1.. SPDX-License-Identifier: GPL-2.0
2
3Written by: Neil Brown
4Please see MAINTAINERS file for where to send questions.
5
6Overlay Filesystem
7==================
8
9This document describes a prototype for a new approach to providing
10overlay-filesystem functionality in Linux (sometimes referred to as
11union-filesystems).  An overlay-filesystem tries to present a
12filesystem which is the result over overlaying one filesystem on top
13of the other.
14
15
16Overlay objects
17---------------
18
19The overlay filesystem approach is 'hybrid', because the objects that
20appear in the filesystem do not always appear to belong to that filesystem.
21In many cases, an object accessed in the union will be indistinguishable
22from accessing the corresponding object from the original filesystem.
23This is most obvious from the 'st_dev' field returned by stat(2).
24
25While directories will report an st_dev from the overlay-filesystem,
26non-directory objects may report an st_dev from the lower filesystem or
27upper filesystem that is providing the object.  Similarly st_ino will
28only be unique when combined with st_dev, and both of these can change
29over the lifetime of a non-directory object.  Many applications and
30tools ignore these values and will not be affected.
31
32In the special case of all overlay layers on the same underlying
33filesystem, all objects will report an st_dev from the overlay
34filesystem and st_ino from the underlying filesystem.  This will
35make the overlay mount more compliant with filesystem scanners and
36overlay objects will be distinguishable from the corresponding
37objects in the original filesystem.
38
39On 64bit systems, even if all overlay layers are not on the same
40underlying filesystem, the same compliant behavior could be achieved
41with the "xino" feature.  The "xino" feature composes a unique object
42identifier from the real object st_ino and an underlying fsid index.
43The "xino" feature uses the high inode number bits for fsid, because the
44underlying filesystems rarely use the high inode number bits.  In case
45the underlying inode number does overflow into the high xino bits, overlay
46filesystem will fall back to the non xino behavior for that inode.
47
48The "xino" feature can be enabled with the "-o xino=on" overlay mount option.
49If all underlying filesystems support NFS file handles, the value of st_ino
50for overlay filesystem objects is not only unique, but also persistent over
51the lifetime of the filesystem.  The "-o xino=auto" overlay mount option
52enables the "xino" feature only if the persistent st_ino requirement is met.
53
54The following table summarizes what can be expected in different overlay
55configurations.
56
57Inode properties
58````````````````
59
60+--------------+------------+------------+-----------------+----------------+
61|Configuration | Persistent | Uniform    | st_ino == d_ino | d_ino == i_ino |
62|              | st_ino     | st_dev     |                 | [*]            |
63+==============+=====+======+=====+======+========+========+========+=======+
64|              | dir | !dir | dir | !dir |  dir   +  !dir  |  dir   | !dir  |
65+--------------+-----+------+-----+------+--------+--------+--------+-------+
66| All layers   |  Y  |  Y   |  Y  |  Y   |  Y     |   Y    |  Y     |  Y    |
67| on same fs   |     |      |     |      |        |        |        |       |
68+--------------+-----+------+-----+------+--------+--------+--------+-------+
69| Layers not   |  N  |  N   |  Y  |  N   |  N     |   Y    |  N     |  Y    |
70| on same fs,  |     |      |     |      |        |        |        |       |
71| xino=off     |     |      |     |      |        |        |        |       |
72+--------------+-----+------+-----+------+--------+--------+--------+-------+
73| xino=on/auto |  Y  |  Y   |  Y  |  Y   |  Y     |   Y    |  Y     |  Y    |
74+--------------+-----+------+-----+------+--------+--------+--------+-------+
75| xino=on/auto,|  N  |  N   |  Y  |  N   |  N     |   Y    |  N     |  Y    |
76| ino overflow |     |      |     |      |        |        |        |       |
77+--------------+-----+------+-----+------+--------+--------+--------+-------+
78
79[*] nfsd v3 readdirplus verifies d_ino == i_ino. i_ino is exposed via several
80/proc files, such as /proc/locks and /proc/self/fdinfo/<fd> of an inotify
81file descriptor.
82
83Upper and Lower
84---------------
85
86An overlay filesystem combines two filesystems - an 'upper' filesystem
87and a 'lower' filesystem.  When a name exists in both filesystems, the
88object in the 'upper' filesystem is visible while the object in the
89'lower' filesystem is either hidden or, in the case of directories,
90merged with the 'upper' object.
