Equivalent to NFS all_squash

Question

I have an unusual requirement where I need to mount the same filesystem on a client multiple times, but each mount offering a different view of the underlying data, based on the group permissions of the underlying directories and files.

I have achieved this in the past with NFS and the all_squash and anongid /etc/exports option, making a specific mount appear as though the user had a specific group ID. It effectively filtered access to the underlying filesystem by forcing the accessing user's group.

Unfortunately I can't use that in this scenario, as the filesystem will be Amazon EFS (effectively an NFS server, but without any configuration options).

I have looked at bindfs, and this provides a force-group option, but this is the reverse of what I want, since it forces all files to have a specific group, rather than forcing the client to have a specific group, looking at the files unchanged.

I did see a mention of something called filterfs, but it appears to be long dead.

Does anybody know a way to get a filtered view of a file system for a single user by effectively changing the user's group on an ad-hoc basis (without using sudo, since the user is a webserver daemon).

Answer 1

Thanks to @sourcejedi for pointing me in the right direction.

In the original NFS setup, all_squash was used to make a daemon user appear to have a specific group (set by anongid). For this example, assume the group ID is 601. This view onto the original filesystem could therefore enforce permissions on files / directories based on the mounted filesystem's anongid being 601. Permissions appear like they evaluated at the level of the NFS mount, independent of the daemon user's actual group permissions. Another NFS mount onto the same filesystem with different all_squash settings effectively shows a different view of the files, as if the user had different group membership.

Using bindfs --map the same result can be achieved with a little different setup. A sample configuration binds a filesystem such that any files / directories with group ID 601 in the underlying filesystem appear to have group ID 599 in the mounted filesystem:

bindfs --map=@601/@599 --create-for-group=601 --create-for-user=600 --create-with-perms='u=rwD:g=rwD:o=' $FS_ROOT $MOUNT_ROOT/view601

Now, when listing files in $MOUNT_ROOT/view601 the daemon user sees any file that has group 601 instead having group 599. By giving the daemon membership of group gid 599, the permissions are effectively enforced again based on the mount. If a different mount mapped gid 602 to 599, the files in the same underlying filesystem would be available to the same user if they originally had group 602 (rather than 601) now mapped to 599, making them available to daemon.