20161f96d7
The major use case of stat override is to enable rootless containers on network filesystems, and they also lack security xattr support in non-root user namespaces. Trying to set security xattrs on them result in ENOTSUP and break things. It makes little sense to share security xattrs with the underlying filesystems when overriding stat in the first place. Linux's NFS server exposes security xattrs only when the user explicitly claims the security consistencies between the server and clients, and hide them otherwise. Following this precedent, we should isolate security xattrs since we know the security policy enforced by fuse-overlayfs is already distinct from the underlying filesystem when overriding owners and file mode. Mark security xattrs inaccessible with STAT_OVERRIDE_CONTAINERS to prefix all access to them with XATTR_CONTAINERS_OVERRIDE_PREFIX. Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
fuse-overlayfs
An implementation of overlay+shiftfs in FUSE for rootless containers.
Usage:
$ fuse-overlayfs -o lowerdir=lowerdir/a:lowerdir/b,upperdir=up,workdir=workdir merged
Specify a different UID/GID mapping:
$ fuse-overlayfs -o uidmapping=0:10:100:100:10000:2000,gidmapping=0:10:100:100:10000:2000,lowerdir=lowerdir/a:lowerdir/b,upperdir=up,workdir=workdir merged
Requirements:
If you are not using the static build as explained in the next chapter, your system needs libfuse > v3.2.1.
- On Fedora:
dnf install fuse3-devel - On Ubuntu > v19.04:
apt install libfuse3-dev
Also, please note that, when using fuse-overlayfs from a user namespace
(for example, when using rootless podman) a Linux Kernel > v4.18.0 is required.
Static Build:
This project provides a convenient way to automatically perform a static build using a container. The result is a self-contained binary without dependencies, that can be copied across hosts.
-
Install
buildahas explained here; -
Both the build and deploy host require the special device
/dev/fuse; there are a few ways to obtain it:
- install
fuse2orfuse3using the package manager of your choice (dnf, apt, pacman, etc): the install script will usually create the device automatically; or - manually create the device with the command
mknod /dev/fuse -m 0666 c 10 229(see this code)
-
Clone this repository, and switch to the top-level folder containing the file "
Containerfile.static.ubuntu"; -
Launch the build with the command (note the single dot
.at the end):
buildah bud -v $PWD:/build/fuse-overlayfs -t fuse-overlayfs -f ./Containerfile.static.ubuntu .
- Copy the resulting binary to your host:
sudo cp fuse-overlayfs /usr/bin/