packaging/ostree
1
0 Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

repo+tests: Add [core]disable-xattrs=true, use it on overlayfs

Browse Source 
There are a lot of things suboptimal about this approach, but
on the other hand we need to get our CI back up and running.

The basic approach is to - in the test suite, detect if we're on overlayfs. If
so, set a flag in the repo, which gets picked up by a few strategic places in
the core to turn on "ignore xattrs".

I also had to add a variant of this for the sysroot work.

The core problem here is while overlayfs will let us read and
see the SELinux labels, it won't let us write them.

Down the line, we should improve this so that we can selectively ignore e.g.
`security.*` attributes but not `user.*` say.

Closes: https://github.com/ostreedev/ostree/issues/758

Closes: #759
Approved by: jlebon
This commit is contained in:
Colin Walters authored and Atomic Bot committed 2017-03-24 22:16:43 +00:00
1 parent 4d873389f0
commit 455cc5e892
40 files changed
+208 -122
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/libostree/ostree-diff.c
+14
View File
@@ -24,6 +24,7 @@
#include "libglnx.h"
#include "ostree.h"
#include "ostree-repo-private.h"
#include "otutil.h"
static gboolean
@@ -269,6 +270,19 @@ ostree_diff_dirs_with_options (OstreeDiffFlags flags,
if (!options)
options = &default_opts;
/* If we're diffing versus a repo, and either of them have xattrs disabled,
* then disable for both.
*/
OstreeRepo *repo;
if (OSTREE_IS_REPO_FILE (a))
repo = ostree_repo_file_get_repo ((OstreeRepoFile*)a);
else if (OSTREE_IS_REPO_FILE (b))
repo = ostree_repo_file_get_repo ((OstreeRepoFile*)b);
else
repo = NULL;
if (repo != NULL && repo->disable_xattrs)
flags |= OSTREE_DIFF_FLAGS_IGNORE_XATTRS;
if (a == NULL)
{
if (!diff_add_dir_recurse (b, added, cancellable, error))
src/libostree/ostree-repo-commit.c
+2 -1
View File
@@ -2304,7 +2304,8 @@ get_modified_xattrs (OstreeRepo *self,
ret_xattrs = modifier->xattr_callback (self, relpath, file_info,
modifier->xattr_user_data);
}
else if (!(modifier && (modifier->flags & OSTREE_REPO_COMMIT_MODIFIER_FLAGS_SKIP_XATTRS) > 0))
else if (!(modifier && (modifier->flags & OSTREE_REPO_COMMIT_MODIFIER_FLAGS_SKIP_XATTRS) > 0)
&& !self->disable_xattrs)
{
if (path && OSTREE_IS_REPO_FILE (path))
{
src/libostree/ostree-repo-private.h
+1
View File
@@ -100,6 +100,7 @@ struct OstreeRepo {
GError *writable_error;
gboolean in_transaction;
gboolean disable_fsync;
gboolean disable_xattrs;
guint zlib_compression_level;
GHashTable *loose_object_devino_hash;
GHashTable *updated_uncompressed_dirs;
src/libostree/ostree-repo.c
+17 -7
View File
@@ -1584,8 +1584,9 @@ ostree_repo_remote_gpg_import (OstreeRepo *self,
if (fstatat (self->repo_dir_fd, remote->keyring, &stbuf, AT_SYMLINK_NOFOLLOW) == 0)
{
GLnxFileCopyFlags copyflags = self->disable_xattrs ? GLNX_FILE_COPY_NOXATTRS : 0;
