From: Amir Goldstein <amir73il@gmail.com>
To: Chengguang Xu <cgxu519@mykernel.net>
Cc: Miklos Szeredi <miklos@szeredi.hu>,
overlayfs <linux-unionfs@vger.kernel.org>,
Vivek Goyal <vgoyal@redhat.com>
Subject: Re: [RFC PATCH] ovl: keep some file attrubutions after copy-up
Date: Mon, 4 Jan 2021 11:01:04 +0200 [thread overview]
Message-ID: <CAOQ4uxh8DbdpDD6KUuEHaxHc3fGWgeSGdb8hXF45KKibyOf0Vw@mail.gmail.com> (raw)
In-Reply-To: <176cc2dcd40.107ad48cf41153.6757897875754439646@mykernel.net>
On Mon, Jan 4, 2021 at 8:55 AM Chengguang Xu <cgxu519@mykernel.net> wrote:
>
> ---- 在 星期一, 2021-01-04 13:04:56 Amir Goldstein <amir73il@gmail.com> 撰写 ----
> > On Sat, Dec 26, 2020 at 12:48 PM Chengguang Xu <cgxu519@mykernel.net> wrote:
> > >
> > > Currently after copy-up, upper file will lose most of file
> > > attributions except copy-up triggered by setting fsflags.
> > > Because ioctl operation of underlying file systems does not
> > > expect calling from kernel component, it seems hard to
> > > copy fsflags during copy-up.
> > >
> > > Overlayfs keeps limited attributions(append-only, etc) in it's
> > > inode flags after successfully updating attributions. so ater
> > > copy-up, lsattr(1) does not show correct result but overlayfs
> > > can still prohibit ramdom write for those files which originally
> > > have append-only attribution. However, recently I found this
> > > protection can be easily broken in below operations.
> > >
> > > 1, Set append attribution to lower file.
> > > 2, Mount overlayfs.
> > > 3, Trigger copy-up by data append.
> > > 4, Set noatime attributtion to the file.
> > > 5, The file is random writable.
> > >
> > > This patch tries to keep some file attributions after copy-up
> > > so that overlayfs keeps compatible behavior with local filesystem
> > > as much as possible.
> > >
> >
> > This approach seems quite wrong.
> > For one thing, mount cycle overlay or drop caches will result in loss
> > of append only flag after copy-up, so this is not a security fix.
> >
>
> You are right, I overlooked the case of dropping cache.
>
> > Second, Miklos has already proposed a much more profound change
> > to address this and similar issues [1] and he has already made some
> > changes to ioctl handler to master doesn't have ovl_iflags_to_fsflags().
> >
> > [1] https://lore.kernel.org/linux-fsdevel/20201123141207.GC327006@miu.piliscsaba.redhat.com/
> >
> > One more thing.
> > It seems like ovl_copyflags() in ovl_inode_init() would have been better
> > to copy from ovl_inode_realdata() inode instead of ovl_inode_real().
> > This way, copy up still loses the append-only flag, but metacopy up
> > does not. So at least for the common use case of containers that
> > chown -R won't cause losing all the file flags.
>
> IIUC, the flags will still keep in overlayfs' inode after copy up until
> the inode cleaned by dropping cache. So I think your suggestion will be
> helpful for the case of meta-copyup & dropping cache.
Yes, for the use case of chowning all files sure cannot rely on caches
and I believe those containers are also used as persistent containers
that can be mounted again later after initial ownership fix.
>
> Hi Miklos
>
> Is it worth to change like above?
>
I guess that depends what are the use cases that benefit.
After all it is not a security fix it just increases the amount of
use cases that preserve the append-only flag.
I *think* it could fix a lot of cases like:
chmod foo; drop_caches; touch foo # should fail
mv foo bar; drop_caches; touch bar # should fail
and in order to lose the append-only flag, users will need to
first open with O_APPEND, set noatime flag or some unusual
operations that do not happen by mistake as often as chmod,chown,rename.
>
> >
> > ovl_ioctl_set_flags() triggers data copy up, so that will break the link
> > to lower flags anyway.
>
> I think though ovl_ioctl_set_flags() triggers data copy up but the flags
> will be set correctly to upper file, because chattr(1) will get the flags
> first and set the whole flags(include original flags) to upper file.
>
Sure, unless the user is not privileged to set flags, but copy up will still
happen. But what I meant is if user changes the flags, data copy up
happens and ovl_copyflags() after drop caches will no longer copy the
lower flags.
Thanks,
Amir.
prev parent reply other threads:[~2021-01-04 9:01 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-26 10:46 [RFC PATCH] ovl: keep some file attrubutions after copy-up Chengguang Xu
2021-01-04 5:04 ` Amir Goldstein
2021-01-04 6:55 ` Chengguang Xu
2021-01-04 9:01 ` Amir Goldstein [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAOQ4uxh8DbdpDD6KUuEHaxHc3fGWgeSGdb8hXF45KKibyOf0Vw@mail.gmail.com \
--to=amir73il@gmail.com \
--cc=cgxu519@mykernel.net \
--cc=linux-unionfs@vger.kernel.org \
--cc=miklos@szeredi.hu \
--cc=vgoyal@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).