github.com/toplink-cn/moby@v0.0.0-20240305205811-460b4aebdf81/daemon/graphdriver/overlay2/check.go (about) 1 //go:build linux 2 3 package overlay2 // import "github.com/docker/docker/daemon/graphdriver/overlay2" 4 5 import ( 6 "fmt" 7 "os" 8 "path" 9 "path/filepath" 10 "syscall" 11 12 "github.com/containerd/containerd/mount" 13 "github.com/containerd/containerd/pkg/userns" 14 "github.com/docker/docker/daemon/graphdriver/overlayutils" 15 "github.com/docker/docker/pkg/system" 16 "github.com/pkg/errors" 17 "golang.org/x/sys/unix" 18 ) 19 20 // doesSupportNativeDiff checks whether the filesystem has a bug 21 // which copies up the opaque flag when copying up an opaque 22 // directory or the kernel enable CONFIG_OVERLAY_FS_REDIRECT_DIR. 23 // When these exist naive diff should be used. 24 // 25 // When running in a user namespace, returns errRunningInUserNS 26 // immediately. 27 func doesSupportNativeDiff(d string) error { 28 if userns.RunningInUserNS() { 29 return errors.New("running in a user namespace") 30 } 31 32 td, err := os.MkdirTemp(d, "opaque-bug-check") 33 if err != nil { 34 return err 35 } 36 defer func() { 37 if err := os.RemoveAll(td); err != nil { 38 logger.Warnf("Failed to remove check directory %v: %v", td, err) 39 } 40 }() 41 42 // Make directories l1/d, l1/d1, l2/d, l3, work, merged 43 if err := os.MkdirAll(filepath.Join(td, "l1", "d"), 0o755); err != nil { 44 return err 45 } 46 if err := os.MkdirAll(filepath.Join(td, "l1", "d1"), 0o755); err != nil { 47 return err 48 } 49 if err := os.MkdirAll(filepath.Join(td, "l2", "d"), 0o755); err != nil { 50 return err 51 } 52 if err := os.Mkdir(filepath.Join(td, "l3"), 0o755); err != nil { 53 return err 54 } 55 if err := os.Mkdir(filepath.Join(td, workDirName), 0o755); err != nil { 56 return err 57 } 58 if err := os.Mkdir(filepath.Join(td, mergedDirName), 0o755); err != nil { 59 return err 60 } 61 62 // Mark l2/d as opaque 63 if err := system.Lsetxattr(filepath.Join(td, "l2", "d"), "trusted.overlay.opaque", []byte("y"), 0); err != nil { 64 return errors.Wrap(err, "failed to set opaque flag on middle layer") 65 } 66 67 opts := fmt.Sprintf("lowerdir=%s:%s,upperdir=%s,workdir=%s", path.Join(td, "l2"), path.Join(td, "l1"), path.Join(td, "l3"), path.Join(td, workDirName)) 68 if err := unix.Mount("overlay", filepath.Join(td, mergedDirName), "overlay", 0, opts); err != nil { 69 return errors.Wrap(err, "failed to mount overlay") 70 } 71 defer func() { 72 if err := unix.Unmount(filepath.Join(td, mergedDirName), 0); err != nil { 73 logger.Warnf("Failed to unmount check directory %v: %v", filepath.Join(td, mergedDirName), err) 74 } 75 }() 76 77 // Touch file in d to force copy up of opaque directory "d" from "l2" to "l3" 78 if err := os.WriteFile(filepath.Join(td, mergedDirName, "d", "f"), []byte{}, 0o644); err != nil { 79 return errors.Wrap(err, "failed to write to merged directory") 80 } 81 82 // Check l3/d does not have opaque flag 83 xattrOpaque, err := system.Lgetxattr(filepath.Join(td, "l3", "d"), "trusted.overlay.opaque") 84 if err != nil { 85 return errors.Wrap(err, "failed to read opaque flag on upper layer") 86 } 87 if string(xattrOpaque) == "y" { 88 return errors.New("opaque flag erroneously copied up, consider update to kernel 4.8 or later to fix") 89 } 90 91 // rename "d1" to "d2" 92 if err := os.Rename(filepath.Join(td, mergedDirName, "d1"), filepath.Join(td, mergedDirName, "d2")); err != nil { 93 // if rename failed with syscall.EXDEV, the kernel doesn't have CONFIG_OVERLAY_FS_REDIRECT_DIR enabled 94 if err.