1. 28 1月, 2021 1 次提交
  2. 14 12月, 2020 1 次提交
  3. 12 11月, 2020 2 次提交
    • P
      ovl: introduce new "uuid=off" option for inodes index feature · 5830fb6b
      Pavel Tikhomirov 提交于
      This replaces uuid with null in overlayfs file handles and thus relaxes
      uuid checks for overlay index feature. It is only possible in case there is
      only one filesystem for all the work/upper/lower directories and bare file
      handles from this backing filesystem are unique. In other case when we have
      multiple filesystems lets just fallback to "uuid=on" which is and
      equivalent of how it worked before with all uuid checks.
      
      This is needed when overlayfs is/was mounted in a container with index
      enabled (e.g.: to be able to resolve inotify watch file handles on it to
      paths in CRIU), and this container is copied and started alongside with the
      original one. This way the "copy" container can't have the same uuid on the
      superblock and mounting the overlayfs from it later would fail.
      
      That is an example of the problem on top of loop+ext4:
      
      dd if=/dev/zero of=loopbackfile.img bs=100M count=10
      losetup -fP loopbackfile.img
      losetup -a
        #/dev/loop0: [64768]:35 (/loop-test/loopbackfile.img)
      mkfs.ext4 loopbackfile.img
      mkdir loop-mp
      mount -o loop /dev/loop0 loop-mp
      mkdir loop-mp/{lower,upper,work,merged}
      mount -t overlay overlay -oindex=on,lowerdir=loop-mp/lower,\
      upperdir=loop-mp/upper,workdir=loop-mp/work loop-mp/merged
      umount loop-mp/merged
      umount loop-mp
      e2fsck -f /dev/loop0
      tune2fs -U random /dev/loop0
      
      mount -o loop /dev/loop0 loop-mp
      mount -t overlay overlay -oindex=on,lowerdir=loop-mp/lower,\
      upperdir=loop-mp/upper,workdir=loop-mp/work loop-mp/merged
        #mount: /loop-test/loop-mp/merged:
        #mount(2) system call failed: Stale file handle.
      
      If you just change the uuid of the backing filesystem, overlay is not
      mounting any more. In Virtuozzo we copy container disks (ploops) when
      create the copy of container and we require fs uuid to be unique for a new
      container.
      Signed-off-by: NPavel Tikhomirov <ptikhomirov@virtuozzo.com>
      Reviewed-by: NAmir Goldstein <amir73il@gmail.com>
      Signed-off-by: NMiklos Szeredi <mszeredi@redhat.com>
      5830fb6b
    • P
      ovl: propagate ovl_fs to ovl_decode_real_fh and ovl_encode_real_fh · 1cdb0cb6
      Pavel Tikhomirov 提交于
      This will be used in next patch to be able to change uuid checks and add
      uuid nullification based on ofs->config.index for a new "uuid=off" mode.
      Reviewed-by: NAmir Goldstein <amir73il@gmail.com>
      Signed-off-by: NPavel Tikhomirov <ptikhomirov@virtuozzo.com>
      Signed-off-by: NMiklos Szeredi <mszeredi@redhat.com>
      1cdb0cb6
  4. 02 9月, 2020 6 次提交
    • M
      ovl: pass ovl_fs down to functions accessing private xattrs · 610afc0b
      Miklos Szeredi 提交于
      This paves the way for optionally using the "user.overlay." xattr
      namespace.
      Signed-off-by: NMiklos Szeredi <mszeredi@redhat.com>
      610afc0b
    • M
      ovl: drop flags argument from ovl_do_setxattr() · 26150ab5
      Miklos Szeredi 提交于
      All callers pass zero flags to ovl_do_setxattr().  So drop this argument.
      Signed-off-by: NMiklos Szeredi <mszeredi@redhat.com>
      26150ab5
    • M
      ovl: adhere to the vfs_ vs. ovl_do_ conventions for xattrs · 71097047
      Miklos Szeredi 提交于
      Call ovl_do_*xattr() when accessing an overlay private xattr, vfs_*xattr()
      otherwise.
      
      This has an effect on debug output, which is made more consistent by this
      patch.
      Signed-off-by: NMiklos Szeredi <mszeredi@redhat.com>
      71097047
    • M
      ovl: clean up ovl_getxattr() in copy_up.c · de7a52c9
      Miklos Szeredi 提交于
      Lose the padding and the failure message (in line with other parts of the
      copy up process).  Return zero for both nonexistent or empty xattr.
      Signed-off-by: NMiklos Szeredi <mszeredi@redhat.com>
      de7a52c9
    • M
      duplicate ovl_getxattr() · fee0f298
      Miklos Szeredi 提交于
      ovl_getattr() returns the value of an xattr in a kmalloced buffer.  There
      are two callers:
      
       ovl_copy_up_meta_inode_data()	(copy_up.c)
       ovl_get_redirect_xattr()	(util.c)
      
      This patch just copies ovl_getxattr() to copy_up.c, the following patches
      will deal with the differences in idividual callers.
      Signed-off-by: NMiklos Szeredi <mszeredi@redhat.com>
      fee0f298
    • V
      ovl: provide a mount option "volatile" · c86243b0
      Vivek Goyal 提交于
      Container folks are complaining that dnf/yum issues too many sync while
      installing packages and this slows down the image build. Build requirement
      is such that they don't care if a node goes down while build was still
      going on. In that case, they will simply throw away unfinished layer and
      start new build. So they don't care about syncing intermediate state to the
      disk and hence don't want to pay the price associated with sync.
      
