@@ -118,7 +118,7 @@ Where both upper and lower objects are directories, a merged directory
118
118
is formed.
119
119
120
120
At mount time, the two directories given as mount options "lowerdir" and
121
- "upperdir" are combined into a merged directory:
121
+ "upperdir" are combined into a merged directory::
122
122
123
123
mount -t overlay overlay -olowerdir=/lower,upperdir=/upper,\
124
124
workdir=/work /merged
@@ -172,12 +172,12 @@ directory is being read. This is unlikely to be noticed by many
172
172
programs.
173
173
174
174
seek offsets are assigned sequentially when the directories are read.
175
- Thus if
175
+ Thus if:
176
176
177
- - read part of a directory
178
- - remember an offset, and close the directory
179
- - re-open the directory some time later
180
- - seek to the remembered offset
177
+ - read part of a directory
178
+ - remember an offset, and close the directory
179
+ - re-open the directory some time later
180
+ - seek to the remembered offset
181
181
182
182
there may be little correlation between the old and new locations in
183
183
the list of filenames, particularly if anything has changed in the
@@ -290,9 +290,9 @@ Permission checking in the overlay filesystem follows these principles:
290
290
2) task creating the overlay mount MUST NOT gain additional privileges
291
291
292
292
3) non-mounting task MAY gain additional privileges through the overlay,
293
- compared to direct access on underlying lower or upper filesystems
293
+ compared to direct access on underlying lower or upper filesystems
294
294
295
- This is achieved by performing two permission checks on each access
295
+ This is achieved by performing two permission checks on each access:
296
296
297
297
a) check if current task is allowed access based on local DAC (owner,
298
298
group, mode and posix acl), as well as MAC checks
@@ -311,11 +311,11 @@ to create setups where the consistency rule (1) does not hold; normally,
311
311
however, the mounting task will have sufficient privileges to perform all
312
312
operations.
313
313
314
- Another way to demonstrate this model is drawing parallels between
314
+ Another way to demonstrate this model is drawing parallels between::
315
315
316
316
mount -t overlay overlay -olowerdir=/lower,upperdir=/upper,... /merged
317
317
318
- and
318
+ and::
319
319
320
320
cp -a /lower /upper
321
321
mount --bind /upper /merged
@@ -328,7 +328,7 @@ Multiple lower layers
328
328
---------------------
329
329
330
330
Multiple lower layers can now be given using the colon (":") as a
331
- separator character between the directory names. For example:
331
+ separator character between the directory names. For example::
332
332
333
333
mount -t overlay overlay -olowerdir=/lower1:/lower2:/lower3 /merged
334
334
@@ -340,13 +340,13 @@ rightmost one and going left. In the above example lower1 will be the
340
340
top, lower2 the middle and lower3 the bottom layer.
341
341
342
342
Note: directory names containing colons can be provided as lower layer by
343
- escaping the colons with a single backslash. For example:
343
+ escaping the colons with a single backslash. For example::
344
344
345
345
mount -t overlay overlay -olowerdir=/a\:lower\:\:dir /merged
346
346
347
347
Since kernel version v6.8, directory names containing colons can also
348
348
be configured as lower layer using the "lowerdir+" mount options and the
349
- fsconfig syscall from new mount api. For example:
349
+ fsconfig syscall from new mount api. For example::
350
350
351
351
fsconfig(fs_fd, FSCONFIG_SET_STRING, "lowerdir+", "/a:lower::dir", 0);
352
352
@@ -405,7 +405,7 @@ A normal lower layer is not allowed to be below a data-only layer, so single
405
405
colon separators are not allowed to the right of double colon ("::") separators.
406
406
407
407
408
- For example:
408
+ For example::
409
409
410
410
mount -t overlay overlay -olowerdir=/l1:/l2:/l3::/do1::/do2 /merged
411
411
@@ -419,7 +419,7 @@ to the absolute path of the "lower data" file in the "data-only" lower layer.
419
419
420
420
Since kernel version v6.8, "data-only" lower layers can also be added using
421
421
the "datadir+" mount options and the fsconfig syscall from new mount api.