if (!glnx_file_copy_at (self->repo_dir_fd, remote->keyring,
&stbuf, target_temp_fd, "pubring.gpg", 0,
&stbuf, target_temp_fd, "pubring.gpg", copyflags,
cancellable, error))
{
g_prefix_error (error, "Unable to copy remote's keyring: ");
@@ -2067,6 +2068,11 @@ reload_core_config (OstreeRepo *self,
ostree_repo_set_disable_fsync (self, TRUE);
}
/* See https://github.com/ostreedev/ostree/issues/758 */
if (!ot_keyfile_get_boolean_with_default (self->config, "core", "disable-xattrs",
TRUE, &self->disable_xattrs, error))
return FALSE;
{ g_autofree char *tmp_expiry_seconds = NULL;
/* 86400 secs = one day */
@@ -2920,8 +2926,10 @@ ostree_repo_load_file (OstreeRepo *self,
if (out_xattrs)
{
if (!glnx_fd_get_all_xattrs (fd, &ret_xattrs,
cancellable, error))
if (self->disable_xattrs)
ret_xattrs = g_variant_ref_sink (g_variant_new_array (G_VARIANT_TYPE ("(ayay)"), NULL, 0));
else if (!glnx_fd_get_all_xattrs (fd, &ret_xattrs,
cancellable, error))
goto out;
}
@@ -2934,15 +2942,17 @@ ostree_repo_load_file (OstreeRepo *self,
else if (g_file_info_get_file_type (ret_file_info) == G_FILE_TYPE_SYMBOLIC_LINK
&& out_xattrs)
{
if (!glnx_dfd_name_get_all_xattrs (self->objects_dir_fd, loose_path_buf,
&ret_xattrs,
cancellable, error))
if (self->disable_xattrs)
ret_xattrs = g_variant_ref_sink (g_variant_new_array (G_VARIANT_TYPE ("(ayay)"), NULL, 0));
else if (!glnx_dfd_name_get_all_xattrs (self->objects_dir_fd, loose_path_buf,
&ret_xattrs,
cancellable, error))
goto out;
}
}
}
}
if (!found)
{
if (self->parent_repo)
src/libostree/ostree-sysroot-deploy.c
+42 -21
View File
@@ -88,6 +88,15 @@ symlink_at_replace (const char *oldpath,
return ret;
}
static GLnxFileCopyFlags
sysroot_flags_to_copy_flags (GLnxFileCopyFlags defaults,
OstreeSysrootDebugFlags sysrootflags)
{
if (sysrootflags & OSTREE_SYSROOT_DEBUG_NO_XATTRS)
defaults |= GLNX_FILE_COPY_NOXATTRS;
return defaults;
}
/* Try a hardlink if we can, otherwise fall back to copying. Used
* right now for kernels/initramfs in /boot, where we can just
* hardlink if we're on the same partition.
@@ -97,6 +106,7 @@ hardlink_or_copy_at (int src_dfd,
const char *src_subpath,
int dest_dfd,
const char *dest_subpath,
OstreeSysrootDebugFlags flags,
GCancellable *cancellable,
GError **error)
{
@@ -106,7 +116,8 @@ hardlink_or_copy_at (int src_dfd,
{
if (errno == EMLINK || errno == EXDEV)
{
return glnx_file_copy_at (src_dfd, src_subpath, NULL, dest_dfd, dest_subpath, 0,
return glnx_file_copy_at (src_dfd, src_subpath, NULL, dest_dfd, dest_subpath,
sysroot_flags_to_copy_flags (0, flags),
cancellable, error);
}
else
@@ -126,6 +137,7 @@ dirfd_copy_attributes_and_xattrs (int src_parent_dfd,
const char *src_name,
int src_dfd,
int dest_dfd,
OstreeSysrootDebugFlags flags,
GCancellable *cancellable,
GError **error)
{
@@ -136,13 +148,16 @@ dirfd_copy_attributes_and_xattrs (int src_parent_dfd,
/* Clone all xattrs first, so we get the SELinux security context
