OverlayFS

OverlayFS Stashed Credentials Separate Overlay Access from Backing Filesystem Access

OverlayFS Stashed Credentials Separate Overlay Access from Backing Filesystem Access A process opens a path through an OverlayFS mount and appears to access one ordinary filesystem object. The kernel may actually consult an upper layer, a lower layer, or both, and a write can trigger copy-up before the requested operation proceeds. That indirection creates an authorization problem: the caller must be permitted to use the object as exposed by the overlay, while the internal access to the backing filesystems must also run under a defined security identity.