91
92It would be more correct to refer to an upper and lower 'directory
93tree' rather than 'filesystem' as it is quite possible for both
94directory trees to be in the same filesystem and there is no
95requirement that the root of a filesystem be given for either upper or
96lower.
97
98A wide range of filesystems supported by Linux can be the lower filesystem,
99but not all filesystems that are mountable by Linux have the features
100needed for OverlayFS to work.  The lower filesystem does not need to be
101writable.  The lower filesystem can even be another overlayfs.  The upper
102filesystem will normally be writable and if it is it must support the
103creation of trusted.* and/or user.* extended attributes, and must provide
104valid d_type in readdir responses, so NFS is not suitable.
105
106A read-only overlay of two read-only filesystems may use any
107filesystem type.
108
109Directories
110-----------
111
112Overlaying mainly involves directories.  If a given name appears in both
113upper and lower filesystems and refers to a non-directory in either,
114then the lower object is hidden - the name refers only to the upper
115object.
116
117Where both upper and lower objects are directories, a merged directory
118is formed.
119
120At mount time, the two directories given as mount options "lowerdir" and
121"upperdir" are combined into a merged directory:
122
123  mount -t overlay overlay -olowerdir=/lower,upperdir=/upper,\
124  workdir=/work /merged
125
126The "workdir" needs to be an empty directory on the same filesystem
127as upperdir.
128
129Then whenever a lookup is requested in such a merged directory, the
130lookup is performed in each actual directory and the combined result
131is cached in the dentry belonging to the overlay filesystem.  If both
132actual lookups find directories, both are stored and a merged
133directory is created, otherwise only one is stored: the upper if it
134exists, else the lower.
135
136Only the lists of names from directories are merged.  Other content
137such as metadata and extended attributes are reported for the upper
138directory only.  These attributes of the lower directory are hidden.
139
140whiteouts and opaque directories
141--------------------------------
142
143In order to support rm and rmdir without changing the lower
144filesystem, an overlay filesystem needs to record in the upper filesystem
145that files have been removed.  This is done using whiteouts and opaque
146directories (non-directories are always opaque).
147
148A whiteout is created as a character device with 0/0 device number.
149When a whiteout is found in the upper level of a merged directory, any
150matching name in the lower level is ignored, and the whiteout itself
151is also hidden.
152
153A directory is made opaque by setting the xattr "trusted.overlay.opaque"
154to "y".  Where the upper filesystem contains an opaque directory, any
155directory in the lower filesystem with the same name is ignored.
156
157readdir
158-------
159
160When a 'readdir' request is made on a merged directory, the upper and
161lower directories are each read and the name lists merged in the
162obvious way (upper is read first, then lower - entries that already
163exist are not re-added).  This merged name list is cached in the
164'struct file' and so remains as long as the file is kept open.  If the
165directory is opened and read by two processes at the same time, they
166will each have separate caches.  A seekdir to the start of the
167directory (offset 0) followed by a readdir will cause the cache to be
168discarded and rebuilt.
169
170This means that changes to the merged directory do not appear while a
171directory is being read.  This is unlikely to be noticed by many
172programs.
173
174seek offsets are assigned sequentially when the directories are read.
175Thus if
176
177  - read part of a directory
178  - remember an offset, and close the directory
179  - re-open the directory some time later
180  - seek to the remembered offset
181
182there may be little correlation between the old and new locations in
183the list of filenames, particularly if anything has changed in the
184directory.
185
186Readdir on directories that are not merged is simply handled by the
187underlying directory (upper or lower).
188
189renaming directories
190--------------------
191
192When renaming a directory that is on the lower layer or merged (i.e. the
193directory was not created on the upper layer to start with) overlayfs can
194handle it in two different ways:
195
1961. return EXDEV error: this error is returned by rename(2) when trying to
197   move a file or directory across filesystem boundaries.  Hence
198   applications are usually prepared to hande this error (mv(1) for example
199   recursively copies the directory tree).  This is the default behavior.
200
2012. If the "redirect_dir" feature is enabled, then the directory will be
202   copied up (but not the contents).  Then the "trusted.overlay.redirect"
203   extended attribute is set to the path of the original location from the
204   root of the overlay.  Finally the directory is moved to the new
205   location.
206
207There are several ways to tune the "redirect_dir" feature.
208
209Kernel config options:
210
211- OVERLAY_FS_REDIRECT_DIR:
212    If this is enabled, then redirect_dir is turned on by  default.
213- OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW:
214    If this is enabled, then redirects are always followed by default. Enabling
215    this results in a less secure configuration.  Enable this option only when
216    worried about backward compatibility with kernels that have the redirect_dir
217    feature and follow redirects even if turned off.
218
219Module options (can also be changed through /sys/module/overlay/parameters/):
220
221- "redirect_dir=BOOL":
222    See OVERLAY_FS_REDIRECT_DIR kernel config option above.
223- "redirect_always_follow=BOOL":
224    See OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW kernel config option above.
225- "redirect_max=NUM":
226    The maximum number of bytes in an absolute redirect (default is 256).
227
228Mount options:
229
230- "redirect_dir=on":
231    Redirects are enabled.
232- "redirect_dir=follow":
233    Redirects are not created, but followed.
234- "redirect_dir=off":
235    Redirects are not created and only followed if "redirect_always_follow"
236    feature is enabled in the kernel/module config.
237- "redirect_dir=nofollow":
238    Redirects are not created and not followed (equivalent to "redirect_dir=off"
239    if "redirect_always_follow" feature is not enabled).
240
241When the NFS export feature is enabled, every copied up directory is
242indexed by the file handle of the lower inode and a file handle of the
243upper directory is stored in a "trusted.overlay.upper" extended attribute
244on the index entry.  On lookup of a merged directory, if the upper
245directory does not match the file handle stores in the index, that is an
246indication that multiple upper directories may be redirected to the same
247lower directory.  In that case, lookup returns an error and warns about
248a possible inconsistency.
249
250Because lower layer redirects cannot be verified with the index, enabling
251NFS export support on an overlay filesystem with no upper layer requires
252turning off redirect follow (e.g. "redirect_dir=nofollow").
253
254
255Non-directories
256---------------
257
258Objects that are not directories (files, symlinks, device-special
259files etc.) are presented either from the upper or lower filesystem as
260appropriate.  When a file in the lower filesystem is accessed in a way
261the requires write-access, such as opening for write access, changing
262some metadata etc., the file is first copied from the lower filesystem
263to the upper filesystem (copy_up).  Note that creating a hard-link
264also requires copy_up, though of course creation of a symlink does
265not.
266
267The copy_up may turn out to be unnecessary, for example if the file is
268opened for read-write but the data is not modified.
269
270The copy_up process first makes sure that the containing directory
271exists in the upper filesystem - creating it and any parents as
272necessary.  It then creates the object with the same metadata (owner,
273mode, mtime, symlink-target etc.) and then if the object is a file, the
274data is copied from the lower to the upper filesystem.  Finally any
275extended attributes are copied up.
276
277Once the copy_up is complete, the overlay filesystem simply
278provides direct access to the newly created file in the upper
279filesystem - future operations on the file are barely noticed by the
280overlay filesystem (though an operation on the name of the file such as
281rename or unlink will of course be noticed and handled).
282
283
284Permission model
285----------------
286
287Permission checking in the overlay filesystem follows these principles:
288
289 1) permission check SHOULD return the same result before and after copy up
290
291 2) task creating the overlay mount MUST NOT gain additional privileges
292
293 3) non-mounting task MAY gain additional privileges through the overlay,
294 compared to direct access on underlying lower or upper filesystems
295
296This is achieved by performing two permission checks on each access
297
298 a) check if current task is allowed access based on local DAC (owner,
299    group, mode and posix acl), as well as MAC checks
300
301 b) check if mounting task would be allowed real operation on lower or
302    upper layer based on underlying filesystem permissions, again including
303    MAC checks
304
305Check (a) ensures consistency (1) since owner, group, mode and posix acls
306are copied up.  On the other hand it can result in server enforced
307permissions (used by NFS, for example) being ignored (3).
308
309Check (b) ensures that no task gains permissions to underlying layers that
310the mounting task does not have (2).  This also means that it is possible
311to create setups where the consistency rule (1) does not hold; normally,
312however, the mounting task will have sufficient privileges to perform all
313operations.
