| package archive // import "github.com/docker/docker/pkg/archive" |
| |
| import ( |
| "archive/tar" |
| "fmt" |
| "io/ioutil" |
| "os" |
| "path/filepath" |
| "strings" |
| "syscall" |
| |
| "github.com/containerd/continuity/fs" |
| "github.com/docker/docker/pkg/system" |
| "github.com/pkg/errors" |
| "golang.org/x/sys/unix" |
| ) |
| |
| func getWhiteoutConverter(format WhiteoutFormat, inUserNS bool) tarWhiteoutConverter { |
| if format == OverlayWhiteoutFormat { |
| return overlayWhiteoutConverter{inUserNS: inUserNS} |
| } |
| return nil |
| } |
| |
| type overlayWhiteoutConverter struct { |
| inUserNS bool |
| } |
| |
| func (overlayWhiteoutConverter) ConvertWrite(hdr *tar.Header, path string, fi os.FileInfo) (wo *tar.Header, err error) { |
| // convert whiteouts to AUFS format |
| if fi.Mode()&os.ModeCharDevice != 0 && hdr.Devmajor == 0 && hdr.Devminor == 0 { |
| // we just rename the file and make it normal |
| dir, filename := filepath.Split(hdr.Name) |
| hdr.Name = filepath.Join(dir, WhiteoutPrefix+filename) |
| hdr.Mode = 0600 |
| hdr.Typeflag = tar.TypeReg |
| hdr.Size = 0 |
| } |
| |
| if fi.Mode()&os.ModeDir != 0 { |
| // convert opaque dirs to AUFS format by writing an empty file with the prefix |
| opaque, err := system.Lgetxattr(path, "trusted.overlay.opaque") |
| if err != nil { |
| return nil, err |
| } |
| if len(opaque) == 1 && opaque[0] == 'y' { |
| if hdr.Xattrs != nil { |
| delete(hdr.Xattrs, "trusted.overlay.opaque") |
| } |
| |
| // create a header for the whiteout file |
| // it should inherit some properties from the parent, but be a regular file |
| wo = &tar.Header{ |
| Typeflag: tar.TypeReg, |
| Mode: hdr.Mode & int64(os.ModePerm), |
| Name: filepath.Join(hdr.Name, WhiteoutOpaqueDir), |
| Size: 0, |
| Uid: hdr.Uid, |
| Uname: hdr.Uname, |
| Gid: hdr.Gid, |
| Gname: hdr.Gname, |
| AccessTime: hdr.AccessTime, |
| ChangeTime: hdr.ChangeTime, |
| } |
| } |
| } |
| |
| return |
| } |
| |
| func (c overlayWhiteoutConverter) ConvertRead(hdr *tar.Header, path string) (bool, error) { |
| base := filepath.Base(path) |
| dir := filepath.Dir(path) |
| |
| // if a directory is marked as opaque by the AUFS special file, we need to translate that to overlay |
| if base == WhiteoutOpaqueDir { |
| err := unix.Setxattr(dir, "trusted.overlay.opaque", []byte{'y'}, 0) |
| if err != nil { |
| if c.inUserNS { |
| if err = replaceDirWithOverlayOpaque(dir); err != nil { |
| return false, errors.Wrapf(err, "replaceDirWithOverlayOpaque(%q) failed", dir) |
| } |
| } else { |
| return false, errors.Wrapf(err, "setxattr(%q, trusted.overlay.opaque=y)", dir) |
| } |
| } |
| // don't write the file itself |
| return false, err |
| } |
| |
| // if a file was deleted and we are using overlay, we need to create a character device |
| if strings.HasPrefix(base, WhiteoutPrefix) { |
| originalBase := base[len(WhiteoutPrefix):] |
| originalPath := filepath.Join(dir, originalBase) |
| |
| if err := unix.Mknod(originalPath, unix.S_IFCHR, 0); err != nil { |
| if c.inUserNS { |
| // Ubuntu and a few distros support overlayfs in userns. |
| // |
| // Although we can't call mknod directly in userns (at least on bionic kernel 4.15), |
| // we can still create 0,0 char device using mknodChar0Overlay(). |
