From: Randy Dunlap <rdunlap@infradead.org>
To: NeilBrown <neilb@suse.com>,
"J. Bruce Fields" <bfields@fieldses.org>,
Andreas Gruenbacher <agruenba@redhat.com>
Cc: "Miklos Szeredi" <miklos@szeredi.hu>,
"Andreas Grünbacher" <andreas.gruenbacher@gmail.com>,
"Patrick Plagwitz" <Patrick_Plagwitz@web.de>,
"linux-unionfs@vger.kernel.org" <linux-unionfs@vger.kernel.org>,
"Linux NFS list" <linux-nfs@vger.kernel.org>,
"Linux FS-devel Mailing List" <linux-fsdevel@vger.kernel.org>,
"Linux Kernel Mailing List" <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] OVL: add honoracl=off mount option.
Date: Wed, 1 May 2019 22:08:19 -0700 [thread overview]
Message-ID: <9ada42cb-8783-49bb-fd0d-31e7fb7dacf4@infradead.org> (raw)
In-Reply-To: <8736lx4goa.fsf@notabene.neil.brown.name>
Hi Neil,
On 5/1/19 9:35 PM, NeilBrown wrote:
>
> If the upper and lower layers use incompatible ACL formats, it is not
> possible to copy the ACL xttr from one to the other, so overlayfs
attr (?)
> cannot work with them.
> This happens particularly with NFSv4 which uses system.nfs4_acl, and
> ext4 which uses system.posix_acl_access.
>
> If all ACLs actually make to Unix permissions, then there is no need
map (?)
> to copy up the ACLs, but overlayfs cannot determine this.
>
> So allow the sysadmin it assert that ACLs are not needed with a mount
> option
> honoracl=off
> This causes the ACLs to not be copied, so filesystems with different
> ACL formats can be overlaid together.
>
> Signed-off-by: NeilBrown <neilb@suse.com>
> ---
> Documentation/filesystems/overlayfs.txt | 24 ++++++++++++++++++++++++
> fs/overlayfs/copy_up.c | 9 +++++++--
> fs/overlayfs/dir.c | 2 +-
> fs/overlayfs/overlayfs.h | 2 +-
> fs/overlayfs/ovl_entry.h | 1 +
> fs/overlayfs/super.c | 15 +++++++++++++++
> 6 files changed, 49 insertions(+), 4 deletions(-)
>
> diff --git a/Documentation/filesystems/overlayfs.txt b/Documentation/filesystems/overlayfs.txt
> index eef7d9d259e8..7ad675940c93 100644
> --- a/Documentation/filesystems/overlayfs.txt
> +++ b/Documentation/filesystems/overlayfs.txt
> @@ -245,6 +245,30 @@ filesystem - future operations on the file are barely noticed by the
> overlay filesystem (though an operation on the name of the file such as
> rename or unlink will of course be noticed and handled).
>
> +ACL copy-up
> +-----------
> +
> +When a file that only exists on the lower layer is modified it needs
> +to be copied up to the upper layer. This means copying the metadata
> +and (usually) the data (though see "Metadata only copy up" below).
> +One part of the metadata can be problematic: the ACLs.
> +
> +Now all filesystems support ACLs, and when they do they don't all use
Not
> +the same format. A significant conflict appears between POSIX acls
ACLs
> +used on many local filesystems, and NFSv4 ACLs used with NFSv4. There
These (or the)
> +two formats are, in general, not inter-convertible.
> +
> +If a site only uses regular Unix permissions (Read, Write, eXecute by
> +User, Group and Other), then as these permissions are compatible with
> +all ACLs, there is no need to copy ACLs. overlayfs cannot determine
> +if this is the case itself.
> +
> +For this reason, overlayfs supports a mount option "honoracl=off"
> +which causes ACLs, any "system." extended attribute, on the lower
> +layer to be ignored and, particularly, not copied to the upper later.
> +This allows NFSv4 to be overlaid with a local filesystem, but should
> +only be used if the only access controls used on the filesystem are
> +Unix permission bits.
>
> Multiple lower layers
> ---------------------
--
~Randy
next prev parent reply other threads:[~2019-05-02 5:08 UTC|newest]
Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <5a6862bd-924d-25e4-2a8e-ba4f51e66604@web.de>
2016-12-05 9:28 ` [PATCH] overlayfs: ignore empty NFSv4 ACLs in ext4 upperdir Miklos Szeredi
2016-12-05 15:19 ` J. Bruce Fields
2016-12-05 15:36 ` Miklos Szeredi
2016-12-05 16:25 ` J. Bruce Fields
2016-12-05 18:25 ` Patrick Plagwitz
2016-12-05 19:37 ` Andreas Grünbacher
2016-12-05 22:58 ` Patrick Plagwitz
2016-12-05 23:19 ` Andreas Grünbacher
2016-12-05 23:24 ` Andreas Grünbacher
2016-12-06 10:08 ` Miklos Szeredi
2016-12-06 13:18 ` Andreas Gruenbacher
2016-12-06 18:58 ` J. Bruce Fields
2019-05-02 2:02 ` NeilBrown
2019-05-02 2:54 ` Amir Goldstein
2019-05-02 3:57 ` NeilBrown
2019-05-02 14:04 ` Andreas Gruenbacher
2019-05-02 14:28 ` Miklos Szeredi
2019-05-02 15:08 ` Andreas Grünbacher
2019-05-02 17:16 ` J. Bruce Fields
2019-05-02 17:53 ` Andreas Gruenbacher
2019-05-02 23:04 ` NeilBrown
2019-05-02 23:24 ` NeilBrown
2019-05-03 6:54 ` Andreas Grünbacher
2019-05-02 17:26 ` Goetz, Patrick G
2019-05-02 17:44 ` Andreas Gruenbacher
2019-05-02 17:51 ` Goetz, Patrick G
2019-05-03 15:27 ` J. Bruce Fields
2019-05-03 17:39 ` Goetz, Patrick G
2019-05-02 4:35 ` [PATCH] OVL: add honoracl=off mount option NeilBrown
2019-05-02 5:08 ` Randy Dunlap [this message]
2019-05-02 11:46 ` Amir Goldstein
2019-05-02 23:19 ` NeilBrown
2019-05-02 13:47 ` J. R. Okajima
2019-05-03 15:35 ` [PATCH] overlayfs: ignore empty NFSv4 ACLs in ext4 upperdir J. Bruce Fields
2019-05-03 17:26 ` Amir Goldstein
2019-05-03 17:31 ` J. Bruce Fields
2019-05-03 17:41 ` Amir Goldstein
2019-05-03 17:51 ` Vivek Goyal
2019-05-07 0:24 ` NeilBrown
2019-05-10 20:09 ` J. Bruce Fields
2019-09-18 9:07 ` Miklos Szeredi
2019-09-18 19:49 ` J. Bruce Fields
2019-05-07 8:07 ` Miklos Szeredi
2019-05-07 23:51 ` J. Bruce Fields
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=9ada42cb-8783-49bb-fd0d-31e7fb7dacf4@infradead.org \
--to=rdunlap@infradead.org \
--cc=Patrick_Plagwitz@web.de \
--cc=agruenba@redhat.com \
--cc=andreas.gruenbacher@gmail.com \
--cc=bfields@fieldses.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-nfs@vger.kernel.org \
--cc=linux-unionfs@vger.kernel.org \
--cc=miklos@szeredi.hu \
--cc=neilb@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).