314
315Another way to demonstrate this model is drawing parallels between
316
317  mount -t overlay overlay -olowerdir=/lower,upperdir=/upper,... /merged
318
319and
320
321  cp -a /lower /upper
322  mount --bind /upper /merged
323
324The resulting access permissions should be the same.  The difference is in
325the time of copy (on-demand vs. up-front).
326
327
328Multiple lower layers
329---------------------
330
331Multiple lower layers can now be given using the colon (":") as a
332separator character between the directory names.  For example:
333
334  mount -t overlay overlay -olowerdir=/lower1:/lower2:/lower3 /merged
335
336As the example shows, "upperdir=" and "workdir=" may be omitted.  In
337that case the overlay will be read-only.
338
339The specified lower directories will be stacked beginning from the
340rightmost one and going left.  In the above example lower1 will be the
341top, lower2 the middle and lower3 the bottom layer.
342
343
344Metadata only copy up
345---------------------
346
347When metadata only copy up feature is enabled, overlayfs will only copy
348up metadata (as opposed to whole file), when a metadata specific operation
349like chown/chmod is performed. Full file will be copied up later when
350file is opened for WRITE operation.
351
352In other words, this is delayed data copy up operation and data is copied
353up when there is a need to actually modify data.
354
355There are multiple ways to enable/disable this feature. A config option
356CONFIG_OVERLAY_FS_METACOPY can be set/unset to enable/disable this feature
357by default. Or one can enable/disable it at module load time with module
358parameter metacopy=on/off. Lastly, there is also a per mount option
359metacopy=on/off to enable/disable this feature per mount.
360
361Do not use metacopy=on with untrusted upper/lower directories. Otherwise
362it is possible that an attacker can create a handcrafted file with
363appropriate REDIRECT and METACOPY xattrs, and gain access to file on lower
364pointed by REDIRECT. This should not be possible on local system as setting
365"trusted." xattrs will require CAP_SYS_ADMIN. But it should be possible
366for untrusted layers like from a pen drive.
367
368Note: redirect_dir={off|nofollow|follow[*]} and nfs_export=on mount options
369conflict with metacopy=on, and will result in an error.
370
371[*] redirect_dir=follow only conflicts with metacopy=on if upperdir=... is
372given.
373
374Sharing and copying layers
375--------------------------
376
377Lower layers may be shared among several overlay mounts and that is indeed
378a very common practice.  An overlay mount may use the same lower layer
379path as another overlay mount and it may use a lower layer path that is
380beneath or above the path of another overlay lower layer path.
381
382Using an upper layer path and/or a workdir path that are already used by
383another overlay mount is not allowed and may fail with EBUSY.  Using
384partially overlapping paths is not allowed and may fail with EBUSY.
385If files are accessed from two overlayfs mounts which share or overlap the
386upper layer and/or workdir path the behavior of the overlay is undefined,
387though it will not result in a crash or deadlock.
388
389Mounting an overlay using an upper layer path, where the upper layer path
390was previously used by another mounted overlay in combination with a
391different lower layer path, is allowed, unless the "inodes index" feature
392or "metadata only copy up" feature is enabled.
393
394With the "inodes index" feature, on the first time mount, an NFS file
395handle of the lower layer root directory, along with the UUID of the lower
396filesystem, are encoded and stored in the "trusted.overlay.origin" extended
397attribute on the upper layer root directory.  On subsequent mount attempts,
398the lower root directory file handle and lower filesystem UUID are compared
399to the stored origin in upper root directory.  On failure to verify the
400lower root origin, mount will fail with ESTALE.  An overlayfs mount with
401"inodes index" enabled will fail with EOPNOTSUPP if the lower filesystem
402does not support NFS export, lower filesystem does not have a valid UUID or
403if the upper filesystem does not support extended attributes.
404
405For "metadata only copy up" feature there is no verification mechanism at
406mount time. So if same upper is mounted with different set of lower, mount
407probably will succeed but expect the unexpected later on. So don't do it.
408
409It is quite a common practice to copy overlay layers to a different
410directory tree on the same or different underlying filesystem, and even
411to a different machine.  With the "inodes index" feature, trying to mount
412the copied layers will fail the verification of the lower root file handle.
413
414
415Non-standard behavior
416---------------------
417
418Current version of overlayfs can act as a mostly POSIX compliant
419filesystem.
