linux-kernel - Re: [PATCH v4 2/2] ovl: introduce new "uuid=off" option for inodes index feature

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJfpegvgmnWrmsACuWe_hYCfVm2r0Ltv0C+sN+3T1DBMzrGE9w@mail.gmail.com>
Date:   Tue, 6 Oct 2020 17:13:25 +0200
From:   Miklos Szeredi <miklos@...redi.hu>
To:     Pavel Tikhomirov <ptikhomirov@...tuozzo.com>
Cc:     Amir Goldstein <amir73il@...il.com>,
        Vivek Goyal <vgoyal@...hat.com>,
        overlayfs <linux-unionfs@...r.kernel.org>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v4 2/2] ovl: introduce new "uuid=off" option for inodes
 index feature

On Fri, Sep 25, 2020 at 10:35 AM Pavel Tikhomirov
<ptikhomirov@...tuozzo.com> wrote:

> Note: In our (Virtuozzo) use case users inside a container can create
> "regular" overlayfs mounts without any "index=" option, but we still
> want to migrate this containers with CRIU so we set "index=on" as kernel
> default so that all the container overlayfs mounts get support of file
> handles automatically. With "uuid=off" we want the same thing (to be
> able to "copy" container with uuid change) - we would set kernel default
> so that all the container overlayfs mounts get "uuid=off" automatically.

I'm not sure I buy that argument for a kernel option.   It should
rather be a "container" option in that case, but AFAIK the kernel
doesn't have a concept of a container.  I think this needs to be
discussed on the relevant mailing lists.

As of now mainline kernel doesn't support unprivileged overlay mounts,
so I guess this is not an issue.  Let's just merge this without the
kernel and the module options.

Thanks,
Miklos