Add uid shifting overlay filesystem (shiftfs)
Bug #1823186 reported by
Seth Forshee
This bug affects 1 person
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| linux (Ubuntu) |
Fix Released
|
Medium
|
Seth Forshee | ||
Bug Description
shiftfs transparently translates the on-disk ids of an underlaying filesystem into valid ids in a given user namespace. This is wanted in Ubuntu for LXD and Anbox and is targeted for inclusion in Disco.
The main advantage of shiftfs is that it provides signficiant performance benefits as it lets us avoid recursively chowning the root filesystem for unprivileged containers when they are created or when their idmap is changed. This becomes very important with workloads where we are running a huge number of containers which Anbox and LXD both are currently doing. Other container runtimes will benefit from shiftfs in Ubuntu as well.
CVE References
| Changed in linux (Ubuntu): | |
| status: | In Progress → Fix Committed |
Revision history for this message
| Launchpad Janitor (janitor) wrote | #1 |
Download full text (50.5 KiB)
| Changed in linux (Ubuntu): | |
| status: | Fix Committed → Fix Released |
| tags: | added: cscc |
To post a comment you must log in.
This bug was fixed in the package linux - 5.0.0-11.12
---------------
linux (5.0.0-11.12) disco; urgency=medium
* linux: 5.0.0-11.12 -proposed tracker (LP: #1824383)
* hns3: PPU_PF_
(LP: #1824194)
- net: hns3: fix for not calculating tx bd num correctly
* disco: unable to use iptables/enable ufw under -virtual kernel
(LP: #1823862)
- [Packaging] add bpfilter to linux-modules
* Make shiftfs a module rather than built-in (LP: #1824354)
- [Config] CONFIG_SHIFT_FS=m
* shiftfs: chown sets untranslated ids in lower fs (LP: #1824350)
- SAUCE: shiftfs: use translated ids when chaning lower fs attrs
* [Hyper-V] KVP daemon fails to start on first boot of disco VM (LP: #1820063)
- [Packaging] bind hv_kvp_daemon startup to hv_kvp device
linux (5.0.0-10.11) disco; urgency=medium
* linux: 5.0.0-10.11 -proposed tracker (LP: #1823936)
* Apparmor enforcement failure in lxc selftests (LP: #1823379)
- SAUCE: apparmor: Restore Y/N in /sys for apparmor's "enabled"
* systemd cause kernel trace "BUG: unable to handle kernel paging request at
6db23a14" on Cosmic i386 (LP: #1813244)
- openvswitch: fix flow actions reallocation
linux (5.0.0-9.10) disco; urgency=medium
* linux: 5.0.0-9.10 -proposed tracker (LP: #1823228)
* Packaging resync (LP: #1786013)
- [Packaging] resync git-ubuntu-log
- [Packaging] update helper scripts
- [Packaging] resync retpoline extraction
* Huawei Hi1822 NIC has poor performance (LP: #1820187)
- net-next/hinic: replace disable_
* Add uid shifting overlay filesystem (shiftfs) (LP: #1823186)
- shiftfs: uid/gid shifting bind mount
- shiftfs: rework and extend
- shiftfs: support some btrfs ioctls
- [Config] enable shiftfs
* Cannot boot or install - have to use nomodeset (LP: #1821820)
- Revert "drm/i915/fbdev: Actually configure untiled displays"
* Disco update: v5.0.6 upstream stable release (LP: #1823060)
- netfilter: nf_tables: fix set double-free in abort path
- dccp: do not use ipv6 header for ipv4 flow
- genetlink: Fix a memory leak on error path
- gtp: change NET_UDP_TUNNEL dependency to select
- ipv6: make ip6_create_rt_rcu return ip6_null_entry instead of NULL
- mac8390: Fix mmio access size probe
- mISDN: hfcpci: Test both vendor & device ID for Digium HFC4S
- net: aquantia: fix rx checksum offload for UDP/TCP over IPv6
- net: datagram: fix unbounded loop in __skb_try_
- net/packet: Set __GFP_NOWARN upon allocation in alloc_pg_vec
- net: phy: meson-gxl: fix interrupt support
- net: rose: fix a possible stack overflow
- net: stmmac: fix memory corruption with large MTUs
- net-sysfs: call dev_hold if kobject_
- net: usb: aqc111: Extend HWID table by QNAP device
- packets: Always register packet sk in the same order
- rhashtable: Still do rehash when we get EEXIST
- sctp: get sctphdr by offset in sctp_compute_cksum
- sctp: use memdup_user instead of vmemdup_user
- tcp: do not use ipv6 header for ipv4 flow
- tipc: allow servic...