          image: 'centos:latest'
          command:
            - sh
            - '-c'
            - sleep 1000000        
          volumeMounts:
            - name: windows-mount
              mountPath: /var/windows-share

and in the Dockerfile I'm changing to application user like so:

# Drop from 'root' user to 'nobody' (user with no privileges).
USER nobody:nobody

But now, the mount is owned by "root". The "root" user can write to the path but the user "nobody" cannot.

I tried init container to run chmod -R 775 on the folder, but it looks like the root user cannot change the permissions or ownership of the mount. (umask command returned 022)

If I exec into the pod, I can see the mount is set with 755 permissions instead of 777 "file_mode=0755,dir_mode=0755"

[root@centos-deployment-5d46bd8b89-tzghs /]# mount | grep windows-share
//100.200.300.400/windows-share on /var/windows-share type cifs (rw,relatime,vers=default,cache=strict,username=*******,domain=,uid=0,noforceuid,gid=0,noforcegid,addr=100.200.300.400,file_mode=0755,dir_mode=0755,soft,nounix,serverino,mapposix,rsize=1048576,wsize=1048576,echo_interval=60,actimeo=1)

Any idea how to mount a Windows share so that it is writable by non-root user?

Thanks! any help will be very appreciated

user_14484111 · Answer

Full reference: https://linux.die.net/man/8/mount.cifs

Try playing with the mountOptions. For example:

uid=arg - sets the uid that will own all files or directories on the mounted filesystem when the server does not provide ownership information. It may be specified as either a username or a numeric uid. When not specified, the default is uid 0. The mount.cifs helper must be at version 1.10 or higher to support specifying the uid in non-numeric form. See the section on FILE AND DIRECTORY OWNERSHIP AND PERMISSIONS below for more information.

      volumes:
        - name: windows-mount
              ...
            options:
              mountOptions: 'cifs,uid=,dir_mode=0777,file_mode=0777'

If this doesen't work you can also try adding noperm mount option.

noperm - Client does not do permission checks. This can expose files on this mount to access by other users on the local client system. It is typically only needed when the server supports the CIFS Unix Extensions but the UIDs/GIDs on the client and server system do not match closely enough to allow access by the user doing the mount. Note that this does not affect the normal ACL check on the target machine done by the server software (of the server ACL against the user name provided at mount time).

      volumes:
        - name: windows-mount
              ...
            options:
              mountOptions: 'cifs,dir_mode=0777,file_mode=0777,noperm'

About using chmod/chown on CIFS

The core CIFS protocol does not provide unix ownership information or mode for files and directories. Because of this, files and directories will generally appear to be owned by whatever values the uid= or gid= options are set, and will have permissions set to the default file_mode and dir_mode for the mount. Attempting to change these values via chmod/chown will return success but have no effect.

How to grant non root user wrote permissions on kubernetes SBM flexvolume mount?

1 Answers