From: "J. Bruce Fields" <bfields@fieldses.org>
To: Miklos Szeredi <miklos@szeredi.hu>
Cc: Patrick Plagwitz <Patrick_Plagwitz@web.de>,
"linux-unionfs@vger.kernel.org" <linux-unionfs@vger.kernel.org>,
Linux NFS list <linux-nfs@vger.kernel.org>,
linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
Andreas Gruenbacher <agruenba@redhat.com>
Subject: Re: [PATCH] overlayfs: ignore empty NFSv4 ACLs in ext4 upperdir
Date: Mon, 5 Dec 2016 10:19:33 -0500 [thread overview]
Message-ID: <20161205151933.GA17517@fieldses.org> (raw)
In-Reply-To: <CAJfpeguwUtRWRGmNmimNp-FXzWqMCCQMb24iWPu0w_J0_rOnnw@mail.gmail.com>
On Mon, Dec 05, 2016 at 10:28:18AM +0100, Miklos Szeredi wrote:
> [Added a few more CCs]
>
> On Mon, Dec 5, 2016 at 1:51 AM, Patrick Plagwitz
> <Patrick_Plagwitz@web.de> wrote:
> > Mounting an overlayfs with an NFSv4 lowerdir and an ext4 upperdir causes copy_up operations, specifically the function copy_up.c:ovl_copy_xattr, to fail with EOPNOTSUPP.
> > For example, having the following folders:
> >
> > |- nfs <- NFSv4 is mounted here
> > |--|- folder
> > |- root <- ext4 is mounted here
> > |- work <- also ext4
> > |- merged <- overlay is mounted here with
> > lowerdir=nfs,upperdir=root,workdir=work
> >
> > And calling
> > # touch merged/folder/file
> > will print
> > touch: cannot touch 'merged/folder/file': Operation not supported
> >
> > This is because NFS returns the xattr system.nfs4_acl with an empty value even if no NFS ACLs are in use in the lower filesystem. Trying to set this xattr in the upperdir
> > fails because ext4 does not support it.
> >
> > Fix this by explicitly checking for the name of the xattr and an empty value and ignoring EOPNOTSUPP if both things match.
> >
> > Signed-off-by: Patrick Plagwitz <patrick_plagwitz@web.de>
> > ---
> > Maybe NFS could be changed to not return empty system.nfs4_acl values, I don't know. In any case, to support upperdir ext4 + lowerdir NFSv4, returning the error code from
> > vfs_setxattr with this xattr name must be avoided as long as the value is empty.
> >
> > diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
> > index 36795ee..505b86e 100644
> > --- a/fs/overlayfs/copy_up.c
> > +++ b/fs/overlayfs/copy_up.c
> > @@ -123,6 +123,9 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new)
> > continue; /* Discard */
> > }
> > error = vfs_setxattr(new, name, value, size, 0);
> > + if (error == -EOPNOTSUPP && *value == '\0' &&
> > + strcmp(name, "system.nfs4_acl") == 0)
> > + error = 0;
> > if (error)
> > break;
> > }
>
> I agree that this should be fixed, but adding such exceptions for
> certain filesystems or xattrs is not the proper way, IMO.
>
> Can NFS people comment on this? Where does the nfs4_acl come from?
This is the interface the NFS client provides for applications to modify
NFSv4 ACLs on servers that support them.
> What can overlayfs do if it's a non-empty ACL?
As little as possible. You can't copy it up, can you? So any attempt
to support it is going to be incomplete.
> Does knfsd translate posix ACL into NFS acl? If so, we can translate
> back. Should we do a generic POSIX<->NFS acl translator?
knsd does translate between POSIX and NFSv4 ACLs. It's a complicated
algorithm, and lossy (in the NFSv4->POSIX direction). The client
developers have been understandably reluctant to have anything to do
with it.
So, I think listxattr should omit system.nfs4_acl, and attempts to
set/get the attribute should error out. The same should apply to any
"system." attribute not supported by both filesystems, I think?
I don't understand overlayfs very well, though.
--b.
next prev parent reply other threads:[~2016-12-05 15:20 UTC|newest]
Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <5a6862bd-924d-25e4-2a8e-ba4f51e66604@web.de>
2016-12-05 9:28 ` [PATCH] overlayfs: ignore empty NFSv4 ACLs in ext4 upperdir Miklos Szeredi
2016-12-05 15:19 ` J. Bruce Fields [this message]
2016-12-05 15:36 ` Miklos Szeredi
2016-12-05 16:25 ` J. Bruce Fields
2016-12-05 18:25 ` Patrick Plagwitz
2016-12-05 19:37 ` Andreas Grünbacher
2016-12-05 22:58 ` Patrick Plagwitz
2016-12-05 23:19 ` Andreas Grünbacher
2016-12-05 23:24 ` Andreas Grünbacher
2016-12-06 10:08 ` Miklos Szeredi
2016-12-06 13:18 ` Andreas Gruenbacher
2016-12-06 18:58 ` J. Bruce Fields
2019-05-02 2:02 ` NeilBrown
2019-05-02 2:54 ` Amir Goldstein
2019-05-02 3:57 ` NeilBrown
2019-05-02 14:04 ` Andreas Gruenbacher
2019-05-02 14:28 ` Miklos Szeredi
2019-05-02 15:08 ` Andreas Grünbacher
2019-05-02 17:16 ` J. Bruce Fields
2019-05-02 17:53 ` Andreas Gruenbacher
2019-05-02 23:04 ` NeilBrown
2019-05-02 23:24 ` NeilBrown
2019-05-03 6:54 ` Andreas Grünbacher
2019-05-02 17:26 ` Goetz, Patrick G
2019-05-02 17:44 ` Andreas Gruenbacher
2019-05-02 17:51 ` Goetz, Patrick G
2019-05-03 15:27 ` J. Bruce Fields
2019-05-03 17:39 ` Goetz, Patrick G
2019-05-02 4:35 ` [PATCH] OVL: add honoracl=off mount option NeilBrown
2019-05-02 5:08 ` Randy Dunlap
2019-05-02 11:46 ` Amir Goldstein
2019-05-02 23:19 ` NeilBrown
2019-05-02 13:47 ` J. R. Okajima
2019-05-03 15:35 ` [PATCH] overlayfs: ignore empty NFSv4 ACLs in ext4 upperdir J. Bruce Fields
2019-05-03 17:26 ` Amir Goldstein
2019-05-03 17:31 ` J. Bruce Fields
2019-05-03 17:41 ` Amir Goldstein
2019-05-03 17:51 ` Vivek Goyal
2019-05-07 0:24 ` NeilBrown
2019-05-10 20:09 ` J. Bruce Fields
2019-09-18 9:07 ` Miklos Szeredi
2019-09-18 19:49 ` J. Bruce Fields
2019-05-07 8:07 ` Miklos Szeredi
2019-05-07 23:51 ` J. Bruce Fields
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161205151933.GA17517@fieldses.org \
--to=bfields@fieldses.org \
--cc=Patrick_Plagwitz@web.de \
--cc=agruenba@redhat.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-nfs@vger.kernel.org \
--cc=linux-unionfs@vger.kernel.org \
--cc=miklos@szeredi.hu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).