Re: [vserver] Issue with OverlayFS in 3.18

From: Herbert Poetzl <herbert_at_13thfloor.at>
Date: Sun 22 Feb 2015 - 16:01:07 GMT
Message-ID: <20150222160107.GC21728@MAIL.13thfloor.at>

On Sun, Feb 22, 2015 at 04:50:00PM +0100, Oliver Welter wrote:
> Am 22.02.2015 um 15:50 schrieb Oliver Welter:
>> Hi Bertl,

>> Am 02.02.2015 um 11:11 schrieb Herbert Poetzl:
>>> On Mon, Feb 02, 2015 at 08:10:15AM +0100, Oliver Welter wrote:
>>>> Am 02.02.2015 um 01:58 schrieb Herbert Poetzl:
>>>>> On Sun, Feb 01, 2015 at 03:28:22PM +0100, Oliver Welter wrote:

>>>>>> Trying the same without starting the vserver, using a simple
>>>>>> "chroot" works, so it looks like some limits are not working
>>>>>> correctly.

>>>>> Please try without Linux-VServer isolation but with the same
>>>>> namespace setup, I don't think that you are hitting a limit
>>>>> here, it looks more like a namespace problem of overlayfs.

>>>> Can you be a bit more verbose - I never git in touch with the
>>>> individual components ;)

>>> Either use vnamespace or the unshare tool to create a namespace
>>> setup identical to your guest and check if the issue remains.

>> I am unable to reproduce it with vnamespace or unshare, I used attached
>> test script and ran it as:

>> vnamespace -n /mnt/test.sh
>> vcontext --create --xid 42 /mnt/test.sh
>> unshare -i -m -u test.sh

>> with the correct result (file breakme is replaced by a
>> directory on the common mount).

>> When you do the same inside a vserver, it does not work (use
>> overlay to assemble rootfs of vserver, start vserver, try to
>> change entity which exists on the lower but not on the upper
>> fs).

> I think I got the root cause - overlayfs uses character files
> to mark whiteouts and the vserver env seems to refuse access
> to this whiteout file.

Not sure what that means?

If overlayfs uses special device files, you might want to
create them for the guest and/or allow them in the device
mapper.

> Adding SYS_ADMIN "makes it work", so I guess the right way
> would be to skip the access check for overlayfs whiteouts.

Documentation says it should be a character device with
major/minor 0/0, so allowing that device should do the
job, no further modification required.

All the best,
Herbert

> Oli

> --
> Protect your environment - close windows and adopt a penguin!
Received on Sun Feb 22 16:01:13 2015

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Sun 22 Feb 2015 - 16:01:13 GMT by hypermail 2.1.8