420
421This is the list of cases that overlayfs doesn't currently handle:
422
423a) POSIX mandates updating st_atime for reads.  This is currently not
424done in the case when the file resides on a lower layer.
425
426b) If a file residing on a lower layer is opened for read-only and then
427memory mapped with MAP_SHARED, then subsequent changes to the file are not
428reflected in the memory mapping.
429
430c) If a file residing on a lower layer is being executed, then opening that
431file for write or truncating the file will not be denied with ETXTBSY.
432
433The following options allow overlayfs to act more like a standards
434compliant filesystem:
435
4361) "redirect_dir"
437
438Enabled with the mount option or module option: "redirect_dir=on" or with
439the kernel config option CONFIG_OVERLAY_FS_REDIRECT_DIR=y.
440
441If this feature is disabled, then rename(2) on a lower or merged directory
442will fail with EXDEV ("Invalid cross-device link").
443
4442) "inode index"
445
446Enabled with the mount option or module option "index=on" or with the
447kernel config option CONFIG_OVERLAY_FS_INDEX=y.
448
449If this feature is disabled and a file with multiple hard links is copied
450up, then this will "break" the link.  Changes will not be propagated to
451other names referring to the same inode.
452
4533) "xino"
454
455Enabled with the mount option "xino=auto" or "xino=on", with the module
456option "xino_auto=on" or with the kernel config option
457CONFIG_OVERLAY_FS_XINO_AUTO=y.  Also implicitly enabled by using the same
458underlying filesystem for all layers making up the overlay.
459
460If this feature is disabled or the underlying filesystem doesn't have
461enough free bits in the inode number, then overlayfs will not be able to
462guarantee that the values of st_ino and st_dev returned by stat(2) and the
463value of d_ino returned by readdir(3) will act like on a normal filesystem.
464E.g. the value of st_dev may be different for two objects in the same
465overlay filesystem and the value of st_ino for filesystem objects may not be
466persistent and could change even while the overlay filesystem is mounted, as
467summarized in the `Inode properties`_ table above.
468
469
470Changes to underlying filesystems
471---------------------------------
472
473Changes to the underlying filesystems while part of a mounted overlay
474filesystem are not allowed.  If the underlying filesystem is changed,
475the behavior of the overlay is undefined, though it will not result in
476a crash or deadlock.
477
478Offline changes, when the overlay is not mounted, are allowed to the
479upper tree.  Offline changes to the lower tree are only allowed if the
480"metadata only copy up", "inode index", "xino" and "redirect_dir" features
481have not been used.  If the lower tree is modified and any of these
482features has been used, the behavior of the overlay is undefined,
483though it will not result in a crash or deadlock.
484
485When the overlay NFS export feature is enabled, overlay filesystems
486behavior on offline changes of the underlying lower layer is different
487than the behavior when NFS export is disabled.
488
489On every copy_up, an NFS file handle of the lower inode, along with the
490UUID of the lower filesystem, are encoded and stored in an extended
491attribute "trusted.overlay.origin" on the upper inode.
492
493When the NFS export feature is enabled, a lookup of a merged directory,
494that found a lower directory at the lookup path or at the path pointed
495to by the "trusted.overlay.redirect" extended attribute, will verify
496that the found lower directory file handle and lower filesystem UUID
497match the origin file handle that was stored at copy_up time.  If a
498found lower directory does not match the stored origin, that directory
499will not be merged with the upper directory.
500
501
502
503NFS export
504----------
505
506When the underlying filesystems supports NFS export and the "nfs_export"
507feature is enabled, an overlay filesystem may be exported to NFS.
508
509With the "nfs_export" feature, on copy_up of any lower object, an index
510entry is created under the index directory.  The index entry name is the
511hexadecimal representation of the copy up origin file handle.  For a
512non-directory object, the index entry is a hard link to the upper inode.
513For a directory object, the index entry has an extended attribute
514"trusted.overlay.upper" with an encoded file handle of the upper
515directory inode.
