It occurred to me that the cvmfs server software was successfully using kernel overlay

Make sure to go through the cases in <a class="issue-link js-issue-link" data-error-te

Indeed I found that the problem in <a class="issue-link js-issue-link" data-error-text

Apptainer can probably use overlayfs more if layers and mounts are read-only about apptainer HOT 2 CLOSED

DrDaveD commented on June 2, 2024

Apptainer can probably use overlayfs more if layers and mounts are read-only

from apptainer.

Comments (2)

DrDaveD commented on June 2, 2024

Make sure to go through the cases in #1459 before making changes.

from apptainer.

DrDaveD commented on June 2, 2024

Indeed I found that the problem in #1459 reappeared. I think adding the fuse allow_other option helps, but that's not enough to fix the Permission denied error. With setuid mode it also happens on CentOS7, although not on Rocky9. In user namespace mode it happens on all 3 current systems.

Here's how to reproduce it outside of Apptainer, using just command line commands. Use the test.squashfs from #1459 and for simplicity build a simple squashfs container with

$ apptainer pull test_image.sif docker://alpine
$ apptainer sif dump 4 test_image.sif >test_image.squashfs

Next reproduce the issue privileged on CentOS7 or Rocky8 since it's simpler:

$ cd /tmp
$ mkdir mnt1 mnt2 mnt3
$ sudo unshare -m
[root@localhost tmp]# squashfuse -f -o allow_other,ro,uid=1000,gid=1000 test_image.squashfs mnt1 &
[1] 7617
[root@localhost tmp]# squashfuse -f -o allow_other,ro,uid=1000,gid=1000 test.squashfs mnt2 &
[2] 7622
[root@localhost tmp]# mount -t overlay -o lowerdir=mnt2:mnt1 - mnt3
[root@localhost tmp]# runuser user -c "ls mnt3"
ls: cannot open directory 'mnt3': Permission denied

Replace user with your own user name and 1000 with your own uid and gid.

Bizarrely, I found that this can be worked around by unmounting and remounting the overlay:

[root@localhost tmp]# umount mnt3
[root@localhost tmp]# mount -t overlay -o lowerdir=mnt2:mnt1 - mnt3
[root@localhost tmp]# runuser user -c "ls mnt3"

This only works when there is also an access to the mnt3 mountpoint after the initial overlay mount and before the umount.

Likewise, for user namespaces, on Rocky8 or Rocky9 in one window create a root-mapped user namespace:

SHELL=/bin/sh unshare -rm
[root@localhost tmp]# squashfuse -f -o allow_other,ro,uid=1000,gid=1000 test_image.squashfs mnt1 &
[root@localhost tmp]# squashfuse -f -o allow_other,ro,uid=1000,gid=1000 test.squashfs mnt2 &
[root@localhost tmp]# mount -t overlay -o lowerdir=mnt2:mnt1 - mnt3
[root@localhost tmp]# echo $$
2793

Then in another window enter that namespace and create a sub user namespace:

$ SHELL=/bin/sh nsenter -t 2793 --preserve-credentials -U -m --
[root@localhost /]# cd tmp
[root@localhost tmp]# unshare -U
[nobody@localhost tmp]$ echo $$
3350

Then back in the root-mapped namespace set it to map root back to the original user:

[nobody@localhost tmp]# echo "1000 0 1" >/proc/3350/gid_map
[nobody@localhost tmp]# echo "1000 0 1" >/proc/3350/uid_map

Then in the nsenter user shell you see Permission denied:

[nobody@localhost tmp]$ id
uid=1000(user) gid=1000(user) groups=1000(user),65534(nobody)
[nobody@localhost tmp]$ cd mnt3
ls: cannot open directory 'mnt3': Permission denied

Until you go back to the original root-mapped space and umount and mount again the overlay.

from apptainer.

Apptainer can probably use overlayfs more if layers and mounts are read-only about apptainer HOT 2 CLOSED

Comments (2)

Related Issues (20)

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent