1

Running Debian Buster on Kernel 4.20.17 with systemd 241:

+PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD -IDN2 +IDN -PCRE2 default-hierarchy=hybrid

I have two ubifs volumes on a nand (/dev/mtd3) partition:

ubi0:rootfs on / type ubifs (ro,relatime,assert=read-only,ubi=0,vol=1)
/dev/ubi0_2 on /var type ubifs (rw,relatime,assert=read-only,ubi=0,vol=2)

and I get the following error:

systemd-journald[747]: Failed to set ACL on /var/log/journal/2f572c0abab24e2fafc1b969aba78f1f/user-1000.journal, ignoring: Operation not supported

Can I set UBIFS as ACL and if so how do I tweak my fstab to enable it?

/dev/ubi0_2 /var ubifs defaults,auto 0 0
cajjed
  • 95
  • 1
  • 11

1 Answers1

1

No, according to the UBIFS documentation, ACL support is not implemented in UBIFS:

Extended attributes

UBIFS supports extended attributes if the corresponding configuration option is enabled (no additional mount options are required). It supports the user, trusted, and security name-spaces. However, access control lists (ACL) support is not implemented.

Note, currently mkfs.ubifs ignores extended attributes and does not write them to the target file-system image.

Likewise, the kernel source states that ACL support is not implemented.

Filesystems implementing ACL usually have an acl.c file in sources. JFFS2 has such a file and supports ACLs (eg: its mkfs.jffs2 command has a --with-posix-acl option).

If the ACL feature is really needed, and your system can afford it (eg: JFFS2 might use more RAM and have a longer mount time if big) maybe a small separate JFFS2 filesystem where this feature is needed could be considered. Using JFFS2 over UBI (to improve wear levelling) appears to be fine and has been studied when comparing various solutions, so this could perhaps be a workaround.

refs:

A.B
  • 31,762
  • 2
  • 62
  • 101
  • Thanks, very insightful. So the other option would be to turn off ACL support for systemd? – cajjed Mar 20 '19 at 14:05
  • probably. I didn't even know systemd had options to set acls – A.B Mar 20 '19 at 15:37
  • systemd-journald uses ACL entries to allow only read access, if compiled with the ACL option (which it most likely was; you can check with `systemd --version`). In the code this appears as HAVE_ACL e.g. https://github.com/systemd/systemd/blob/c6837e4e86d876cba3102ab1ba1e544237c3beb8/src/journal/journald-server.c#L249 called from functions opening, finding and rotating journals. It is logged as a warning, so setting `MaxLevelKMsg=err` in /etc/systemd/journald.conf and `systemctl restart systemd-journald` should silence it for the purpose of dmesg (obviously this may silence other warnings too). – GreenReaper Dec 16 '21 at 17:02