Automatic mounting of /sys/kernel/debug

[Strahinja]

I recently noticed that df(1) complains about "Permission denied" on /sys/kernel/debug/tracing when ran as non-root on a recent Alpine Linux. Investigating this further led me to a RedHat bug report where Lennart Poettering tried to justify this by his opinion on what the users really need and want (typical). Quote:

mounts of optional API kernel virtual file systems

If they are optional, why mount them automatically anyway?

Is there a reason behind OpenRC doing this without making it optional?

Update 2023-09-20: Further investigation revealed that this only occurs if the service hwdrivers is added to a runlevel, usually sysinit. Still, it is counter-intuitive that a simple df would give errors at all, much less obscure ones such as this, unless it is executed as root.

[vapier]

the RH bug is about systemd setting up automounters. OpenRC doesn't do that. it just mounts debugfs. not exactly the same. OpenRC doesnt do anything with tracefs.

OpenRC has always mounted debugfs if it's enabled in the kernel (see Apr 2007 d2c112e). Linux used to mount with 0755 perms by default until linux-3.7 (commit 82aceae4f0d42f03d9ad7d1e90389e731153898f in Aug 2012) when it switched to 0700. so the behavior you describe wrt mounting certainly is nothing new, and basically no one is complaining. if you don't want it mounted at all, don't enable CONFIG_DEBUG_FS in your kernel.

the /sys/kernel/debug/tracing behavior is new and is a kernel thing with tracefs. i think they've been bouncing between /sys/kernel/tracing and /sys/kernel/debug/tracing. similarly, if you don't like that behavior, disable CONFIG_TRACING in your kernel.

[Strahinja]

Linux used to mount with 0755 perms by default until linux-3.7 (commit 82aceae4f0d42f03d9ad7d1e90389e731153898f in Aug 2012) when it switched to 0700.

Interesting. In any case, I found out what is causing this in Alpine Linux. On my two computers, one had Alpine installed automatically using the entire disk, while on the other I installed it alongside other OSes. The non-whole-disk installation added the hwdrivers service to sysinit runlevel. When active, that service causes df to output the error.

Thus, the workaround is to not have hwdrivers active in a runlevel.