s3fs public-read-write (1.74+) vs allow_other (v1.61)

2
votes

I've been using S3FS for a while now (since 2010+) and got stuck at v1.61 due to how I needed to use the "allow all users to read/write". I am using it as a "global file share" (SAN) and mount (/etc/fstab) the same 3 buckets on 10+ servers. Different services (users) read/write from it, primarily Nginx/PHP-FPM (www-data with uid=33/gid=33) but also automysqlbackup and git so it was convenient to use have "public-read-write" access to the mount point(s)

What I am trying to do is upgrade to the latest 1.74 version (due to memory spikes on DO VPS, s3fs is taking up 480Mb of the 500Mb memory) but having problems with the file permissions. I am also finding out that any writes (directories and files) from 1.74 mounts does not show up on the 1.61 mounts so I have to upgrade the servers all at once (which is fine)

v1.61 /etc/fstab config (one of the mounts)

s3fs#s3fs-db.example.com /mnt/s3fs-db fuse use_cache=/tmp,allow_other 0 0

v1.74+ /etc/fstab config

s3fs#s3fs-db.example.com /mnt/s3fs-db fuse use_cache=/tmp,allow_other,default_acl=public-read-write,url=https://aws.amazon.com 0 0

Note: no uid= and no gid= yet

When the 1.74+ mounts the directories, the permissions are drwxr-x-r-x which when mounted as root (/etc/fstab) makes the www-data user not be able to write to it.

Questions:

  • Is there a way to emulate the functionality of 1.61 on the 1.74+ version ... I can't seem to figure out how to get the correct settings. default_acl=public-read-write seems to be the correct way.
  • Should I use the uid= and gid= and then do a chmod -R 777 on ALL the mount points after I mount them? I was expecting the /etc/fstab to do this for me
  • Should I be looking at s3ql or s3backer or riofs for what I am doing (SAN-ish)?

Other notes:

Thanks, Chris

1
s3fs

1 Answers

0
votes

There are several different permissions at play here:

  • -o default_acl controls the access control from the S3 server. Setting this to public-read-write would allow non-s3fs tools to read and write to the object.
  • -o umask allows setting the mask for the objects within the mountpoint
  • -o mp_umask allows setting the mask for the mountpoint directory
  • -o allow_other allows the non-mounting user to access the mount path, but not the objects underneath

If you set -o umask=0022 this will allow other users to read files but not write to them.