1.. SPDX-License-Identifier: GPL-2.0
2
3Written by: Neil Brown
4Please see MAINTAINERS file for where to send questions.
5
6Overlay Filesystem
7==================
8
9This document describes a prototype for a new approach to providing
10overlay-filesystem functionality in Linux (sometimes referred to as
11union-filesystems).  An overlay-filesystem tries to present a
12filesystem which is the result over overlaying one filesystem on top
13of the other.
14
15
16Overlay objects
17---------------
18
19The overlay filesystem approach is 'hybrid', because the objects that
20appear in the filesystem do not always appear to belong to that filesystem.
21In many cases, an object accessed in the union will be indistinguishable
22from accessing the corresponding object from the original filesystem.
23This is most obvious from the 'st_dev' field returned by stat(2).
24
25While directories will report an st_dev from the overlay-filesystem,
26non-directory objects may report an st_dev from the lower filesystem or
27upper filesystem that is providing the object.  Similarly st_ino will
28only be unique when combined with st_dev, and both of these can change
29over the lifetime of a non-directory object.  Many applications and
30tools ignore these values and will not be affected.
31
32In the special case of all overlay layers on the same underlying
33filesystem, all objects will report an st_dev from the overlay
34filesystem and st_ino from the underlying filesystem.  This will
35make the overlay mount more compliant with filesystem scanners and
36overlay objects will be distinguishable from the corresponding
37objects in the original filesystem.
38
39On 64bit systems, even if all overlay layers are not on the same
40underlying filesystem, the same compliant behavior could be achieved
41with the "xino" feature.  The "xino" feature composes a unique object
42identifier from the real object st_ino and an underlying fsid index.
43
44If all underlying filesystems support NFS file handles and export file
45handles with 32bit inode number encoding (e.g. ext4), overlay filesystem
46will use the high inode number bits for fsid.  Even when the underlying
47filesystem uses 64bit inode numbers, users can still enable the "xino"
48feature with the "-o xino=on" overlay mount option.  That is useful for the
49case of underlying filesystems like xfs and tmpfs, which use 64bit inode
50numbers, but are very unlikely to use the high inode number bits.  In case
51the underlying inode number does overflow into the high xino bits, overlay
52filesystem will fall back to the non xino behavior for that inode.
53
54The following table summarizes what can be expected in different overlay
55configurations.
56
57Inode properties
58````````````````
59
60+--------------+------------+------------+-----------------+----------------+
61|Configuration | Persistent | Uniform    | st_ino == d_ino | d_ino == i_ino |
62|              | st_ino     | st_dev     |                 | [*]            |
63+==============+=====+======+=====+======+========+========+========+=======+
64|              | dir | !dir | dir | !dir |  dir   +  !dir  |  dir   | !dir  |
65+--------------+-----+------+-----+------+--------+--------+--------+-------+
66| All layers   |  Y  |  Y   |  Y  |  Y   |  Y     |   Y    |  Y     |  Y    |
67| on same fs   |     |      |     |      |        |        |        |       |
68+--------------+-----+------+-----+------+--------+--------+--------+-------+
69| Layers not   |  N  |  Y   |  Y  |  N   |  N     |   Y    |  N     |  Y    |
70| on same fs,  |     |      |     |      |        |        |        |       |
71| xino=off     |     |      |     |      |        |        |        |       |
72+--------------+-----+------+-----+------+--------+--------+--------+-------+
73| xino=on/auto |  Y  |  Y   |  Y  |  Y   |  Y     |   Y    |  Y     |  Y    |
74|              |     |      |     |      |        |        |        |       |
75+--------------+-----+------+-----+------+--------+--------+--------+-------+
76| xino=on/auto,|  N  |  Y   |  Y  |  N   |  N     |   Y    |  N     |  Y    |
77| ino overflow |     |      |     |      |        |        |        |       |
78+--------------+-----+------+-----+------+--------+--------+--------+-------+
79
80[*] nfsd v3 readdirplus verifies d_ino == i_ino. i_ino is exposed via several
81/proc files, such as /proc/locks and /proc/self/fdinfo/<fd> of an inotify
82file descriptor.
83
84
85Upper and Lower
86---------------
87
88An overlay filesystem combines two filesystems - an 'upper' filesystem
89and a 'lower' filesystem.  When a name exists in both filesystems, the
90object in the 'upper' filesystem is visible while the object in the
91'lower' filesystem is either hidden or, in the case of directories,
92merged with the 'upper' object.
93
94It would be more correct to refer to an upper and lower 'directory
95tree' rather than 'filesystem' as it is quite possible for both
96directory trees to be in the same filesystem and there is no
97requirement that the root of a filesystem be given for either upper or
98lower.
99
100A wide range of filesystems supported by Linux can be the lower filesystem,
101but not all filesystems that are mountable by Linux have the features
102needed for OverlayFS to work.  The lower filesystem does not need to be
103writable.  The lower filesystem can even be another overlayfs.  The upper
104filesystem will normally be writable and if it is it must support the
105creation of trusted.* and/or user.* extended attributes, and must provide
106valid d_type in readdir responses, so NFS is not suitable.
107
108A read-only overlay of two read-only filesystems may use any
109filesystem type.
110
111Directories
112-----------
113
114Overlaying mainly involves directories.  If a given name appears in both
115upper and lower filesystems and refers to a non-directory in either,
116then the lower object is hidden - the name refers only to the upper
117object.
118
119Where both upper and lower objects are directories, a merged directory
120is formed.
121
122At mount time, the two directories given as mount options "lowerdir" and
123"upperdir" are combined into a merged directory:
124
125  mount -t overlay overlay -olowerdir=/lower,upperdir=/upper,\
126  workdir=/work /merged
127
128The "workdir" needs to be an empty directory on the same filesystem
129as upperdir.
130
131Then whenever a lookup is requested in such a merged directory, the
132lookup is performed in each actual directory and the combined result
133is cached in the dentry belonging to the overlay filesystem.  If both
134actual lookups find directories, both are stored and a merged
135directory is created, otherwise only one is stored: the upper if it
136exists, else the lower.
137
138Only the lists of names from directories are merged.  Other content
139such as metadata and extended attributes are reported for the upper
140directory only.  These attributes of the lower directory are hidden.
141
142whiteouts and opaque directories
143--------------------------------
144
145In order to support rm and rmdir without changing the lower
146filesystem, an overlay filesystem needs to record in the upper filesystem
147that files have been removed.  This is done using whiteouts and opaque
148directories (non-directories are always opaque).
149
150A whiteout is created as a character device with 0/0 device number.
151When a whiteout is found in the upper level of a merged directory, any
152matching name in the lower level is ignored, and the whiteout itself
153is also hidden.
154
155A directory is made opaque by setting the xattr "trusted.overlay.opaque"
156to "y".  Where the upper filesystem contains an opaque directory, any
157directory in the lower filesystem with the same name is ignored.
158
159readdir
160-------
161
162When a 'readdir' request is made on a merged directory, the upper and
163lower directories are each read and the name lists merged in the
164obvious way (upper is read first, then lower - entries that already
165exist are not re-added).  This merged name list is cached in the
166'struct file' and so remains as long as the file is kept open.  If the
167directory is opened and read by two processes at the same time, they
168will each have separate caches.  A seekdir to the start of the
169directory (offset 0) followed by a readdir will cause the cache to be
170discarded and rebuilt.
171
172This means that changes to the merged directory do not appear while a
173directory is being read.  This is unlikely to be noticed by many
174programs.
175
176seek offsets are assigned sequentially when the directories are read.
177Thus if
178
179  - read part of a directory
180  - remember an offset, and close the directory
181  - re-open the directory some time later
182  - seek to the remembered offset
183
184there may be little correlation between the old and new locations in
185the list of filenames, particularly if anything has changed in the
186directory.
187
188Readdir on directories that are not merged is simply handled by the
189underlying directory (upper or lower).
190
191renaming directories
192--------------------
193
194When renaming a directory that is on the lower layer or merged (i.e. the
195directory was not created on the upper layer to start with) overlayfs can
196handle it in two different ways:
197
1981. return EXDEV error: this error is returned by rename(2) when trying to
199   move a file or directory across filesystem boundaries.  Hence
200   applications are usually prepared to hande this error (mv(1) for example
201   recursively copies the directory tree).  This is the default behavior.