* right. This will allow other users access if they have ACLs, but
* oh well.
*/
if (!glnx_dfd_name_get_all_xattrs (src_parent_dfd, src_name,
&xattrs, cancellable, error))
goto out;
if (!glnx_fd_set_all_xattrs (dest_dfd, xattrs,
cancellable, error))
goto out;
*/
if (!(flags & OSTREE_SYSROOT_DEBUG_NO_XATTRS))
{
if (!glnx_dfd_name_get_all_xattrs (src_parent_dfd, src_name,
&xattrs, cancellable, error))
goto out;
if (!glnx_fd_set_all_xattrs (dest_dfd, xattrs,
cancellable, error))
goto out;
}
if (fstat (src_dfd, &src_stbuf) != 0)
{
@@ -169,6 +184,7 @@ static gboolean
copy_dir_recurse (int src_parent_dfd,
int dest_parent_dfd,
const char *name,
OstreeSysrootDebugFlags flags,
GCancellable *cancellable,
GError **error)
{
@@ -190,7 +206,7 @@ copy_dir_recurse (int src_parent_dfd,
return FALSE;
if (!dirfd_copy_attributes_and_xattrs (src_parent_dfd, name, src_dfd_iter.fd, dest_dfd,
cancellable, error))
flags, cancellable, error))
return FALSE;
while (TRUE)
@@ -212,14 +228,14 @@ copy_dir_recurse (int src_parent_dfd,
if (S_ISDIR (child_stbuf.st_mode))
{
if (!copy_dir_recurse (src_dfd_iter.fd, dest_dfd, dent->d_name,
cancellable, error))
flags, cancellable, error))
return FALSE;
}
else
{
if (!glnx_file_copy_at (src_dfd_iter.fd, dent->d_name, &child_stbuf,
dest_dfd, dent->d_name,
GLNX_FILE_COPY_OVERWRITE,
sysroot_flags_to_copy_flags (GLNX_FILE_COPY_OVERWRITE, flags),
cancellable, error))
return FALSE;
}
@@ -234,6 +250,7 @@ ensure_directory_from_template (int orig_etc_fd,
int new_etc_fd,
const char *path,
int *out_dfd,
OstreeSysrootDebugFlags flags,
GCancellable *cancellable,
GError **error)
{
@@ -262,7 +279,7 @@ ensure_directory_from_template (int orig_etc_fd,
if (strcmp (parent_path, ".") != 0)
{
if (!ensure_directory_from_template (orig_etc_fd, modified_etc_fd, new_etc_fd,
parent_path, NULL, cancellable, error))
parent_path, NULL, flags, cancellable, error))
goto out;
/* Loop */
@@ -286,7 +303,7 @@ ensure_directory_from_template (int orig_etc_fd,
goto out;
if (!dirfd_copy_attributes_and_xattrs (modified_etc_fd, path, src_dfd, target_dfd,
cancellable, error))
flags, cancellable, error))
goto out;
ret = TRUE;
@@ -312,6 +329,7 @@ copy_modified_config_file (int orig_etc_fd,
int modified_etc_fd,
int new_etc_fd,
const char *path,
OstreeSysrootDebugFlags flags,
GCancellable *cancellable,
GError **error)
{
@@ -332,7 +350,7 @@ copy_modified_config_file (int orig_etc_fd,
g_autofree char *parent = g_path_get_dirname (path);
if (!ensure_directory_from_template (orig_etc_fd, modified_etc_fd, new_etc_fd,
parent, &dest_parent_dfd, cancellable, error))
parent, &dest_parent_dfd, flags, cancellable, error))
goto out;
}
else
@@ -386,7 +404,7 @@ copy_modified_config_file (int orig_etc_fd,
if (S_ISDIR (modified_stbuf.st_mode))
{
if (!copy_dir_recurse (modified_etc_fd, new_etc_fd, path,
if (!copy_dir_recurse (modified_etc_fd, new_etc_fd, path, flags,
cancellable, error))
