graphdriver/fuse-overlayfs: Remove redundant dir chown

[vvoland]

Init already creates the driver home with the required ownership. Avoid calling MkdirAllAndChown on it again during every layer creation.

Summary

Release notes (optional)

A picture of a cute animal (not mandatory but encouraged)

[Copilot]

Pull request overview

This PR removes a per-layer MkdirAllAndChown(path.Dir(dir), ...) call in the fuse-overlayfs graphdriver’s create() path, relying on Init() to have already created and chowned the driver home directory. The intent is to avoid repeated ownership work on every layer creation.

Changes:

• Remove redundant MkdirAllAndChown() of the driver home directory from (*Driver).create().
• Keep per-layer directory creation (MkdirAndChown(dir, ...)) unchanged.

[thaJeztah]

The path is created in the driver's init function

moby/daemon/graphdriver/fuse-overlayfs/fuseoverlayfs.go

Lines 76 to 92 in b780867

	func Init(home string, options []string, idMap user.IdentityMapping) (graphdriver.Driver, error) {
	if _, err := exec.LookPath(binary); err != nil {
	logger.Error(err)
	return nil, graphdriver.ErrNotSupported
	}
	if !kernel.CheckKernelVersion(4, 18, 0) {
	return nil, graphdriver.ErrNotSupported
	}
	cuid := os.Getuid()
	_, gid := idMap.RootPair()
	if err := user.MkdirAllAndChown(home, 0o710, cuid, gid); err != nil {
	return nil, err
	}
	if err := user.MkdirAllAndChown(path.Join(home, linkDir), 0o700, cuid, os.Getegid()); err != nil {
	return nil, err
	}

Which is registered as the init function for the driver, so executed at startup;

moby/daemon/graphdriver/fuse-overlayfs/fuseoverlayfs.go

Line 70 in b780867

graphdriver.Register(driverName, Init)

[thaJeztah]

LGTM

[thaJeztah]

Had another look at this, and probably needs a follow-up; looks like the same is the case for overlay2 (maybe others)

moby/daemon/graphdriver/overlay2/overlay.go

Lines 346 to 356 in c77c96e

	func (d *Driver) create(id, parent string, opts *graphdriver.CreateOpts) (retErr error) {
	dir := d.dir(id)
	cuid := os.Getuid()
	uid, gid := d.idMap.RootPair()
	if err := user.MkdirAllAndChown(path.Dir(dir), 0o710, cuid, gid); err != nil {
	return err
	}
	if err := user.MkdirAndChown(dir, 0o710, cuid, gid); err != nil {
	return err
	}

Some notes there;

Looks like this MkdirAllAndChown for the drivers' home because redundant after 03f1c3d

That was a security fix, to make sure the driver's home had the right permissions, and that added the MkdirAllAndChown in the Init function, but it left the one in Create;

• [master] forward-port security fixes from 20.10.9 #42907
• (forward-ported from); 93ac040

03f1c3d#diff-ed0b7987eccdde1bd70dc1ca9191f0ac2601e8f187024db5e3f968d755b9e47c

From the above, it looks to be intentional to overwrite existing mode for the directory BUT it may be too wide; MkdirAllAndChown is called without OnlyNew

moby/vendor/github.com/moby/sys/user/idtools.go

Lines 15 to 17 in c77c96e

	// WithOnlyNew is an option for MkdirAllAndChown that will only change ownership and permissions
	// on newly created directories. If the directory already exists, it will not be modified
	func WithOnlyNew(o *mkdirOptions) {

MkdirAllAndChown calls mkDirAs with mkAll =true

moby/vendor/github.com/moby/sys/user/idtools.go

Line 31 in c77c96e

return mkdirAs(path, mode, uid, gid, true, options.onlyNew)

Which means that any missing parent path would also be chown-ed and chmod-ed (the comment looks wrong because existing paths are handled earlier);

moby/vendor/github.com/moby/sys/user/idtools_unix.go

Lines 60 to 66 in c77c96e

	// even if it existed, we will chown the requested path + any subpaths that
	// didn't exist when we called MkdirAll
	for _, pathComponent := range paths {
	if err = setPermissions(pathComponent, mode, uid, gid, nil); err != nil {
	return err
	}
	}