# Does mount --bind allow different permissions?

## StormShaman

I'm trying to set up incremental back-ups as described by Mike Rubel.  He mentions that the best way to make the snapshots editable by root but not by others would be to mount the snapshots directory at /root/snapshots (editable by root) and at /snapshots (read-only) using mount --bind.  At the time he wrote the article, mount --bind had a bug that caused all mount points to have the same permissions as the last-created mount point.  Has this been fixed?

----------

## desultory

Not yet, but the work is in progress.

----------

## StormShaman

Mr. Ruben ended up using NFS locally instead of mount --bind.  He said he read that this is insecure, but he didn't understand why.  Is this something about which I should worry?

----------

## desultory

If the only thing you are doing with NFS is mounting it in a loopback configuration, consider having NFS listen to requests on 127.0.0.1 exclusively, also consider having iptables DENY or DROP any connections to NFS related ports from external IP addresses. If you do that, NFS should not be a cause for concern.

In any case, why not simply set permissions along the lines of 0644, instead of bothering with NFS?

----------

## StormShaman

 *desultory wrote:*   

> In any case, why not simply set permissions along the lines of 0644, instead of bothering with NFS?

 

I don't know why the author didn't do it, and I was just following his instructions.  You can do that to a mounted drive to make its contents read-write for root and read-only for everyone else?

----------

## desultory

 *StormShaman wrote:*   

> I don't know why the author didn't do it, and I was just following his instructions.

 

The reason was probably preservation of permissions.

 *StormShaman wrote:*   

> You can do that to a mounted drive to make its contents read-write for root and read-only for everyone else?

 

If the underlying filesystem supports unix style permissions, or has a veneer in place which does, then I can and so can you.

----------