| // |
| // NOTE: we don't need this hack for the containerd snapshotter+unpack model. |
| if err := mknodChar0Overlay(originalPath); err != nil { |
| return false, errors.Wrapf(err, "failed to mknodChar0UserNS(%q)", originalPath) |
| } |
| } else { |
| return false, errors.Wrapf(err, "failed to mknod(%q, S_IFCHR, 0)", originalPath) |
| } |
| } |
| if err := os.Chown(originalPath, hdr.Uid, hdr.Gid); err != nil { |
| return false, err |
| } |
| |
| // don't write the file itself |
| return false, nil |
| } |
| |
| return true, nil |
| } |
| |
| // mknodChar0Overlay creates 0,0 char device by mounting overlayfs and unlinking. |
| // This function can be used for creating 0,0 char device in userns on Ubuntu. |
| // |
| // Steps: |
| // * Mkdir lower,upper,merged,work |
| // * Create lower/dummy |
| // * Mount overlayfs |
| // * Unlink merged/dummy |
| // * Unmount overlayfs |
| // * Make sure a 0,0 char device is created as upper/dummy |
| // * Rename upper/dummy to cleansedOriginalPath |
| func mknodChar0Overlay(cleansedOriginalPath string) error { |
| dir := filepath.Dir(cleansedOriginalPath) |
| tmp, err := ioutil.TempDir(dir, "mc0o") |
| if err != nil { |
| return errors.Wrapf(err, "failed to create a tmp directory under %s", dir) |
| } |
| defer os.RemoveAll(tmp) |
| lower := filepath.Join(tmp, "l") |
| upper := filepath.Join(tmp, "u") |
| work := filepath.Join(tmp, "w") |
| merged := filepath.Join(tmp, "m") |
| for _, s := range []string{lower, upper, work, merged} { |
| if err := os.MkdirAll(s, 0700); err != nil { |
| return errors.Wrapf(err, "failed to mkdir %s", s) |
| } |
| } |
| dummyBase := "d" |
| lowerDummy := filepath.Join(lower, dummyBase) |
| if err := ioutil.WriteFile(lowerDummy, []byte{}, 0600); err != nil { |
| return errors.Wrapf(err, "failed to create a dummy lower file %s", lowerDummy) |
| } |
| mOpts := fmt.Sprintf("lowerdir=%s,upperdir=%s,workdir=%s", lower, upper, work) |
| // docker/pkg/mount.Mount() requires procfs to be mounted. So we use syscall.Mount() directly instead. |
| if err := syscall.Mount("overlay", merged, "overlay", uintptr(0), mOpts); err != nil { |
| return errors.Wrapf(err, "failed to mount overlay (%s) on %s", mOpts, merged) |
| } |
| mergedDummy := filepath.Join(merged, dummyBase) |
| if err := os.Remove(mergedDummy); err != nil { |
| syscall.Unmount(merged, 0) |
| return errors.Wrapf(err, "failed to unlink %s", mergedDummy) |
| } |
| if err := syscall.Unmount(merged, 0); err != nil { |
| return errors.Wrapf(err, "failed to unmount %s", merged) |
| } |
| upperDummy := filepath.Join(upper, dummyBase) |
| if err := isChar0(upperDummy); err != nil { |
| return err |
| } |
| if err := os.Rename(upperDummy, cleansedOriginalPath); err != nil { |
| return errors.Wrapf(err, "failed to rename %s to %s", upperDummy, cleansedOriginalPath) |
| } |
| return nil |
| } |
| |
| func isChar0(path string) error { |
| osStat, err := os.Stat(path) |
| if err != nil { |
| return errors.Wrapf(err, "failed to stat %s", path) |
| } |
| st, ok := osStat.Sys().(*syscall.Stat_t) |
| if !ok { |
| return errors.Errorf("got unsupported stat for %s", path) |
| } |
| if os.FileMode(st.Mode)&syscall.S_IFMT != syscall.S_IFCHR { |
