aufs: apply dirperm1 by default if supported

[dqminh]

Automatically detect support for aufs dirperm1 option and apply it.
dirperm1 tells aufs to check the permission bits of the directory on the
topmost branch and ignore the permission bits on all lower branches.
It can be used to fix aufs' permission bug (i.e., upper layer having
broader mask than the lower layer).

dirperm1 man page is at: http://aufs.sourceforge.net/aufs3/man.html

Fixes #783

[dqminh]

cc @tiborvass

Also it seems like enabling dirperm1 makes remounting layer significantly slower (1+ms in my VM) ( happens when the user has a lot of layers that total length of mount options exceeds PAGE_SIZE ). TestMountMoreThan42Layers is much more slower with this patch.

[tiborvass]

+1 for this, I like it.

Ping @vbatts @unclejack feel free to step in to say if you don't like the way this is implemented.

[tiborvass]

should be

base, err := ioutil.TempDir("", "docker-aufs-base")
if err != nil {

Same for union, err :=

[tiborvass]

@jfrazelle this would be a great fix that a lot of people would welcome. Also it would close an issue with a 3-digit number :P

@dqminh would you mind removing the part that mentions the issue in some KNOWN issues section somewhere?

[dqminh]

would you mind removing the part that mentions the issue in some KNOWN issues section somewhere?

@tiborvass this won't fix it for system that doesnt have dirperm1 patch though, so I think we still need to keep the note. I can add some note about dirperm1 being set as the default option if it's available.

[tiborvass]

@dqminh fair enough! Thanks :)

[crosbymichael]

LGTM

[dqminh]

@tiborvass i added dirperm1 support status to docker info output too so there's an easy way to tell user whether their system is still affected by the permission bug.

[dqminh]

@tiborvass is this merge-able for 1.6, or is it too late now ?

[jessfraz]

I added the milestone @crosbymichael is that ok with you

[vbatts]

LGTM

[Blaisorblade]

While investigating some other (transient) docker problem, I saw this error (once) in my kernel log — is it a harmless error produced here while testing the presence of dirperm1? Google wasn't very helpful.

[   16.825747] aufs au_opts_parse:1155:docker[1679]: unknown option dirperm1

[Blaisorblade]

OK, I'm guessing yes:

# docker info | grep Dirperm1
 Dirperm1 Supported: false