lkml.org 
[lkml]   [2019]   [May]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: [PATCH] OVL: add honoracl=off mount option.
    Date
    NeilBrown:
    > If the upper and lower layers use incompatible ACL formats, it is not
    > possible to copy the ACL xttr from one to the other, so overlayfs
    > cannot work with them.
    > This happens particularly with NFSv4 which uses system.nfs4_acl, and
    > ext4 which uses system.posix_acl_access.

    FYI,
    Aufs had met the same problem many years ago, and I introduced some
    options called ICEX (Ignore Copyup Error on Xattr).

    (from the design doc in aufs)
    ----------------------------------------
    For example, the src branch supports ACL but the dst branch doesn't
    because the dst branch may natively un-support it or temporary
    un-support it due to "noacl" mount option. Of course, the dst branch fs
    may NOT return an error even if the XATTR is not supported. It is
    totally up to the branch fs.

    Anyway when the aufs internal copy-up gets an error from the dst branch
    fs, then aufs tries removing the just copied entry and returns the error
    to the userspace. The worst case of this situation will be all copy-up
    will fail.

    For the copy-up operation, there two basic approaches.
    - copy the specified XATTR only (by category above), and return the
    error unconditionally if it happens.
    - copy all XATTR, and ignore the error on the specified category only.

    In order to support XATTR and to implement the correct behaviour, aufs
    chooses the latter approach and introduces some new branch attributes,
    "icexsec", "icexsys", "icextr", "icexusr", and "icexoth".
    They correspond to the XATTR namespaces (see above). Additionally, to be
    convenient, "icex" is also provided which means all "icex*" attributes
    are set (here the word "icex" stands for "ignore copy-error on XATTR").

    The meaning of these attributes is to ignore the error from setting
    XATTR on that branch.
    Note that aufs tries copying all XATTR unconditionally, and ignores the
    error from the dst branch according to the specified attributes.
    ----------------------------------------

    But recent nfs4 got changed its behaviour around ACL, and it didn't pass
    my local tests. I had posted about that, but got no reply.


    J. R. Okajima

    \
     
     \ /
      Last update: 2019-05-02 15:57    [W:5.554 / U:0.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site