Finding overlayfs whiteout files

In aufs, finding whiteout files is easy, as they are all named appended with ".wh.". Overlayfs is a bit more tricky.

I'm running EasyOS with overlayfs right now. The place where overlay whiteout files can be found, is in /mnt/.easy_rw/mainrw, which is the files and folders created in the current session, and running in RAM; ZRAM specifically. When the session is saved, usually at shutdown, the contents of mainrw will be written to /mnt/wkg/.session, for permanent storage.

In overlay, whiteout files are character devices, with major/minor numbers 0/0. In ROX-Filer, they look like this (the one on the right, that looks like a measuring tape):

The thing is though, we want only character devices with major/minor numbers 0/0. This is how we can recursively find them:

# find /mnt/.easy_rw/mainrw -type c -exec stat -c %n%t%T {} \;
/mnt/.easy_rw/mainrw/root/.pup_event/drive_sdb400
/mnt/.easy_rw/mainrw/root/.pup_event/drive_sdb500
/mnt/.easy_rw/mainrw/root/.pup_event/drive_sdb600
/mnt/.easy_rw/mainrw/root/.pup_event/drive_sdb300
/mnt/.easy_rw/mainrw/home/chromium/.config/chromium/Default/blob_storage/bda67b4f-b9f9-4f0e-b0de-0e71a52cfb5600

...prints the found file or folder, with "00" appended. It is easy to reject other character devices in a script, with this ($A being one of the found devices):

 [ "${A%00}" == "${A}" ] && continue
 A="${A%00}" #remove the "00"

To make things more difficult, from a finding point of view, overlay will set extended attributes (xattrs) on some folders. To find these, we need the 'getfattr' utility, which is part of the 'attr' package. This will find all files or folders with any xattrs set:

# getfattr -R -dm- /mnt/.easy_rw/mainrw

...which returns lots of hits. For example:

# file: mnt/.easy_rw/mainrw/var/local
trusted.overlay.impure="y"
trusted.overlay.origin=0sAPsdAAE63D9mBENHGJCgLEICu0Nu09QBAJZJ49Q=

# file: mnt/.easy_rw/mainrw/var/local/pup_event_frontend_scrn_x
trusted.overlay.origin=0sAPsdAAE63D9mBENHGJCgLEICu0NuE9cBAKy7IU8=

To be more specific, overlay creates xattrs named starting with "trusted.overlay.", so we can use a regular expression:

# getfattr -R -d --match='trusted\.overlay\..*' /mnt/.easy_rw/mainrw

To read about what these xattrs do, see the kernel documentation:

https://docs.kernel.org/filesystems/overlayfs.html   

Tags: easy