      So they are asking for mount options where they can disable sync on overlay
      mount point.
      
      They primarily seem to have two use cases.
      
      - For building images, they will mount overlay with nosync and then sync
        upper layer after unmounting overlay and reuse upper as lower for next
        layer.
      
      - For running containers, they don't seem to care about syncing upper layer
        because if node goes down, they will simply throw away upper layer and
        create a fresh one.
      
      So this patch provides a mount option "volatile" which disables all forms
      of sync. Now it is caller's responsibility to throw away upper if system
      crashes or shuts down and start fresh.
      
      With "volatile", I am seeing roughly 20% speed up in my VM where I am just
      installing emacs in an image. Installation time drops from 31 seconds to 25
      seconds when nosync option is used. This is for the case of building on top
      of an image where all packages are already cached. That way I take out the
      network operations latency out of the measurement.
      
      Giuseppe is also looking to cut down on number of iops done on the disk. He
      is complaining that often in cloud their VMs are throttled if they cross
      the limit. This option can help them where they reduce number of iops (by
      cutting down on frequent sync and writebacks).
      Signed-off-by: NGiuseppe Scrivano <gscrivan@redhat.com>
      Signed-off-by: NVivek Goyal <vgoyal@redhat.com>
      Signed-off-by: NMiklos Szeredi <mszeredi@redhat.com>
      c86243b0
  5. 17 7月, 2020 1 次提交
  6. 16 7月, 2020 1 次提交
  7. 04 6月, 2020 1 次提交
  8. 13 5月, 2020 1 次提交
  9. 17 3月, 2020 1 次提交
    • M
      ovl: ignore failure to copy up unknown xattrs · c61ca557
      Miklos Szeredi 提交于
      This issue came up with NFSv4 as the lower layer, which generates
      "system.nfs4_acl" xattrs (even for plain old unix permissions).  Prior to
      this patch this prevented copy-up from succeeding.
      
      The overlayfs permission model mandates that permissions are checked
      locally for the task and remotely for the mounter(*).  NFS4 ACLs are not
      supported by the Linux kernel currently, hence they cannot be enforced
      locally.  Which means it is indifferent whether this attribute is copied or
      not.
      
      Generalize this to any xattr that is not used in access checking (i.e. it's
      not a POSIX ACL and not in the "security." namespace).
      
      Incidentally, best effort copying of xattrs seems to also be the behavior
      of "cp -a", which is what overlayfs tries to mimic.
      
      (*) Documentation/filesystems/overlayfs.txt#Permission model
      Signed-off-by: NMiklos Szeredi <mszeredi@redhat.com>
      c61ca557
  10. 23 1月, 2020 2 次提交
  11. 10 12月, 2019 2 次提交
  12. 19 6月, 2019 1 次提交
  13. 18 6月, 2019 1 次提交
    • N
      ovl: fix typo in MODULE_PARM_DESC · 253e7483
      Nicolas Schier 提交于
      Change first argument to MODULE_PARM_DESC() calls, that each of them
      matched the actual module parameter name.  The matching results in
      changing (the 'parm' section from) the output of `modinfo overlay` from:
      
          parm: ovl_check_copy_up:Obsolete; does nothing
          parm: redirect_max:ushort
          parm: ovl_redirect_max:Maximum length of absolute redirect xattr value
          parm: redirect_dir:bool
          parm: ovl_redirect_dir_def:Default to on or off for the redirect_dir feature
          parm: redirect_always_follow:bool
          parm: ovl_redirect_always_follow:Follow redirects even if redirect_dir feature is turned off
          parm: index:bool
          parm: ovl_index_def:Default to on or off for the inodes index feature
          parm: nfs_export:bool
          parm: ovl_nfs_export_def:Default to on or off for the NFS export feature
          parm: xino_auto:bool
          parm: ovl_xino_auto_def:Auto enable xino feature
          parm: metacopy:bool
          parm: ovl_metacopy_def:Default to on or off for the metadata only copy up feature
      
      into:
      