202
2032. If the "redirect_dir" feature is enabled, then the directory will be
204   copied up (but not the contents).  Then the "trusted.overlay.redirect"
205   extended attribute is set to the path of the original location from the
206   root of the overlay.  Finally the directory is moved to the new
207   location.
208
209There are several ways to tune the "redirect_dir" feature.
210
211Kernel config options:
212
213- OVERLAY_FS_REDIRECT_DIR:
214    If this is enabled, then redirect_dir is turned on by  default.
215- OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW:
216    If this is enabled, then redirects are always followed by default. Enabling
217    this results in a less secure configuration.  Enable this option only when
218    worried about backward compatibility with kernels that have the redirect_dir
219    feature and follow redirects even if turned off.
220
221Module options (can also be changed through /sys/module/overlay/parameters/):
222
223- "redirect_dir=BOOL":
224    See OVERLAY_FS_REDIRECT_DIR kernel config option above.
225- "redirect_always_follow=BOOL":
226    See OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW kernel config option above.
227- "redirect_max=NUM":
228    The maximum number of bytes in an absolute redirect (default is 256).
229
230Mount options:
231
232- "redirect_dir=on":
233    Redirects are enabled.
234- "redirect_dir=follow":
235    Redirects are not created, but followed.
236- "redirect_dir=off":
237    Redirects are not created and only followed if "redirect_always_follow"
238    feature is enabled in the kernel/module config.
239- "redirect_dir=nofollow":
240    Redirects are not created and not followed (equivalent to "redirect_dir=off"
241    if "redirect_always_follow" feature is not enabled).
242
243When the NFS export feature is enabled, every copied up directory is
244indexed by the file handle of the lower inode and a file handle of the
245upper directory is stored in a "trusted.overlay.upper" extended attribute
246on the index entry.  On lookup of a merged directory, if the upper
247directory does not match the file handle stores in the index, that is an
248indication that multiple upper directories may be redirected to the same
249lower directory.  In that case, lookup returns an error and warns about
250a possible inconsistency.
251
252Because lower layer redirects cannot be verified with the index, enabling
253NFS export support on an overlay filesystem with no upper layer requires
254turning off redirect follow (e.g. "redirect_dir=nofollow").
255
256
257Non-directories
258---------------
259
260Objects that are not directories (files, symlinks, device-special
261files etc.) are presented either from the upper or lower filesystem as
262appropriate.  When a file in the lower filesystem is accessed in a way
263the requires write-access, such as opening for write access, changing
264some metadata etc., the file is first copied from the lower filesystem
265to the upper filesystem (copy_up).  Note that creating a hard-link
266also requires copy_up, though of course creation of a symlink does
267not.
268
269The copy_up may turn out to be unnecessary, for example if the file is
270opened for read-write but the data is not modified.
271
272The copy_up process first makes sure that the containing directory
273exists in the upper filesystem - creating it and any parents as
274necessary.  It then creates the object with the same metadata (owner,
275mode, mtime, symlink-target etc.) and then if the object is a file, the
276data is copied from the lower to the upper filesystem.  Finally any
277extended attributes are copied up.
278
279Once the copy_up is complete, the overlay filesystem simply
280provides direct access to the newly created file in the upper
281filesystem - future operations on the file are barely noticed by the
282overlay filesystem (though an operation on the name of the file such as
283rename or unlink will of course be noticed and handled).
284
285
286Permission model
287----------------
288
289Permission checking in the overlay filesystem follows these principles:
290
291 1) permission check SHOULD return the same result before and after copy up
292
293 2) task creating the overlay mount MUST NOT gain additional privileges
294
295 3) non-mounting task MAY gain additional privileges through the overlay,
296 compared to direct access on underlying lower or upper filesystems
297
298This is achieved by performing two permission checks on each access
299
300 a) check if current task is allowed access based on local DAC (owner,
301    group, mode and posix acl), as well as MAC checks
302
303 b) check if mounting task would be allowed real operation on lower or
304    upper layer based on underlying filesystem permissions, again including
305    MAC checks
306
307Check (a) ensures consistency (1) since owner, group, mode and posix acls
308are copied up.  On the other hand it can result in server enforced
309permissions (used by NFS, for example) being ignored (3).
310
311Check (b) ensures that no task gains permissions to underlying layers that
312the mounting task does not have (2).  This also means that it is possible
313to create setups where the consistency rule (1) does not hold; normally,
314however, the mounting task will have sufficient privileges to perform all
315operations.
