GitLab

At the mount-time, XINO files are created and removed very soon.  When
multiple mounts with being given the same XINO file path executed in
parallel, some of them may fail in creating XINO due to EEXIST.
Introducing a local mutex, make it serialized.
By default, XINO is created at the top dir of the first writable
branch.  In this case, the new mutex won't be used.

Obviously this is an unnecessary overhead when the XINO file path is not
same, and such lock should be done by inode_lock() for the parent dir.
Actually au_xino_create2() behaves in this manner.  Then why didn't I
apply the same way to this au_xino_create()?  It is just because of my
laziness.  Calling VFS filp_open() here is easy for me.
Reported-by: Kirill Kolyshkin <kolyshkin@gmail.com>
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>
(cherry picked from commit 30d9273f2a1ce331b1a79b770bdb4c493919a673)

They are historical options and a branch attribute.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

This feature automatically handles MVDOWN in other commits.
In user-space, a daemon monitors the free space of the branch and issues
MVDOWN ioctl automatically when necessary. The main role is in
user-space and several options are implemented.
For a branch to join the FHSM circle, a new attribute 'fhsm' should be
specified.

See also the document in this commit.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

When these attributes are specified and aufs tries opening a file on that
branch, aufs copies/moves it up.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

These are very old options.
Since Unionfs created 'diropq' unconditionally in mkdir(2), old users
may expect the same behaviour. But there are cases where 'diropq' is
unnecessary. The aufs default behaviour is to create 'diropq' only when
it is necessary.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

Generally aufs hides the name of whiteouts. But in some cases, to show
them is very useful for users. For instance, creating a new middle layer
(branch) by merging existing layers.

See also the document in this commit.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

While most people (especially who use tmpfs as top writable branch)
doesn't care, I care and think it can be a security problem.
For example, when the lower readonly branch may contain
/etc/{passwd,shadow} and the permission bits of the upper empty
branch is world-writable, then a malicious user can make these files
manually with by-passing aufs.
Aufs can do nothing but produce a warning.

For details, see aufs manual in aufs-util.git.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

Introduce the new mount options, dirren and nodirren, which activates
and deactivates DIRREN feature.
In remount and unmount, the inum-list per branch should be flushed to
the file.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

Since aufs can have multiple writable branches, these options are
useful.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

This is a feature to optimize for rmdir and rename dir.
When the number of whiteouts under the target dir is very many, it may
take a long time to remove them all. To prevent this, 'dirwh=%d' option
specifies the watermark to decide when to remove them.

For details, see aufs manual in aufs-util.git.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

Sometimes the aufs policy to respect the branch fs's permission bits
makes users confused. IE. the direcotry permission bits on the top branch
allows users to read, but the lower branch prohibts. This option may be
useful for such case.
See also the document in this commit.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

The permissions and attributes of a branch can be modified dynamically.
See also the document in this commit.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

Implement the user interface.
Since users often wonder "Why I cannot delete this branch?", 'verbose'
option was introduced.

You may think aufs should not hold several strings for the variation of
the option, and the mount helper (/sbin/mount.aufs) can convert all
variations to a single fixed string, and in kernel space aufs should
contain this only one string.
I agree, but in our real world, many users don't install
/sbin/mount.aufs. To be convenient, aufs contains these variations.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

The interfaces to append and prepend branches.
They are the variations of "branch add" in another commit.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

Support for XATTR and ACL including several branch attributes to ignore
the copy error around XATTR and ACL.

NFS always sets MS_POSIXACL regardless its mount option 'noacl.'
When MS_POSIXACL is set, generic_permission() calls check_acl() (via
acl_permission_check()) and gets -EOPNOTSUPP because the NFS branch is
mounted as 'noacl.'
In aufs, h_permission() should not call generic_permission() in this
case.
The similar thing happens in coping-up XATTR. vfs_getxattr_alloc()
returns -EOPNOTSUPP.

See also the document in this commit.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

An enhancement for udba=none if possible.
The condition is same to the 'no ->d_revalidate()' patch series.
Refresh i_op in all cached inodes at the remount-time.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

Optimize out ->d_revalidate() if possible.
If the refreshing failed, then ->d_revalidate() remains. In this case,
aufs has two types of dentries. One has ->d_revalidate, the other
doesn't. I am afraid it will confuse me someday.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

Maintain the internal array including corresponding XINO file and sysfs
entries.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

This commit is just to prepare for the succeeding commit, and split to
suppress the size of a single commit.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

Now aufs becomes mountable with very few features.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

In order to prevent firing the notify event from aufs itself, hnotify
feature is suspend/resume-able. They are combined with mutex lock/unlock
for the parent dir.

See also previous commits.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

As a result of branch management, the virtual inode may point a
different real inode from it used to. And aufs has to maintain its
address_space_operations, since its definition may affect the
behaviour.
I know some people (including grsec-patch) doesn't like a non-const
address_space_operations, but in order to keep the consistency of the
behaviour, the correct address_space_operations is important.

See also the document in this commit.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

Aufs allows users' direct branch access (UDBA), ie. by-passing aufs.
Of course it will make aufs inode/dentry-caches obsolete. In order to
detect such change by the several tests, "udba=" option is introduced.

For details, see lookup.txt in later commit.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

Several policies to select one among multiple writable branches.
See also the document in previous commit.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

Aufs can have multiple writable branches, and there are several
policies to select one among them.
This commit implements default "top-down-parent" for both of
creating-policy and copyup-policy.

See also the document in this commit.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

The internal file read/write for copy-up in kernelspace.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

Some filesystems are natively readonly. And aufs can make a few
optimization for them. This new attribute tells aufs.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

Actually prepare the whiteout bases on the adding writable branch.
For details, refer to previous commit.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

While the whiteout on the writable branch have its effect
unconditionally (in latter commit), the one on the readonly branch can
have its effect only when this attribute is specified explicitly.
For the branch attributes, refer to the manual in aufs-util.git.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

Aufs pseudo-link (plink) represents a virtual hardlink across the
branches. To implement the plink maintenance mode, aufs uses procfs.
See also the document in this commit.

There is an external user-space utility called 'auplink' in
aufs-util.git, which has these features.
- 'list' shows the pseudo-linked inode numbers and filenames.
- 'cpup' copies-up all pseudo-link to the writable branch.
- 'flush' calls 'cpup', and then 'mount -o remount,clean_plink=inum'
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

As mentioned earlier, sometimes the size of XINO file is a problem.
Aufs has a feature to truncate it asynchronously using workqueue. But it
may not be so effective in some cases, and you may want to stop
discontiguous distribution of the inode numbers on branch fs.
See also the log in another commit.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

XINO and XIB files are read and written frequently after unlinked, and
it means that the remote filesystems are not suitable for them.
Additionally aufs shows their metadata via debugfs (in later commit).
To make it easier to do this, aufs expects branch filesystems to
maintain their i_size and i_blocks. And it means some filesystem are not
suitable for XINO.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>

For details, see previous commit.
Signed-off-by: J. R. Okajima <hooanon05g@gmail.com>