From 83a8b309e949df4b8f82f26085cd62284f9eeb87 Mon Sep 17 00:00:00 2001 From: Nicolas Lacasse Date: Wed, 26 Aug 2020 10:03:46 -0700 Subject: tmpfs: Allow xattrs in the trusted namespace if creds has CAP_SYS_ADMIN. This is needed to support the overlay opaque attribute. PiperOrigin-RevId: 328552985 --- pkg/sentry/fsimpl/overlay/filesystem.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'pkg/sentry/fsimpl/overlay/filesystem.go') diff --git a/pkg/sentry/fsimpl/overlay/filesystem.go b/pkg/sentry/fsimpl/overlay/filesystem.go index a3cee4047..e720bfb0b 100644 --- a/pkg/sentry/fsimpl/overlay/filesystem.go +++ b/pkg/sentry/fsimpl/overlay/filesystem.go @@ -30,7 +30,7 @@ import ( // _OVL_XATTR_OPAQUE is an extended attribute key whose value is set to "y" for // opaque directories. // Linux: fs/overlayfs/overlayfs.h:OVL_XATTR_OPAQUE -const _OVL_XATTR_OPAQUE = "trusted.overlay.opaque" +const _OVL_XATTR_OPAQUE = linux.XATTR_TRUSTED_PREFIX + "overlay.opaque" func isWhiteout(stat *linux.Statx) bool { return stat.Mode&linux.S_IFMT == linux.S_IFCHR && stat.RdevMajor == 0 && stat.RdevMinor == 0 -- cgit v1.2.3