-
Notifications
You must be signed in to change notification settings - Fork 192
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
drop rofiles-fuse, start using overlayfs #4827
Comments
I did some investigation, and /etc is on a rofiles-fuse mount with -copyup, so writes to it should work. However, it doesn't. Trying to modify an existing file (which should break the hardlink and replace it) like so:
Fails with:
I wonder if it somehow is using the composefs dir as backing for the rofiles, and not the deploy dirs. |
In a quick test, I am not reproducing this on FCOS (fedora 39). That said, I can't even enable composefs in the current centos-bootc:stream9 images as dbus-broker.service fails to launch...wait...this used to work... (some debugging) Argh it it's that's dang patch for rhel to disable |
So, the problem happens because the file we're replacing has fs-verity enabled. |
Oh yeah duh, so this is an ostree bug: |
Obviously package layering here should stop using rofiles-fuse and use overlayfs instead (and more generally align with container builds). |
In case fs-verity is in used for the repo objects, and something like "rpm-ostree apply-live" uses rofiles-fuse with --copyup, then writing to a hard-linked file fails to copy up, like this: echo foo > /a/rofile-mnt/a-file /a/rofile-mnt/a-file: Operation not permitted The reason for this is that do_write() starts by opening the file non-truncating for writing, stat:ing it and then calling verify_write_or_copyup(). It is expecting the the open(write) to succeed, however, in the fs-verity case any open with write fails with EPERM. We fix this by delaying the EPERM failure, only reporting it when the file descriptor needs to be used. In the case this triggered a copyup the file descriptor will be reopened, and in this case we will not get the EPERM anymore. To simplify this code the fd variable now uses glnx_autofd. This fixes coreos/rpm-ostree#4827
Its not actually in verify_write_or_copyup(), but before it, see the linked PR. |
Fixed by ostreedev/ostree#3175 |
On an automotive cs9 image, using composefs this command fails:
The log says is:
The actual post-trans is:
I don't understand why this breaks, because /etc should still be the regular bind-mount even though composefs is used (i.e. it is not using e.g. transient /etc. However, I don't know the details of apply-live.
The text was updated successfully, but these errors were encountered: