Don't verify write permissions on lower inodes on overlayfs

[mjg59]

If a user opens a file r/w on overlayfs, and if the underlying inode is
currently still on the lower fs, right now we're verifying whether selinux
policy permits writes to the selinux context on the underlying inode. This
is suboptimal, since we don't want confined processes to be able to write to
these files if they're able to escape from a container and so don't want to
permit this in policy. Have overlayfs pass down an additional flag when
verifying the permission on lower inodes, and mask off the write bits in
the selinux permissions check if that flag is set.

[mjg59]

coreos/bugs#1015

[vcaputo]

lgtm, though it feels naughty to be punching holes in selinux and assuming overlayfs will do the right thing with writes going to the upper layer.

Is there perhaps something simple we can do to assert this will always be the case to defend against overlayfs bugs? Perhaps beyond the scope of selinux, but thinking out loud here - it might be handy to have write operations detect if they're under overlayfs and always error.

[mjg59]

The semantics around how overlayfs should behave with SELinux aren't really terribly well figured out yet. We want a permissions check against the lower inode (at this point the upper inode doesn't exist), and at this point in the code we've pretty much handed off to the underlying filesystem and so there's very little awareness that we're coming from an overlay