Fork of kdave/btrfs-progs, allowing to build distinct suid binaries for specific btrfs command groups
C Shell Python Makefile M4 C++
Switch branches/tags
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Failed to load latest commit information.
Documentation
check
convert
image
kernel-lib
kernel-shared
libbtrfsutil
m4
mkfs
tests
travis
.gitignore
.travis.yml
64-btrfs-dm.rules
Android.mk
CHANGES
COPYING
INSTALL
Makefile
Makefile.extrawarn
Makefile.inc.in
README.md
README_btrfs-progs.md
VERSION
androidcompat.h
autogen.sh
backref.c
backref.h
bcp
btrfs-calc-size.c
btrfs-completion
btrfs-corrupt-block.c
btrfs-crc.c
btrfs-debug-tree.c
btrfs-debugfs
btrfs-filesystem-usage.c
btrfs-find-root.c
btrfs-fragments.c
btrfs-list.c
btrfs-list.h
btrfs-map-logical.c
btrfs-qgroup-destroy.c
btrfs-receive.c
btrfs-sb-mod.c
btrfs-select-super.c
btrfs-send.c
btrfs-show-super.c
btrfs-subvolume-delete.c
btrfs-subvolume-list.c
btrfs-subvolume-show.c
btrfs-subvolume-snapshot.c
btrfs-zero-log.c
btrfs.c
btrfsck.h
btrfstune.c
chunk-recover.c
cmds-balance.c
cmds-device.c
cmds-fi-du.c
cmds-fi-usage.c
cmds-fi-usage.h
cmds-filesystem.c
cmds-inspect-dump-super.c
cmds-inspect-dump-tree.c
cmds-inspect-tree-stats.c
cmds-inspect.c
cmds-property.c
cmds-qgroup.c
cmds-quota.c
cmds-receive.c
cmds-replace.c
cmds-rescue.c
cmds-restore.c
cmds-scrub.c
cmds-send.c
cmds-subvolume.c
commands.h
common-defs.h
configure.ac
ctree.c
ctree.h
dir-item.c
dir-test.c
disk-io.c
disk-io.h
extent-cache.c
extent-cache.h
extent-tree.c
extent_io.c
extent_io.h
file-item.c
file.c
find-root.c
find-root.h
free-space-cache.c
free-space-cache.h
free-space-tree.c
free-space-tree.h
fsck.btrfs
fsfeatures.c
fsfeatures.h
hash.h
hasher.c
help.c
help.h
inode-item.c
inode-map.c
inode.c
internal.h
ioctl-test.c
ioctl.h
kerncompat.h
library-test.c
messages.c
messages.h
print-tree.c
print-tree.h
props.c
props.h
qgroup-verify.c
qgroup-verify.h
qgroup.c
qgroup.h
quick-test.c
random-test.c
rbtree-utils.c
rbtree-utils.h
repair.c
repair.h
root-tree.c
send-dump.c
send-dump.h
send-stream.c
send-stream.h
send-utils.c
send-utils.h
send.h
show-blocks
string-table.c
string-table.h
super-recover.c
task-utils.c
task-utils.h
transaction.c
transaction.h
utils-lib.c
utils.c
utils.h
uuid-tree.c
version.h.in
volumes.c
volumes.h

README.md

Btrfs-progs-btrbk

This is a fork of btrfs-progs, allowing to build distinct binaries for specific btrfs command groups:

  • btrfs-subvolume-list
  • btrfs-subvolume-show
  • btrfs-subvolume-snapshot
  • btrfs-subvolume-delete
  • btrfs-send
  • btrfs-receive
  • btrfs-filesystem-usage
  • btrfs-qgroup-destroy

These binaries are used by btrbk if backend btrbk-progs-btrbk is set in btrbk.conf.

License: GPLv2.

Motivation

While btrfs-progs offer the all-inclusive "btrfs" command, it gets pretty cumbersome to restrict privileges to the subcommands (command groups). Common approaches are to either setuid root for "/sbin/btrfs" (which is not recommended at all), or to write sudo rules for each command group.

Separating the command groups into distinct binaries makes it easy to set elevated privileges (capabilities or setuid) on each command group. A typical use case where this is needed is when it comes to automated scripts, e.g. btrbk creating snapshots and send/receive them via ssh.

Installation

After building the binaries (see INSTALL documentation), instead of make install, you have an option to install the binaries along with elevated file capabilities (setcap) for users in the btrfs group:

$ sudo make install-setcap

Or selectively, for installing only a single subcommand:

$ sudo make install-setcap-btrfs-subvolume-list \
            install-setcap-btrfs-subvolume-show \
            [...]

The result should be something like this:

$ sudo getcap -r /usr/local/bin/
/usr/local/bin/btrfs-send = cap_dac_read_search,cap_fowner,cap_sys_admin+ep
/usr/local/bin/btrfs-receive = cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_sys_admin,cap_mknod+ep
/usr/local/bin/btrfs-subvolume-delete = cap_dac_override,cap_sys_admin+ep
/usr/local/bin/btrfs-subvolume-list = cap_dac_read_search,cap_fowner,cap_sys_admin+ep
/usr/local/bin/btrfs-subvolume-show = cap_dac_read_search,cap_fowner,cap_sys_admin+ep
/usr/local/bin/btrfs-subvolume-snapshot = cap_dac_override,cap_dac_read_search,cap_fowner,cap_sys_admin+ep

Gentoo Linux

If you're on gentoo, grab the digint portage overlay from: git://dev.tty0.ch/portage/digint-overlay.git

Install selected binaries, e.g. for backup source:

$ echo sys-fs/btrfs-progs-btrbk \
filecaps \
btrfs-subvolume-show \
btrfs-subvolume-list \
btrfs-send \
btrfs-subvolume-delete \
btrfs-subvolume-snapshot >> /etc/portage/package.use

$ emerge sys-fs/btrfs-progs-btrbk

Development

If you would like to contribute or have found bugs:

References