(*os.LinkError).Err == syscall.EXDEV { 95 return nil 96 } 97 return errors.Wrap(err, "failed to rename dir in merged directory") 98 } 99 // get the xattr of "d2" 100 xattrRedirect, err := system.Lgetxattr(filepath.Join(td, "l3", "d2"), "trusted.overlay.redirect") 101 if err != nil { 102 return errors.Wrap(err, "failed to read redirect flag on upper layer") 103 } 104 105 if string(xattrRedirect) == "d1" { 106 return errors.New("kernel has CONFIG_OVERLAY_FS_REDIRECT_DIR enabled") 107 } 108 109 return nil 110 } 111 112 // Forked from https://github.com/containers/storage/blob/05c69f1b2a5871d170c07dc8d2eec69c681e143b/drivers/overlay/check.go 113 // 114 // usingMetacopy checks if overlayfs's metacopy feature is active. When active, 115 // overlayfs will only copy up metadata (as opposed to the whole file) when a 116 // metadata-only operation is performed. Affected inodes will be marked with 117 // the "(trusted|user).overlay.metacopy" xattr. 118 // 119 // The CONFIG_OVERLAY_FS_METACOPY option, the overlay.metacopy parameter, or 120 // the metacopy mount option can all enable metacopy mode. For more details on 121 // this feature, see filesystems/overlayfs.txt in the kernel documentation 122 // tree. 123 // 124 // Note that the mount option should never be relevant should never come up the 125 // daemon has control over all of its own mounts and presently does not request 126 // metacopy. Nonetheless, a user or kernel distributor may enable metacopy, so 127 // we should report in the daemon whether or not we detect its use. 128 func usingMetacopy(d string) (bool, error) { 129 userxattr := false 130 if userns.RunningInUserNS() { 131 needed, err := overlayutils.NeedsUserXAttr(d) 132 if err != nil { 133 return false, err 134 } 135 if needed { 136 userxattr = true 137 } 138 } 139 140 td, err := os.MkdirTemp(d, "metacopy-check") 141 if err != nil { 142 return false, err 143 } 144 defer func() { 145 if err := os.RemoveAll(td); err != nil { 146 logger.WithError(err).Warnf("failed to remove check directory %v", td) 147 } 148 }() 149 150 l1, l2, work, merged := filepath.Join(td, "l1"), filepath.Join(td, "l2"), filepath.Join(td, "work"), filepath.Join(td, "merged") 151 for _, dir := range []string{l1, l2, work, merged} { 152 if err := os.Mkdir(dir, 0o755); err != nil { 153 return false, err 154 } 155 } 156 157 // Create empty file in l1 with 0700 permissions for metacopy test 158 if err := os.WriteFile(filepath.Join(l1, "f"), []byte{}, 0o700); err != nil { 159 return false, err 160 } 161 162 opts := []string{fmt.Sprintf("lowerdir=%s,upperdir=%s,workdir=%s", l1, l2, work)} 163 if userxattr { 164 opts = append(opts, "userxattr") 165 } 166 167 m := mount.Mount{ 168 Type: "overlay", 169 Source: "overlay", 170 Options: opts, 171 } 172 173 if err := m.Mount(merged); err != nil { 174 return false, errors.Wrap(err, "failed to mount overlay for metacopy check") 175 } 176 defer func() { 177 if err := mount.UnmountAll(merged, 0); err != nil { 178 logger.WithError(err).Warnf("failed to unmount check directory %v", merged) 179 } 180 }() 181 182 // Make a change that only impacts the inode, in the upperdir 183 if err := os.Chmod(filepath.Join(merged, "f"), 0o600); err != nil { 184 return false, errors.Wrap(err, "error changing permissions on file for metacopy check") 185 } 186 187 // ...and check if the pulled-up copy is marked as metadata-only 188 xattr, err := system.Lgetxattr(filepath.Join(l2, "f"), overlayutils.GetOverlayXattr("metacopy")) 189 if err != nil { 190 // ENOTSUP signifies the FS does not support either xattrs or metacopy. In either case, 191 // it is not a fatal error, and we should report metacopy as unused. 192 if errors.Is(err, unix.ENOTSUP) { 193 return false, nil 194 } 195 return false, errors.Wrap(err, "metacopy flag was not set on file in the upperdir") 196 } 197 usingMetacopy := xattr != nil 198 199 logger.WithField("usingMetacopy", usingMetacopy).Debug("successfully detected metacopy status") 200 return usingMetacopy, nil 201 }