316
317Another way to demonstrate this model is drawing parallels between
318
319  mount -t overlay overlay -olowerdir=/lower,upperdir=/upper,... /merged
320
321and
322
323  cp -a /lower /upper
324  mount --bind /upper /merged
325
326The resulting access permissions should be the same.  The difference is in
327the time of copy (on-demand vs. up-front).
328
329
330Multiple lower layers
331---------------------
332
333Multiple lower layers can now be given using the colon (":") as a
334separator character between the directory names.  For example:
335
336  mount -t overlay overlay -olowerdir=/lower1:/lower2:/lower3 /merged
337
338As the example shows, "upperdir=" and "workdir=" may be omitted.  In
339that case the overlay will be read-only.
340
341The specified lower directories will be stacked beginning from the
342rightmost one and going left.  In the above example lower1 will be the
343top, lower2 the middle and lower3 the bottom layer.
344
345
346Metadata only copy up
347---------------------
348
349When metadata only copy up feature is enabled, overlayfs will only copy
350up metadata (as opposed to whole file), when a metadata specific operation
351like chown/chmod is performed. Full file will be copied up later when
352file is opened for WRITE operation.
353
354In other words, this is delayed data copy up operation and data is copied
355up when there is a need to actually modify data.
356
357There are multiple ways to enable/disable this feature. A config option
358CONFIG_OVERLAY_FS_METACOPY can be set/unset to enable/disable this feature
359by default. Or one can enable/disable it at module load time with module
360parameter metacopy=on/off. Lastly, there is also a per mount option
361metacopy=on/off to enable/disable this feature per mount.
362
363Do not use metacopy=on with untrusted upper/lower directories. Otherwise
364it is possible that an attacker can create a handcrafted file with
365appropriate REDIRECT and METACOPY xattrs, and gain access to file on lower
366pointed by REDIRECT. This should not be possible on local system as setting
367"trusted." xattrs will require CAP_SYS_ADMIN. But it should be possible
368for untrusted layers like from a pen drive.
369
370Note: redirect_dir={off|nofollow|follow[*]} and nfs_export=on mount options
371conflict with metacopy=on, and will result in an error.
372
373[*] redirect_dir=follow only conflicts with metacopy=on if upperdir=... is
374given.
375
376Sharing and copying layers
377--------------------------
378
379Lower layers may be shared among several overlay mounts and that is indeed
380a very common practice.  An overlay mount may use the same lower layer
381path as another overlay mount and it may use a lower layer path that is
382beneath or above the path of another overlay lower layer path.
383
384Using an upper layer path and/or a workdir path that are already used by
385another overlay mount is not allowed and may fail with EBUSY.  Using
386partially overlapping paths is not allowed and may fail with EBUSY.
387If files are accessed from two overlayfs mounts which share or overlap the
388upper layer and/or workdir path the behavior of the overlay is undefined,
389though it will not result in a crash or deadlock.
390
391Mounting an overlay using an upper layer path, where the upper layer path
392was previously used by another mounted overlay in combination with a
393different lower layer path, is allowed, unless the "inodes index" feature
394or "metadata only copy up" feature is enabled.
395
396With the "inodes index" feature, on the first time mount, an NFS file
397handle of the lower layer root directory, along with the UUID of the lower
398filesystem, are encoded and stored in the "trusted.overlay.origin" extended
399attribute on the upper layer root directory.  On subsequent mount attempts,
400the lower root directory file handle and lower filesystem UUID are compared
401to the stored origin in upper root directory.  On failure to verify the
402lower root origin, mount will fail with ESTALE.  An overlayfs mount with
403"inodes index" enabled will fail with EOPNOTSUPP if the lower filesystem
404does not support NFS export, lower filesystem does not have a valid UUID or
405if the upper filesystem does not support extended attributes.
406
407For "metadata only copy up" feature there is no verification mechanism at
408mount time. So if same upper is mounted with different set of lower, mount
409probably will succeed but expect the unexpected later on. So don't do it.
410
411It is quite a common practice to copy overlay layers to a different
412directory tree on the same or different underlying filesystem, and even
413to a different machine.  With the "inodes index" feature, trying to mount
414the copied layers will fail the verification of the lower root file handle.
