Re: Replacing aufs with overlayfs

Path	csiph.com!news.mixmin.net!aioe.org!bofh.it!news.nic.it!robomod
From	intrigeri <intrigeri@debian.org>
Newsgroups	linux.debian.kernel
Subject	Re: Replacing aufs with overlayfs
Date	Fri, 15 May 2020 09:10:01 +0200
Message-ID	<A6CDL-7Wo-5@gated-at.bofh.it> (permalink)
References	<ovz6W-1jN-3@gated-at.bofh.it> <owc8i-1V4-21@gated-at.bofh.it>
X-Original-To	debian-kernel@lists.debian.org
X-Mailbox-Line	From debian-kernel-request@lists.debian.org Fri May 15 07:06:11 2020
Old-Return-Path	<intrigeri@debian.org>
X-Amavis-Spam-Status	No, score=-6.98 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, LDO_WHITELIST=-5, MURPHY_DRUGS_REL8=0.02] autolearn=ham autolearn_force=no
X-Policyd-Weight	using cached result; rate: -4.6
X-Greylist	delayed 356 seconds by postgrey-1.36 at bendel; Fri, 15 May 2020 07:05:57 UTC
X-Policyd-Weight	using cached result; rate: -4.6
Content-Type	text/plain
X-Mailing-List	<debian-kernel@lists.debian.org> archive/latest/124073
List-ID	<debian-kernel.lists.debian.org>
List-URL	<https://lists.debian.org/debian-kernel/>
List-Archive	https://lists.debian.org/msgid-search/87blmpptsu.fsf@manticora
Approved	robomod@news.nic.it
Lines	40
Organization	linux.* mail to news gateway
Sender	robomod@news.nic.it
X-Original-Cc	debian-live@lists.debian.org
X-Original-Date	Fri, 15 May 2020 08:59:45 +0200
X-Original-Message-ID	<87blmpptsu.fsf@manticora>
X-Original-References	<1418154910.3599.44.camel@decadent.org.uk> <85oara5ny0.fsf@boum.org>
Xref	csiph.com linux.debian.kernel:67095

Show key headers only | View raw

Hi Debian Kernel Team,

intrigeri (2014-12-11):
> Ben Hutchings wrote (09 Dec 2014 19:55:10 GMT) :
>> Please try the Linux 3.18 packages from experimental (they're not there
>> yet, but should be soon) and check that overlayfs does what you need.
>
> Thanks. I'll test it for Tails' usecases (that use aufs a bit more
> than most other live systems, e.g. our incremental upgrades features
> uses it) once I find the time to.

It took us a while, but I'm happy to report that Tails has finally
migrated away from aufs! So as far as Tails is concerned, we don't
need the aufs "compat" patchset in src:linux anymore :)

In passing, so that I can call "case closed" some of the blockers that
were discussed later on this thread back in 2014-2015:

1. overlayfs stack depth upper limit vs. live-boot SquashFS stacking feature

   It turns out that was a misunderstanding: that upper limit applies
   to how many overlayfs filesystems can be part of a new overlayfs
   mount, rather than to how many read-only lower layers it's
   built from.

2. overlayfs vs. AppArmor

   It's still true that out-of-the-box, just like aufs, overlayfs does
   not play well with AppArmor. That's why apparmor.service turns
   itself into a no-op when it detects a Debian or Ubuntu Live system.

   To make them work together, one solution is to add a few AppArmor
   `alias` rules, and to add the `attach_disconnected` flag to every
   profile. For example:

    - https://salsa.debian.org/tails-team/tails/-/blob/master/config/chroot_local-includes/etc/apparmor.d/tunables/alias.d/tails
    - https://salsa.debian.org/tails-team/tails/-/blob/master/config/chroot_local-hooks/48-tweak-AppArmor-profiles
    - https://tails.boum.org/contribute/design/application_isolation/

Cheers!

Back to linux.debian.kernel | Previous | Next | Find similar | Unroll thread

Thread

Re: Replacing aufs with overlayfs intrigeri <intrigeri@debian.org> - 2020-05-15 09:10 +0200

csiph-web