          parm: check_copy_up:Obsolete; does nothing
          parm: redirect_max:Maximum length of absolute redirect xattr value (ushort)
          parm: redirect_dir:Default to on or off for the redirect_dir feature (bool)
          parm: redirect_always_follow:Follow redirects even if redirect_dir feature is turned off (bool)
          parm: index:Default to on or off for the inodes index feature (bool)
          parm: nfs_export:Default to on or off for the NFS export feature (bool)
          parm: xino_auto:Auto enable xino feature (bool)
          parm: metacopy:Default to on or off for the metadata only copy up feature (bool)
      Signed-off-by: NNicolas Schier <n.schier@avm.de>
      Signed-off-by: NMiklos Szeredi <mszeredi@redhat.com>
      253e7483
  14. 06 5月, 2019 1 次提交
    • A
      ovl: fix missing upper fs freeze protection on copy up for ioctl · 3428030d
      Amir Goldstein 提交于
      Generalize the helper ovl_open_maybe_copy_up() and use it to copy up file
      with data before FS_IOC_SETFLAGS ioctl.
      
      The FS_IOC_SETFLAGS ioctl is a bit of an odd ball in vfs, which probably
      caused the confusion.  File may be open O_RDONLY, but ioctl modifies the
      file.  VFS does not call mnt_want_write_file() nor lock inode mutex, but
      fs-specific code for FS_IOC_SETFLAGS does.  So ovl_ioctl() calls
      mnt_want_write_file() for the overlay file, and fs-specific code calls
      mnt_want_write_file() for upper fs file, but there was no call for
      ovl_want_write() for copy up duration which prevents overlayfs from copying
      up on a frozen upper fs.
      
      Fixes: dab5ca8f ("ovl: add lsattr/chattr support")
      Cc: <stable@vger.kernel.org> # v4.19
      Signed-off-by: NAmir Goldstein <amir73il@gmail.com>
      Acked-by: NVivek Goyal <vgoyal@redhat.com>
      Signed-off-by: NMiklos Szeredi <mszeredi@redhat.com>
      3428030d
  15. 13 2月, 2019 1 次提交
  16. 04 2月, 2019 1 次提交
    • V
      ovl: During copy up, first copy up data and then xattrs · 5f32879e
      Vivek Goyal 提交于
      If a file with capability set (and hence security.capability xattr) is
      written kernel clears security.capability xattr. For overlay, during file
      copy up if xattrs are copied up first and then data is, copied up. This
      means data copy up will result in clearing of security.capability xattr
      file on lower has. And this can result into surprises. If a lower file has
      CAP_SETUID, then it should not be cleared over copy up (if nothing was
      actually written to file).
      
      This also creates problems with chown logic where it first copies up file
      and then tries to clear setuid bit. But by that time security.capability
      xattr is already gone (due to data copy up), and caller gets -ENODATA.
      This has been reported by Giuseppe here.
      
      https://github.com/containers/libpod/issues/2015#issuecomment-447824842
      
      Fix this by copying up data first and then metadta. This is a regression
      which has been introduced by my commit as part of metadata only copy up
      patches.
      
      TODO: There will be some corner cases where a file is copied up metadata
      only and later data copy up happens and that will clear security.capability
      xattr. Something needs to be done about that too.
      
      Fixes: bd64e575 ("ovl: During copy up, first copy up metadata and then data")
      Cc: <stable@vger.kernel.org> # v4.19+
      Reported-by: NGiuseppe Scrivano <gscrivan@redhat.com>
      Signed-off-by: NVivek Goyal <vgoyal@redhat.com>
      Signed-off-by: NMiklos Szeredi <mszeredi@redhat.com>
      5f32879e
  17. 30 10月, 2018 2 次提交
  18. 27 10月, 2018 3 次提交
  19. 24 9月, 2018 1 次提交
    • A
      vfs: swap names of {do,vfs}_clone_file_range() · a725356b
      Amir Goldstein 提交于
      Commit 031a072a ("vfs: call vfs_clone_file_range() under freeze
      protection") created a wrapper do_clone_file_range() around
      vfs_clone_file_range() moving the freeze protection to former, so
      overlayfs could call the latter.
      
      The more common vfs practice is to call do_xxx helpers from vfs_xxx
      helpers, where freeze protecction is taken in the vfs_xxx helper, so
      this anomality could be a source of confusion.
      
      It seems that commit 8ede2055 ("ovl: add reflink/copyfile/dedup
      support") may have fallen a victim to this confusion -
      ovl_clone_file_range() calls the vfs_clone_file_range() helper in the
      hope of getting freeze protection on upper fs, but in fact results in
      overlayfs allowing to bypass upper fs freeze protection.
      
      Swap the names of the two helpers to conform to common vfs practice
      and call the correct helpers from overlayfs and nfsd.
      Signed-off-by: NAmir Goldstein <amir73il@gmail.com>
      Signed-off-by: NMiklos Szeredi <mszeredi@redhat.com>
      a725356b
  20. 20 7月, 2018 8 次提交
  21. 18 7月, 2018 1 次提交
  22. 31 5月, 2018 1 次提交