| return errors.Errorf("%s is not a character device, got mode=%d", path, st.Mode) |
| } |
| if st.Rdev != 0 { |
| return errors.Errorf("%s is not a 0,0 character device, got Rdev=%d", path, st.Rdev) |
| } |
| return nil |
| } |
| |
| // replaceDirWithOverlayOpaque replaces path with a new directory with trusted.overlay.opaque |
| // xattr. The contents of the directory are preserved. |
| func replaceDirWithOverlayOpaque(path string) error { |
| if path == "/" { |
| return errors.New("replaceDirWithOverlayOpaque: path must not be \"/\"") |
| } |
| dir := filepath.Dir(path) |
| tmp, err := ioutil.TempDir(dir, "rdwoo") |
| if err != nil { |
| return errors.Wrapf(err, "failed to create a tmp directory under %s", dir) |
| } |
| defer os.RemoveAll(tmp) |
| // newPath is a new empty directory crafted with trusted.overlay.opaque xattr. |
| // we copy the content of path into newPath, remove path, and rename newPath to path. |
| newPath, err := createDirWithOverlayOpaque(tmp) |
| if err != nil { |
| return errors.Wrapf(err, "createDirWithOverlayOpaque(%q) failed", tmp) |
| } |
| if err := fs.CopyDir(newPath, path); err != nil { |
| return errors.Wrapf(err, "CopyDir(%q, %q) failed", newPath, path) |
| } |
| if err := os.RemoveAll(path); err != nil { |
| return err |
| } |
| return os.Rename(newPath, path) |
| } |
| |
| // createDirWithOverlayOpaque creates a directory with trusted.overlay.opaque xattr, |
| // without calling setxattr, so as to allow creating opaque dir in userns on Ubuntu. |
| func createDirWithOverlayOpaque(tmp string) (string, error) { |
| lower := filepath.Join(tmp, "l") |
| upper := filepath.Join(tmp, "u") |
| work := filepath.Join(tmp, "w") |
| merged := filepath.Join(tmp, "m") |
| for _, s := range []string{lower, upper, work, merged} { |
| if err := os.MkdirAll(s, 0700); err != nil { |
| return "", errors.Wrapf(err, "failed to mkdir %s", s) |
| } |
| } |
| dummyBase := "d" |
| lowerDummy := filepath.Join(lower, dummyBase) |
| if err := os.MkdirAll(lowerDummy, 0700); err != nil { |
| return "", errors.Wrapf(err, "failed to create a dummy lower directory %s", lowerDummy) |
| } |
| mOpts := fmt.Sprintf("lowerdir=%s,upperdir=%s,workdir=%s", lower, upper, work) |
| // docker/pkg/mount.Mount() requires procfs to be mounted. So we use syscall.Mount() directly instead. |
| if err := syscall.Mount("overlay", merged, "overlay", uintptr(0), mOpts); err != nil { |
| return "", errors.Wrapf(err, "failed to mount overlay (%s) on %s", mOpts, merged) |
| } |
| mergedDummy := filepath.Join(merged, dummyBase) |
| if err := os.Remove(mergedDummy); err != nil { |
| syscall.Unmount(merged, 0) |
| return "", errors.Wrapf(err, "failed to rmdir %s", mergedDummy) |
| } |
| // upperDummy becomes a 0,0-char device file here |
| if err := os.Mkdir(mergedDummy, 0700); err != nil { |
| syscall.Unmount(merged, 0) |
| return "", errors.Wrapf(err, "failed to mkdir %s", mergedDummy) |
| } |
| // upperDummy becomes a directory with trusted.overlay.opaque xattr |
| // (but can't be verified in userns) |
| if err := syscall.Unmount(merged, 0); err != nil { |
| return "", errors.Wrapf(err, "failed to unmount %s", merged) |
| } |
| upperDummy := filepath.Join(upper, dummyBase) |
| return upperDummy, nil |
| } |