mirror of
https://github.com/containers/fuse-overlayfs.git
synced 2025-09-08 14:52:31 -04:00
20161f96d7
The major use case of stat override is to enable rootless containers on network filesystems, and they also lack security xattr support in non-root user namespaces. Trying to set security xattrs on them result in ENOTSUP and break things. It makes little sense to share security xattrs with the underlying filesystems when overriding stat in the first place. Linux's NFS server exposes security xattrs only when the user explicitly claims the security consistencies between the server and clients, and hide them otherwise. Following this precedent, we should isolate security xattrs since we know the security policy enforced by fuse-overlayfs is already distinct from the underlying filesystem when overriding owners and file mode. Mark security xattrs inaccessible with STAT_OVERRIDE_CONTAINERS to prefix all access to them with XATTR_CONTAINERS_OVERRIDE_PREFIX. Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
56 lines
1.3 KiB
Bash
Executable File
56 lines
1.3 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
set -ex
|
|
|
|
test $(id -u) -gt 0
|
|
|
|
rm -rf unpriv-test
|
|
mkdir unpriv-test
|
|
|
|
cd unpriv-test
|
|
|
|
mkdir lower upper workdir merged
|
|
|
|
touch lower/a lower/b
|
|
chmod 444 lower/a lower/b
|
|
|
|
fuse-overlayfs -o lowerdir=lower,upperdir=upper,workdir=workdir merged
|
|
|
|
rm -f merged/a
|
|
chmod 406 merged/b
|
|
|
|
test \! -e merged/a
|
|
test $(stat --printf=%a merged/b) -eq 406
|
|
test $(stat --printf=%a upper/b) -eq 406
|
|
if [ ${FUSE_OVERLAYFS_DISABLE_OVL_WHITEOUT:-0} -eq 1 ]; then
|
|
test -e upper/.wh.a
|
|
else
|
|
test -c upper/a
|
|
fi
|
|
|
|
fusermount -u merged || [ $? -eq "${EXPECT_UMOUNT_STATUS:-0}" ]
|
|
|
|
# xattr_permissions=2
|
|
rm -rf lower upper workdir merged
|
|
mkdir lower upper workdir merged
|
|
|
|
touch upper/file
|
|
unshare -r setcap cap_net_admin+ep upper/file
|
|
|
|
fuse-overlayfs -o lowerdir=lower,upperdir=upper,workdir=workdir,xattr_permissions=2 merged
|
|
|
|
# Ensure the security xattr namespace is isolated.
|
|
test "$(unshare -r getcap merged/file)" = ''
|
|
unshare -r setcap cap_net_admin+ep merged/file
|
|
test "$(unshare -r getcap merged/file)" = 'merged/file cap_net_admin=ep'
|
|
|
|
# Ensure UID is preserved with chgrp.
|
|
podman unshare chgrp 1 merged/file
|
|
test $(podman unshare stat -c %u:%g merged/file) = 0:1
|
|
|
|
# Ensure UID and GID are preserved with chmod.
|
|
chmod 600 merged/file
|
|
test $(podman unshare stat -c %u:%g merged/file) = 0:1
|
|
|
|
fusermount -u merged || [ $? -eq "${EXPECT_UMOUNT_STATUS:-0}" ]
|