0

I wanted to copy .ssh folder from my old computer to a new machine. So on my new ubuntu I mounted my APFS drive (just read-only support) and did:

➜  adam_old ls -ld .ssh
drwx------ 1 501 dialout 6 dub  3 13:16 .ssh

➜  adam_old sudo cp -vr .ssh ~/.ssh    
cp: cannot stat '.ssh': Permission denied

and got permission denied for root. But when i removed sudo:

➜  adam_old cp -vr .ssh ~/.ssh 
'.ssh/known_hosts' -> '/home/adam/.ssh/.ssh/known_hosts'
'.ssh/pi@hrasp_id_rsa' -> '/home/adam/.ssh/.ssh/pi@hrasp_id_rsa'
'.ssh/pi@hrasp_id_rsa.pub' -> '/home/adam/.ssh/.ssh/pi@hrasp_id_rsa.pub'
'.ssh/config' -> '/home/adam/.ssh/.ssh/config'
'.ssh/pi@rasp_id_rsa' -> '/home/adam/.ssh/.ssh/pi@rasp_id_rsa'
'.ssh/pi@rasp_id_rsa.pub' -> '/home/adam/.ssh/.ssh/pi@rasp_id_rsa.pub'

It worked. I don't get it (I thought root has access to everything).

Has it something to do with the old drive was also a unix system with its own permissions? (We can see user 501 and group dialout as owners of .ssh in the first snippet.)

So I checked groups to which root and my account 'adam' belong, and their IDs:

➜  adam_old cat /etc/group | grep dialout 
dialout:x:20:

➜  adam_old cat /etc/passwd | grep -E '^(root|adam)'
root:x:0:0:root:/root:/bin/bash
adam:x:1000:1000:Adam,,,:/home/adam:/usr/bin/zsh

(groups 0 is group 'root' and group 1000 is group 'adam')

still I have no idea why it didn't work for root, but did for 'adam'.

EDIT: Found out that I actually copied old drive's ~/.ssh to new drive's ~/.ssh/.ssh (but that doesn't matter for the question).

Adam
  • 211
  • 1
  • 11
  • Is it mounted using some FUSE-based filesystem? – muru Aug 05 '19 at 15:35
  • Maybe because there was no '.ssh' dir in '/root' ? – markgraf Aug 05 '19 at 15:35
  • @muru yes: https://github.com/sgan81/apfs-fuse – Adam Aug 05 '19 at 15:36
  • Does `sudo ls -ld .ssh ~/.ssh` show the same error? – Mark Plotnick Aug 05 '19 at 15:36
  • IIRC some FUSE mounts can restrict access from users other than the one who mounted it. – muru Aug 05 '19 at 15:38
  • @markgraf I clarified the question. I meant ~/.ssh on both systems, I used a stupid shorthand to mark which drive it came from. – Adam Aug 05 '19 at 15:39
  • @MarkPlotnick yes, for .ssh (apfs drive) – Adam Aug 05 '19 at 15:41
  • @muru It's the dupe, I tried `apfs-fuse` with `-o allow_root` and it worked. So the world of mounted filesystems is strange. Also – why would allow_root not be standard? Is it somehow protecting users from administrators? What if an administrator compiles his own "FUSE" with allow_root by default. – Adam Aug 05 '19 at 15:58
  • It might make sense of you think of it as running a program rather than accessing a file - there are several cases where programs aren't safe to run as root, the possibilities of exploits and such being too many. – muru Aug 05 '19 at 16:09

0 Answers0