422
- For example:
422
+ For example::
423
423
424
424
fsconfig(fs_fd, FSCONFIG_SET_STRING, "lowerdir+", "/l1", 0);
425
425
fsconfig(fs_fd, FSCONFIG_SET_STRING, "lowerdir+", "/l2", 0);
@@ -429,7 +429,7 @@ For example:
429
429
430
430
431
431
fs-verity support
432
- ----------------------
432
+ -----------------
433
433
434
434
During metadata copy up of a lower file, if the source file has
435
435
fs-verity enabled and overlay verity support is enabled, then the
@@ -547,15 +547,15 @@ filesystem.
547
547
548
548
This is the list of cases that overlayfs doesn't currently handle:
549
549
550
- a) POSIX mandates updating st_atime for reads. This is currently not
551
- done in the case when the file resides on a lower layer.
550
+ a) POSIX mandates updating st_atime for reads. This is currently not
551
+ done in the case when the file resides on a lower layer.
552
552
553
- b) If a file residing on a lower layer is opened for read-only and then
554
- memory mapped with MAP_SHARED, then subsequent changes to the file are not
555
- reflected in the memory mapping.
553
+ b) If a file residing on a lower layer is opened for read-only and then
554
+ memory mapped with MAP_SHARED, then subsequent changes to the file are not
555
+ reflected in the memory mapping.
556
556
557
- c) If a file residing on a lower layer is being executed, then opening that
558
- file for write or truncating the file will not be denied with ETXTBSY.
557
+ c) If a file residing on a lower layer is being executed, then opening that
558
+ file for write or truncating the file will not be denied with ETXTBSY.
559
559
560
560
The following options allow overlayfs to act more like a standards
561
561
compliant filesystem:
@@ -647,12 +647,13 @@ directory inode.
647
647
When encoding a file handle from an overlay filesystem object, the
648
648
following rules apply:
649
649
650
- 1. For a non-upper object, encode a lower file handle from lower inode
651
- 2. For an indexed object, encode a lower file handle from copy_up origin
652
- 3. For a pure-upper object and for an existing non-indexed upper object,
653
- encode an upper file handle from upper inode
650
+ 1. For a non-upper object, encode a lower file handle from lower inode
651
+ 2. For an indexed object, encode a lower file handle from copy_up origin
652
+ 3. For a pure-upper object and for an existing non-indexed upper object,
653
+ encode an upper file handle from upper inode
654
654
655
655
The encoded overlay file handle includes:
656
+
656
657
- Header including path type information (e.g. lower/upper)
657
658
- UUID of the underlying filesystem
658
659
- Underlying filesystem encoding of underlying inode
@@ -662,15 +663,15 @@ are stored in extended attribute "trusted.overlay.origin".
662
663
663
664
When decoding an overlay file handle, the following steps are followed:
664
665
665
- 1. Find underlying layer by UUID and path type information.
666
- 2. Decode the underlying filesystem file handle to underlying dentry.
667
- 3. For a lower file handle, lookup the handle in index directory by name.
668
- 4. If a whiteout is found in index, return ESTALE. This represents an
669
- overlay object that was deleted after its file handle was encoded.
670
- 5. For a non-directory, instantiate a disconnected overlay dentry from the
671
- decoded underlying dentry, the path type and index inode, if found.
672
- 6. For a directory, use the connected underlying decoded dentry, path type
673
- and index, to lookup a connected overlay dentry.
666
+ 1. Find underlying layer by UUID and path type information.
667
+ 2. Decode the underlying filesystem file handle to underlying dentry.
668
+ 3. For a lower file handle, lookup the handle in index directory by name.
669
+ 4. If a whiteout is found in index, return ESTALE. This represents an
670
+ overlay object that was deleted after its file handle was encoded.
671
+ 5. For a non-directory, instantiate a disconnected overlay dentry from the
672
+ decoded underlying dentry, the path type and index inode, if found.
673
+ 6. For a directory, use the connected underlying decoded dentry, path type
674
+ and index, to lookup a connected overlay dentry.
674
675
675
676
Decoding a non-directory file handle may return a disconnected dentry.
676
677
copy_up of that disconnected dentry will create an upper index entry with
@@ -773,9 +774,9 @@ Testsuite
773
774
There's a testsuite originally developed by David Howells and currently
774
775
maintained by Amir Goldstein at:
775
776
776
- https://github.com/amir73il/unionmount-testsuite.git
777
+ https://github.com/amir73il/unionmount-testsuite.git
777
778
778
- Run as root:
779
+ Run as root::
779
780
780
781
# cd unionmount-testsuite
781
782
# ./run --ov --verify
0 commit comments