516
517When encoding a file handle from an overlay filesystem object, the
518following rules apply:
519
5201. For a non-upper object, encode a lower file handle from lower inode
5212. For an indexed object, encode a lower file handle from copy_up origin
5223. For a pure-upper object and for an existing non-indexed upper object,
523   encode an upper file handle from upper inode
524
525The encoded overlay file handle includes:
526 - Header including path type information (e.g. lower/upper)
527 - UUID of the underlying filesystem
528 - Underlying filesystem encoding of underlying inode
529
530This encoding format is identical to the encoding format file handles that
531are stored in extended attribute "trusted.overlay.origin".
532
533When decoding an overlay file handle, the following steps are followed:
534
5351. Find underlying layer by UUID and path type information.
5362. Decode the underlying filesystem file handle to underlying dentry.
5373. For a lower file handle, lookup the handle in index directory by name.
5384. If a whiteout is found in index, return ESTALE. This represents an
539   overlay object that was deleted after its file handle was encoded.
5405. For a non-directory, instantiate a disconnected overlay dentry from the
541   decoded underlying dentry, the path type and index inode, if found.
5426. For a directory, use the connected underlying decoded dentry, path type
543   and index, to lookup a connected overlay dentry.
544
545Decoding a non-directory file handle may return a disconnected dentry.
546copy_up of that disconnected dentry will create an upper index entry with
547no upper alias.
548
549When overlay filesystem has multiple lower layers, a middle layer
550directory may have a "redirect" to lower directory.  Because middle layer
551"redirects" are not indexed, a lower file handle that was encoded from the
552"redirect" origin directory, cannot be used to find the middle or upper
553layer directory.  Similarly, a lower file handle that was encoded from a
554descendant of the "redirect" origin directory, cannot be used to
555reconstruct a connected overlay path.  To mitigate the cases of
556directories that cannot be decoded from a lower file handle, these
557directories are copied up on encode and encoded as an upper file handle.
558On an overlay filesystem with no upper layer this mitigation cannot be
559used NFS export in this setup requires turning off redirect follow (e.g.
560"redirect_dir=nofollow").
561
562The overlay filesystem does not support non-directory connectable file
563handles, so exporting with the 'subtree_check' exportfs configuration will
564cause failures to lookup files over NFS.
565
566When the NFS export feature is enabled, all directory index entries are
567verified on mount time to check that upper file handles are not stale.
568This verification may cause significant overhead in some cases.
569
570Note: the mount options index=off,nfs_export=on are conflicting for a
571read-write mount and will result in an error.
572
573Note: the mount option uuid=off can be used to replace UUID of the underlying
574filesystem in file handles with null, and effectively disable UUID checks. This
575can be useful in case the underlying disk is copied and the UUID of this copy
576is changed. This is only applicable if all lower/upper/work directories are on
577the same filesystem, otherwise it will fallback to normal behaviour.
578
579Volatile mount
580--------------
581
582This is enabled with the "volatile" mount option.  Volatile mounts are not
583guaranteed to survive a crash.  It is strongly recommended that volatile
584mounts are only used if data written to the overlay can be recreated
585without significant effort.
586
587The advantage of mounting with the "volatile" option is that all forms of
588sync calls to the upper filesystem are omitted.
589
590In order to avoid a giving a false sense of safety, the syncfs (and fsync)
591semantics of volatile mounts are slightly different than that of the rest of
592VFS.  If any writeback error occurs on the upperdir's filesystem after a
593volatile mount takes place, all sync functions will return an error.  Once this
594condition is reached, the filesystem will not recover, and every subsequent sync
595call will return an error, even if the upperdir has not experience a new error
596since the last sync call.
597
598When overlay is mounted with "volatile" option, the directory
599"$workdir/work/incompat/volatile" is created.  During next mount, overlay
600checks for this directory and refuses to mount if present. This is a strong
601indicator that user should throw away upper and work directories and create
602fresh one. In very limited cases where the user knows that the system has
603not crashed and contents of upperdir are intact, The "volatile" directory
604can be removed.
605
606
607User xattr
608----------
609
610The the "-o userxattr" mount option forces overlayfs to use the
611"user.overlay." xattr namespace instead of "trusted.overlay.".  This is
612useful for unprivileged mounting of overlayfs.
613
614
615Testsuite
616---------
617
618There's a testsuite originally developed by David Howells and currently
619maintained by Amir Goldstein at:
620
621  https://github.com/amir73il/unionmount-testsuite.git
622
623Run as root:
624
625  # cd unionmount-testsuite
626  # ./run --ov --verify
627