goto out;
}
@@ -394,7 +412,7 @@ copy_modified_config_file (int orig_etc_fd,
{
if (!glnx_file_copy_at (modified_etc_fd, path, &modified_stbuf,
new_etc_fd, path,
GLNX_FILE_COPY_OVERWRITE,
sysroot_flags_to_copy_flags (GLNX_FILE_COPY_OVERWRITE, flags),
cancellable, error))
goto out;
}
@@ -426,6 +444,7 @@ static gboolean
merge_etc_changes (GFile *orig_etc,
GFile *modified_etc,
GFile *new_etc,
OstreeSysrootDebugFlags flags,
GCancellable *cancellable,
GError **error)
{
@@ -496,7 +515,7 @@ merge_etc_changes (GFile *orig_etc,
g_assert (path);
if (!copy_modified_config_file (orig_etc_fd, modified_etc_fd, new_etc_fd, path,
cancellable, error))
flags, cancellable, error))
goto out;
}
for (i = 0; i < added->len; i++)
@@ -507,7 +526,7 @@ merge_etc_changes (GFile *orig_etc,
g_assert (path);
if (!copy_modified_config_file (orig_etc_fd, modified_etc_fd, new_etc_fd, path,
cancellable, error))
flags, cancellable, error))
goto out;
}
@@ -827,7 +846,7 @@ merge_configuration (OstreeSysroot *sysroot,
/* TODO - set out labels as we copy files */
g_assert (!etc_exists);
if (!copy_dir_recurse (deployment_usr_dfd, deployment_dfd, "etc",
cancellable, error))
sysroot->debug_flags, cancellable, error))
goto out;
/* Here, we initialize SELinux policy from the /usr/etc inside
@@ -847,8 +866,8 @@ merge_configuration (OstreeSysroot *sysroot,
if (source_etc_path)
{
if (!merge_etc_changes (source_etc_pristine_path, source_etc_path, deployment_etc_path,
cancellable, error))
if (!merge_etc_changes (source_etc_pristine_path, source_etc_path, deployment_etc_path,
sysroot->debug_flags, cancellable, error))
goto out;
}
@@ -1319,6 +1338,7 @@ install_deployment_kernel (OstreeSysroot *sysroot,
}
if (!hardlink_or_copy_at (tree_boot_dfd, tree_kernel_name,
bootcsum_dfd, dest_kernel_name,
sysroot->debug_flags,
cancellable, error))
goto out;
}
@@ -1336,6 +1356,7 @@ install_deployment_kernel (OstreeSysroot *sysroot,
}
if (!hardlink_or_copy_at (tree_boot_dfd, tree_initramfs_name,
bootcsum_dfd, dest_initramfs_name,
sysroot->debug_flags,
cancellable, error))
goto out;
}
src/libostree/ostree-sysroot-private.h
+3 -1
View File
@@ -30,7 +30,9 @@ G_BEGIN_DECLS
typedef enum {
/* Don't flag deployments as immutable. */
OSTREE_SYSROOT_DEBUG_MUTABLE_DEPLOYMENTS = 1 << 0
OSTREE_SYSROOT_DEBUG_MUTABLE_DEPLOYMENTS = 1 << 0,
/* See https://github.com/ostreedev/ostree/pull/759 */
OSTREE_SYSROOT_DEBUG_NO_XATTRS = 1 << 1,
} OstreeSysrootDebugFlags;
src/libostree/ostree-sysroot.c
+2 -1
View File
@@ -161,9 +161,10 @@ ostree_sysroot_init (OstreeSysroot *self)
{
const GDebugKey keys[] = {
{ "mutable-deployments", OSTREE_SYSROOT_DEBUG_MUTABLE_DEPLOYMENTS },
{ "no-xattrs", OSTREE_SYSROOT_DEBUG_NO_XATTRS },
};
self->debug_flags = g_parse_debug_string (g_getenv("OSTREE_SYSROOT_DEBUG"),
self->debug_flags = g_parse_debug_string (g_getenv ("OSTREE_SYSROOT_DEBUG"),
keys, G_N_ELEMENTS (keys));
self->sysroot_fd = -1;