Subject: Re: [vserver] Issue with OverlayFS in 3.18
From: Oliver Welter <mail@oliwel.de>
Date: Thu, 26 Feb 2015 15:42:51 +0100
Thu, 26 Feb 2015 15:42:51 +0100
Am 22.02.2015 um 21:42 schrieb Corey Wright:
> On Sun, 22 Feb 2015 21:10:45 +0100
> Oliver Welter <mail@oliwel.de> wrote:
>
>> Am 22.02.2015 um 20:05 schrieb Corey Wright:
>>> On Sun, 22 Feb 2015 17:10:20 +0100
>>> Oliver Welter <mail@oliwel.de> wrote:
>>>
>>>> Am 22.02.2015 um 17:01 schrieb Herbert Poetzl:
>>>>
>>>> --snipped--
>>>>
>>>>> Documentation says it should be a character device with
>>>>> major/minor 0/0, so allowing that device should do the
>>>>> job, no further modification required.
>>>>>
>>>> Yes that is correct - is there a way to do so with the current kernel
>>>> patches or do we(you) need to modify the patch.
>>>
>>> i would guess:
>>>
>>> mknod ${WHITEOUT} c 0 0
>>>
>>> which seems to be confirmed by the script attached to the end of this
>>> email [1], though i'm not sure where this whiteout device is suppose to
>>> reside (same directory as mount point for overlay?).
>>>
>>> you should be able to mknod the whiteout device from the host in the vserver
>>> (eg "mknod /vservers/${VNAME}/mnt/whiteout c 0 0") or allow the guest to
>>> create it (using cgroup device whitelist controller or vdevmap).
>>>
>> There is no single whiteout device, overlayfs creates a 0/0 item for
>> each deleted item ( using the name of the deleted file )
>
> yeah, it would have helped if i would have not stopped short with the first
> search hit, but read the kernel documentation [1]. :)
>
> as a simple test, you could try giving the vserver MKNOD ("echo MKNOD >>
> /etc/vservers/${VSERVER}/bcapabilities"; as compared to the all-powerful
> CAP SYS ADMIN) and if that works, then whitelist the char 0:0 device with
> cgroup device whitelisting (eg this paste [2], as i previously referenced on
> irc [3]).

> [1] Documentation/filesystems/overlayfs.txt
> [2] http://pastebin.com/SqCMmkpA
> [3] http://irc.13thfloor.at/LOG/2014-11/LOG 2014-11-28.txt
>

Sorry for the *bump* but can  anybody bring up another idea / fix ?
Using mknod and/or cgroup whitelist doesnt work (or I did it wrong)

Oli

-- 
Protect your environment -  close windows and adopt a penguin!




["application/pkcs7-signature" not shown]