Configuration assistance for permissions and access

[Defy3738]

Hi all,

I have been using mergerfs for some time now and recently I ran into this issue. I am not sure what is the source of the problem so any help would be great. I am on an archlinux distro with linux-zen 6.16.8.zen3-1 kernel.

Essentially, if a directory has permissive permissions for a user and is nested in a path where the parent does not have that same permissive permission, then the access is denied (whereas it was not before), namely when it is mapped as a volume in a podman container. Below are a few commands and associated output I ran. This permission issue only popped up recently after I performed a system upgrade. If there is any other info I can provide please let me know. Thanks!

  root in /mnt/dev
 ❯ tail -n 1 /etc/fstab
/mnt/dev/data /mnt/dev/pool fuse.mergerfs defaults,inodecalc=hybrid-hash,cache.files=partial,dropcacheonclose=true,func.getattr=newest,category.action=all,category.create=pfrd 0 0

 root in /mnt/dev
 ❯ eza --long --tree -gn
drwxr-xr-x - 0    0      30 Sep 09:27 .
drwxr-xr-x - 0    0      30 Sep 09:28 ├── data
drwxrwx--- - 1000 101000 30 Sep 09:28 │   └── a
drwxrwx--- - 1000 100101 30 Sep 10:17 │       └── b
.rw-r--r-- 0 0    0      30 Sep 10:17 │           └── public_file
drwxr-xr-x - 0    0      30 Sep 09:28 └── pool
drwxrwx--- - 1000 101000 30 Sep 09:28     └── a
drwxrwx--- - 1000 100101 30 Sep 10:17         └── b
.rw-r--r-- 0 0    0      30 Sep 10:17             └── public_file

# expected permission error
root in /mnt/dev
 ❯ su $(getent passwd 100101 | cut -d: -f1) -s /bin/bash -c 'eza --long --tree -gn'
drwxr-xr-x - 0    0      30 Sep 09:27 .
drwxr-xr-x - 0    0      30 Sep 09:28 ├── data
drwxrwx--- - 1000 101000 30 Sep 09:28 │   └── a
                                      │       └── <Permission denied (os error 13)>
drwxr-xr-x - 0    0      30 Sep 09:28 └── pool
drwxrwx--- - 1000 101000 30 Sep 09:28     └── a
                                              └── <Permission denied (os error 13)>

 # expected
 root in /mnt/dev
 ❯ cd data/a/b && su $(getent passwd 100101 | cut -d: -f1) -s /bin/bash -c 'eza --long --tree -gn .' && cd -
drwxrwx--- - 1000 100101 30 Sep 10:17 .
.rw-r--r-- 0 0    0      30 Sep 10:17 └── public_file

# unexpected
root in /mnt/dev
 ❯ cd pool/a/b && su $(getent passwd 100101 | cut -d: -f1) -s /bin/bash -c 'eza --long --tree -gn .' && cd -
drwxrwx--- - 1000 100101 30 Sep 10:17 .
                                      └── <Permission denied (os error 13)>

# expected
# note the data path (without mergerfs)
root in /mnt/dev
 ❯ podman run --rm -v /mnt/dev/data/a/b:/data --uidmap 0:1000:1 --gidmap 0:1000:1 --uidmap 1:100001:65536 --gidmap 1:100001:65536 -u 101:101 alpine ls -la /data
total 0
drwxrwx---    1 root     101             24 Sep 30 15:41 .
dr-xr-xr-x    1 root     root            20 Sep 30 15:51 ..
-rw-r--r--    1 nobody   nobody           0 Sep 30 15:17 public_file

# unexpected. Expected the same output as above.
# note the pool path (with mergerfs)
 root in /mnt/dev
 ❯ podman run --rm -v /mnt/dev/pool/a/b:/data --uidmap 0:1000:1 --gidmap 0:1000:1 --uidmap 1:100001:65536 --gidmap 1:100001:65536 -u 101:101 alpine ls -la /data
total 0

# sanity check
root in /mnt/dev
 ❯ podman run --rm -it -v /mnt/dev/pool/a/b:/data --uidmap 0:1000:1 --gidmap 0:1000:1 --uidmap 1:100001:65536 --gidmap 1:100001:65536 -u 101:101 alpine ls -la / | rg data
drwxrwx---    1 root     101             24 Sep 30 15:41 data

# sanity check
root in /mnt/dev
 ❯ podman run --rm -it -v /mnt/dev/pool/a/b:/data --uidmap 0:1000:1 --gidmap 0:1000:1 --uidmap 1:100001:65536 --gidmap 1:100001:65536 -u 101:101 alpine id
uid=101(101) gid=101(101) groups=101(101)

[trapexit]

Possibly because mergerfs has to set the "allow idmap" kernel flag. I've not really messed with it but found just this morning it doesn't work the way I expected so I need to play with it more.