The mount grant

Why mount needs root#

On Linux, zfs allow delegates the dataset verbs to your user — create, destroy, rename, snapshot, rollback, the properties. Mount and unmount it cannot delegate: mounting a filesystem categorically belongs to root. So pālana splits the work along that exact line. Everything delegable runs as you. Two commands—zfs mount and zfs unmount—ask for sudo, and nothing else ever does.

The grant, exactly#

Mount and unmount, only. Never a blanket zfs. The string lives in one place in PalanaCore and is pinned by tests, so what the app shows you can never silently drift toward a wider grant than these two verbs.

You don't need to copy it from here—the same line, prefilled, lives in Settings › Workbench with a copy button, and in the refusal itself when a mount verb hits the wall.

Putting it in place#

Replace <user> with the login pālana connects as on that host—when your ssh config names a User for the alias, the in-app copy is already filled in. Check the path with which zfs: it's /sbin/zfs on some distros, and a sudoers command spec needs the absolute path. Add the line with visudo on the host, then reprobe the host in pālana—f, then r on its row. The verbs light up.

Why it never asks for a password#

pālana runs its two privileged commands as sudo -n—never prompt. The ssh channel it works over has no terminal for a prompt to appear on, and pālana holds no secrets and will not collect one. Passwordless isn't laxness here; there is no human at that end of the channel to type into.

Without the grant, the operation refuses and shows the required change:

mounting needs root on Linux—grant passwordless sudo for zfs, or use the shell
add to koan's sudoers (visudo), then reprobe:
<user> ALL=(root) NOPASSWD: /usr/sbin/zfs mount *, /usr/sbin/zfs unmount *
or mount from the shell—⌘` · full guide in Settings › Workbench

It's optional#

Grant nothing and pālana still does everything else—snapshot to rollback, create to destroy. It just won't offer mount and unmount on that host, and says why. When you do need to mount, ⌘` opens a real shell on the host and you do it your way, password and all.

The shape of the risk#

Weigh what the line actually grants: two verbs, arguments visible in every plan. That is far less than a blanket NOPASSWD: /usr/sbin/zfs, which would hand root's whole zfs surface to your login—a real escalation risk, and the reason pālana will never show you that line. Lock it down further if you like; sudoers command specs take narrower patterns than *. And the gate holds regardless: every mount and unmount pālana runs is a plan step you read before Enter—the grant enables the verbs, it never skips the reading.