Fuidshift refusing to shift files

LXD
1

this is a continuation of

which got closed accidentally

Now I have managed to reproduce it with fuidshift, it seems like multiple (more than one?) additional groups bother fuidshift:

this fails:

:; mkdir -p /tmp/testfile
:; cat<<EOF|setfacl --restore=-
# file: /tmp/rootfs/testdir
# owner: 1000000
# group: 1000190
# flags: -s-
user::rwx
group::r-x
group:0:r-x
group:1000004:r-x
mask::r-x
other::r-x
default:user::rwx
default:group::r-x
default:group:0:r-x
default:group:1000004:r-x
default:mask::r-x
default:other::r-x
EOF
:;go/bin/fuidshift /tmp b:1000000:0:65536
Error: invalid argument - Failed to change ACLs on /tmp/rootfs/testdir


but as soon as I remove extra group it works

:; cat<<EOF|setfacl --restore=-
# file: /tmp/rootfs/testdir
# owner: 1000000
# group: 1000190
# flags: -s-
user::rwx
group::r-x
group:1000004:r-x
mask::r-x
other::r-x
default:user::rwx
default:group::r-x
default:group:1000004:r-x
default:mask::r-x
default:other::r-x
EOF
:; go/bin/fuidshift /tmp b:1000000:0:65536
2

@tomp This feels awfully similar to what I ran into while trying to get container root disk attachment to work. IIRC systemd applied an ACL like this somewhere in /var.

3

yes, this one is actually from journald from /var/log/journal or wherever you like your journals, but there are also others, e.g.

~ getfacl /var/lib/tpm2-tss/system/keystore
getfacl: Removing leading ‘/’ from absolute path names

file: var/lib/tpm2-tss/system/keystore

owner: tss

group: tss

flags: -s-

user::rwx
group::rwx
other::r-x
default:user::rwx
default:group::rwx
default:group:tss:rwx
default:mask::rwx
default:other::r-x