415
416
417Non-standard behavior
418---------------------
419
420Current version of overlayfs can act as a mostly POSIX compliant
421filesystem.
422
423This is the list of cases that overlayfs doesn't currently handle:
424
425a) POSIX mandates updating st_atime for reads.  This is currently not
426done in the case when the file resides on a lower layer.
427
428b) If a file residing on a lower layer is opened for read-only and then
429memory mapped with MAP_SHARED, then subsequent changes to the file are not
430reflected in the memory mapping.
431
432The following options allow overlayfs to act more like a standards
433compliant filesystem:
434
4351) "redirect_dir"
436
437Enabled with the mount option or module option: "redirect_dir=on" or with
438the kernel config option CONFIG_OVERLAY_FS_REDIRECT_DIR=y.
439
440If this feature is disabled, then rename(2) on a lower or merged directory
441will fail with EXDEV ("Invalid cross-device link").
442
4432) "inode index"
444
445Enabled with the mount option or module option "index=on" or with the
446kernel config option CONFIG_OVERLAY_FS_INDEX=y.
447
448If this feature is disabled and a file with multiple hard links is copied
449up, then this will "break" the link.  Changes will not be propagated to
450other names referring to the same inode.
451
4523) "xino"
453
454Enabled with the mount option "xino=auto" or "xino=on", with the module
455option "xino_auto=on" or with the kernel config option
456CONFIG_OVERLAY_FS_XINO_AUTO=y.  Also implicitly enabled by using the same
457underlying filesystem for all layers making up the overlay.
458
459If this feature is disabled or the underlying filesystem doesn't have
460enough free bits in the inode number, then overlayfs will not be able to
461guarantee that the values of st_ino and st_dev returned by stat(2) and the
462value of d_ino returned by readdir(3) will act like on a normal filesystem.
463E.g. the value of st_dev may be different for two objects in the same
464overlay filesystem and the value of st_ino for directory objects may not be
465persistent and could change even while the overlay filesystem is mounted, as
466summarized in the `Inode properties`_ table above.
467
468
469Changes to underlying filesystems
470---------------------------------
471
472Changes to the underlying filesystems while part of a mounted overlay
473filesystem are not allowed.  If the underlying filesystem is changed,
474the behavior of the overlay is undefined, though it will not result in
475a crash or deadlock.
476
477Offline changes, when the overlay is not mounted, are allowed to the
478upper tree.  Offline changes to the lower tree are only allowed if the
479"metadata only copy up", "inode index", and "redirect_dir" features
480have not been used.  If the lower tree is modified and any of these
481features has been used, the behavior of the overlay is undefined,
482though it will not result in a crash or deadlock.
483
484When the overlay NFS export feature is enabled, overlay filesystems
485behavior on offline changes of the underlying lower layer is different
486than the behavior when NFS export is disabled.
487
488On every copy_up, an NFS file handle of the lower inode, along with the
489UUID of the lower filesystem, are encoded and stored in an extended
490attribute "trusted.overlay.origin" on the upper inode.
491
492When the NFS export feature is enabled, a lookup of a merged directory,
493that found a lower directory at the lookup path or at the path pointed
494to by the "trusted.overlay.redirect" extended attribute, will verify
495that the found lower directory file handle and lower filesystem UUID
496match the origin file handle that was stored at copy_up time.  If a
497found lower directory does not match the stored origin, that directory
498will not be merged with the upper directory.
499
500
501
502NFS export
503----------
504
505When the underlying filesystems supports NFS export and the "nfs_export"
506feature is enabled, an overlay filesystem may be exported to NFS.
507
508With the "nfs_export" feature, on copy_up of any lower object, an index
509entry is created under the index directory.  The index entry name is the
510hexadecimal representation of the copy up origin file handle.  For a
511non-directory object, the index entry is a hard link to the upper inode.
512For a directory object, the index entry has an extended attribute
513"trusted.overlay.upper" with an encoded file handle of the upper
514directory inode.
