Arch Linux

Cvlc

Member

Registered: 2020-03-26

Posts: 295

Permissions for ESP mounted at /boot

Hi,

On my system, the permissions for /boot are set to "drwx------".

Are these the normal permissions for /boot ? I have the feeling that I used to be able to autocomplete paths when using sudoedit or sudo xx, but maybe I'm getting mixed up...

I'm using gpt-auto-generator to automount the ESP (i.e. removing /boot and /root/ from /etc/fstab with the right GUIDs set), but I don't think that changes anything.

Is this for security reasons ?

Thanks !

Last edited by Cvlc (2022-01-03 16:30:48)

Scimmia

Fellow

Registered: 2012-09-01

Posts: 13,729

Re: Permissions for ESP mounted at /boot

Of course how it's mounted changes things, that's where the permissions are set for vfat. Yes, I would assume systemd does this for security reasons, although the risk in being able to read the ESP on most systems is negligible.

Head_on_a_Stick

Member

From: The Wirral

Registered: 2014-02-20

Posts: 9,003

Website

Re: Permissions for ESP mounted at /boot

I see the same in my system:

$ ls -ld /efi  
drwx------ 3 root root 4096 Jan  1  1970 /efi
$

I think this is normal because the ESP is only mounted on demand:

$ findmnt /efi 
TARGET SOURCE         FSTYPE OPTIONS
/efi   systemd-1      autofs rw,relatime,fd=46,pgrp=1,timeout=120,minproto=5,maxproto=5,direct,pipe_ino=16053
$

^ Note the autofs FSTYPE and the timeout option.

EDIT: sorry Scimmia, I should have refreshed before replying...

Last edited by Head_on_a_Stick (2022-01-03 16:39:51)

---

Jin, Jîyan, Azadî

Cvlc

Member

Registered: 2020-03-26

Posts: 295

Re: Permissions for ESP mounted at /boot

Ok thanks for your answers. That's what I initially thought, but I put the ESP back in fstab like it was initially generated upon install, did mount -a and the behavior was the same, so I thought it must be something else.

I'll just leave it like this and type the paths I guess. Not that I often have to modify stuff in /boot...

thanks !

Scimmia

Fellow

Registered: 2012-09-01

Posts: 13,729

Re: Permissions for ESP mounted at /boot

Looking at the driver docs, both fmask and dmask default to the umask of the calling process. Arch's default umask is 022 [1], which should result in 755 permissions. Do you have it set to 077 somewhere?

[1] https://github.com/archlinux/svntogit-p … profile#L4

Cvlc

Member

Registered: 2020-03-26

Posts: 295

Re: Permissions for ESP mounted at /boot

No I don't believe I ever modified permissions for anything important. Where would that be set ?

Only thing I did was removing the old line in fstab after modifying the GUIDs to the proper ones for automounting

Last edited by Cvlc (2022-01-03 18:31:49)

Scimmia

Fellow

Registered: 2012-09-01

Posts: 13,729

Re: Permissions for ESP mounted at /boot

Generally in your shell init files, as seen in the link. What does `umask` give you?

Cvlc

Member

Registered: 2020-03-26

Posts: 295

Re: Permissions for ESP mounted at /boot

$ umask 
0022

so that seems right

loqs

Member

Registered: 2014-03-06

Posts: 18,987

Re: Permissions for ESP mounted at /boot

https://github.com/systemd/systemd/blob … tor.c#L470

Scimmia

Fellow

Registered: 2012-09-01

Posts: 13,729

Re: Permissions for ESP mounted at /boot

right, but they said it happened while mounting from fstab, too, which doesn't make a lot of sense.

loqs

Member

Registered: 2014-03-06

Posts: 18,987

Re: Permissions for ESP mounted at /boot

That is strange as the code checks for an fstab entry https://github.com/systemd/systemd/blob … tor.c#L545
Edit:
mount -a should apply the options from the fstab irrespective of what systemd set.  Can mount -a fail silently?

Last edited by loqs (2022-01-04 04:02:50)

Cvlc

Member

Registered: 2020-03-26

Posts: 295

Re: Permissions for ESP mounted at /boot

I tried a full reboot after putting back the ESP in fstab, and this time I can read /boot/.
Commented the line out, did mount -a and the umask is still set to 0022. So I guess mount -a isn't a proper way to test it !

And with a little more reading the wiki does recommend setting those permissions for /boot/. Thanks!