kernel-packages team mailing list archive

[Serge Hallyn <1531747@xxxxxxxxxxxxxxxxxx>]

Ok, I see.  At one point we had a special case to allow the overlay code
to write trusted.* xattrs for creating whiteouts.

However that is gone.  Therefore when overlayfs v1 (mount -t overlayfs)
is mounted, root in a user namespace also is not able to rm a file which
exists in the lower fs.

Some ways to fix this:

1. Add a special case in fs/xattr.c to allow the overlay code to create the trusted.overlay xattrs
2. In ovl_create_or_link(), target the override cred at init_user_ns.  Since we don't do that, the capabilities we are adding do not grant "capable(CAP_SYS_ADMIN)", only ns_capable.
3. Find another way to do this without requiring the trusted.overlay xattr.  It isn't needed for files so I don't know what the complications are, which require it to be done for directories.

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1531747

Title:
  overlay: mkdir fails if directory exists in lowerdir in a user
  namespace

Status in linux package in Ubuntu:
  Triaged
Status in linux source package in Wily:
  Triaged
Status in linux source package in Xenial:
  Triaged

Bug description:
  If a directory exists in the lowerdir but not in the mounted
  overlay, then mkdir of the directory in the target dir results
  in a mysterious -EPERM.  I've seen this both in wily kernel
  (4.2.0-22-generic #27-Ubuntu) and in a hand-built xenial
  master-next (with unrelated patches added).

  =====================================================
  #!/bin/sh -ex
  dir=`mktemp -d`
  cleanup() {
   umount -l $dir/t
   rm -rf $dir
  }

  trap cleanup EXIT

  echo "dir is $dir"
  mkdir -p $dir/l $dir/u $dir/w $dir/t
  mkdir $dir/l/dev
  mount -t overlay -o lowerdir=$dir/l,upperdir=$dir/u,workdir=$dir/w o $dir/t
  stat $dir/t/dev
  rmdir $dir/t/dev
  mkdir $dir/t/dev
  echo $?
  echo "mkdir should have succeeded"
  =====================================================

  The above will work on the host, but fail in a user namespace, i.e
  in a regular lxd container.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1531747/+subscriptions