515
516When encoding a file handle from an overlay filesystem object, the
517following rules apply:
518
5191. For a non-upper object, encode a lower file handle from lower inode
5202. For an indexed object, encode a lower file handle from copy_up origin
5213. For a pure-upper object and for an existing non-indexed upper object,
522   encode an upper file handle from upper inode
523
524The encoded overlay file handle includes:
525 - Header including path type information (e.g. lower/upper)
526 - UUID of the underlying filesystem
527 - Underlying filesystem encoding of underlying inode
528
529This encoding format is identical to the encoding format file handles that
530are stored in extended attribute "trusted.overlay.origin".
531
532When decoding an overlay file handle, the following steps are followed:
533
5341. Find underlying layer by UUID and path type information.
5352. Decode the underlying filesystem file handle to underlying dentry.
5363. For a lower file handle, lookup the handle in index directory by name.
5374. If a whiteout is found in index, return ESTALE. This represents an
538   overlay object that was deleted after its file handle was encoded.
5395. For a non-directory, instantiate a disconnected overlay dentry from the
540   decoded underlying dentry, the path type and index inode, if found.
5416. For a directory, use the connected underlying decoded dentry, path type
542   and index, to lookup a connected overlay dentry.
543
544Decoding a non-directory file handle may return a disconnected dentry.
545copy_up of that disconnected dentry will create an upper index entry with
546no upper alias.
547
548When overlay filesystem has multiple lower layers, a middle layer
549directory may have a "redirect" to lower directory.  Because middle layer
550"redirects" are not indexed, a lower file handle that was encoded from the
551"redirect" origin directory, cannot be used to find the middle or upper
552layer directory.  Similarly, a lower file handle that was encoded from a
553descendant of the "redirect" origin directory, cannot be used to
554reconstruct a connected overlay path.  To mitigate the cases of
555directories that cannot be decoded from a lower file handle, these
556directories are copied up on encode and encoded as an upper file handle.
557On an overlay filesystem with no upper layer this mitigation cannot be
558used NFS export in this setup requires turning off redirect follow (e.g.
559"redirect_dir=nofollow").
560
561The overlay filesystem does not support non-directory connectable file
562handles, so exporting with the 'subtree_check' exportfs configuration will
563cause failures to lookup files over NFS.
564
565When the NFS export feature is enabled, all directory index entries are
566verified on mount time to check that upper file handles are not stale.
567This verification may cause significant overhead in some cases.
568
569Note: the mount options index=off,nfs_export=on are conflicting for a
570read-write mount and will result in an error.
571
572Note: the mount option uuid=off can be used to replace UUID of the underlying
573filesystem in file handles with null, and effectively disable UUID checks. This
574can be useful in case the underlying disk is copied and the UUID of this copy
575is changed. This is only applicable if all lower/upper/work directories are on
576the same filesystem, otherwise it will fallback to normal behaviour.
577
578Volatile mount
579--------------
580
581This is enabled with the "volatile" mount option.  Volatile mounts are not
582guaranteed to survive a crash.  It is strongly recommended that volatile
583mounts are only used if data written to the overlay can be recreated
584without significant effort.
585
586The advantage of mounting with the "volatile" option is that all forms of
587sync calls to the upper filesystem are omitted.
588
589In order to avoid a giving a false sense of safety, the syncfs (and fsync)
590semantics of volatile mounts are slightly different than that of the rest of
591VFS.  If any writeback error occurs on the upperdir's filesystem after a
592volatile mount takes place, all sync functions will return an error.  Once this
593condition is reached, the filesystem will not recover, and every subsequent sync
594call will return an error, even if the upperdir has not experience a new error
595since the last sync call.
596
597When overlay is mounted with "volatile" option, the directory
598"$workdir/work/incompat/volatile" is created.  During next mount, overlay
599checks for this directory and refuses to mount if present. This is a strong
600indicator that user should throw away upper and work directories and create
601fresh one. In very limited cases where the user knows that the system has
602not crashed and contents of upperdir are intact, The "volatile" directory
603can be removed.
604
605
606User xattr
607----------
608
609The the "-o userxattr" mount option forces overlayfs to use the
610"user.overlay." xattr namespace instead of "trusted.overlay.".  This is
611useful for unprivileged mounting of overlayfs.
612
613
614Testsuite
615---------
616
617There's a testsuite originally developed by David Howells and currently
618maintained by Amir Goldstein at:
619
620  https://github.com/amir73il/unionmount-testsuite.git
621
622Run as root:
623
624  # cd unionmount-testsuite
625  # ./run --ov --verify
626