On Tue 25 Jan 2022, at 13:11, Greg Wooledge <g...@wooledge.org> wrote: > On Tue, Jan 25, 2022 at 01:06:42PM +0000, Gareth Evans wrote: >> Just realised I gave contradicting info earlier - I said both that I >> upgraded from Buster (which is literally true) and that >> >> "But for root on ZFS per >> >> https://openzfs.github.io/openzfs-docs/Getting%20Started/Debian/Debian%20Buster%20Root%20on%20ZFS.html >> (adjusted for Bullseye) <<<<<< >> >> ..." >> >> which isn't, because Bullseye arrived via dist-upgrade, rather than a fresh >> installation. >> >> My mistake may have prompted Andrei's suggestion which I then explained away >> partly in relation to having upgraded - sorry. > > I don't know anything about ZFS. That said, it's *conceivable* that > your / ownership has been broken this entire time, and you never noticed > until now. Either because you never ran "who", or because
> systemd in > buster didn't check the parent directory ownerships, but the one in > bullseye does. That's interesting. FWIW, trying to get a timeframe... My email re bullseye upgrade hiccups back in August https://lists.debian.org/debian-user/2021/08/msg00979.html indicates that I upgraded to Bullseye on 17th Aug 2021. There were at most a few days of experimenting with restoring Buster snapshots and re-upgrading, but that was certainly done with by October, when QEMU logs show VM usage. I've never had to modprobe tun to start a VM before today, and Bash history shows who usage on 22/12/21. Given this info and that the / ownership fix fixed both problems, I think that suggests a recent(ish) event as the cause. > > Food for thought. > > (It's not clear to me how setting up ZFS on / would involve your > unprivileged username, though. Sounds more like a "boot from rescue > media and do everything in a root shell" sort of job. It is, but... "5. Create a user account: username=YOUR_USERNAME zfs create rpool/home/$username adduser $username cp -a /etc/skel/. /home/$username chown -R $username:$username /home/$username ..." https://openzfs.github.io/openzfs-docs/Getting%20Started/Debian/Debian%20Buster%20Root%20on%20ZFS.html :) > So I'm more > inclined to think the damage was done by some sort of backup/recovery > gone wrong, as previously speculated.)
