Bug 219433 - ZFS volume cannot be created by delegated user
Summary: ZFS volume cannot be created by delegated user
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 11.0-RELEASE
Hardware: Any Any
: --- Affects Some People
Assignee: freebsd-fs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-05-21 08:20 UTC by p5B2EA84B3
Modified: 2019-01-16 23:14 UTC (History)
2 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description p5B2EA84B3 2017-05-21 08:20:15 UTC
While creating a zfs filesystem by a delegated user works fine, creating a zfs volume fails:


# zfs allow mypool
---- Permissions on mypool --------------------------------------------
Permission sets:
	@container clone,create,destroy,mount,mountpoint,promote,reservation,rollback,snapshot,volblocksize,volsize

# zfs create mypool/container
# zfs allow -u myuser @container mypool/container
# su myuser

$ zfs allow mypool/container
---- Permissions on mypool/container ----------------------------------
Local+Descendent permissions:
	user myuser @container
---- Permissions on mypool --------------------------------------------
Permission sets:
	@container clone,create,destroy,mount,mountpoint,promote,reservation,rollback,snapshot,volblocksize,volsize

$ zfs create -o mountpoint=legacy mypool/container/myfilesystem
$ zfs list -r mypool/container
NAME                            USED  AVAIL  REFER  MOUNTPOINT
mypool/container                192K  50,3G    96K  /mypool/container
mypool/container/myfilesystem    96K  50,3G    96K  legacy

$ zfs create -V 128m mypool/container/myvolume
cannot create 'mypool/container/myvolume': permission denied

From man 8 zfs delegating operations on volumes should be possible, no word is found that creation of volumes is exempt:

zfs allow filesystem|volume
     zfs allow [-ldug] user|group[,user|group]...
	 perm|@setname[,perm|@setname]... filesystem|volume
     zfs allow [-ld] -e|everyone perm|@setname[,perm|@setname]...
	 filesystem|volume
     zfs allow -c perm|@setname[,perm|@setname]... filesystem|volume
     zfs allow -s @setname perm|@setname[,perm|@setname]... filesystem|volume
Comment 1 Allan Jude freebsd_committer freebsd_triage 2017-05-27 02:36:37 UTC
A regular user cannot create a device node, like /dev/zvol/mypool/container/myvolume so this cannot work.