Fail unpacking images with xattrs to filesystems without xattr support
<!--
Please make sure you've read and understood our contributing guidelines;
https://github.com/moby/moby/blob/master/CONTRIBUTING.md

** Make sure all your commits include a signature generated with `git commit -s` **

For additional information on our contributing process, read our contributing
guide https://docs.docker.com/opensource/code/

If this is a bug fix, make sure your description includes "fixes #xxxx", or
"closes #xxxx"

Please provide the following information:
-->

**- What I did**
Following up https://github.com/moby/moby/pull/45420#issuecomment-1535047278, I made it a fatal error to untar a file with extended attributes to a destination which does not support extended attributes. I added an escape hatch to the `vfs` graph driver to allow users to opt back into the old, broken behaviour.

**- How I did it**
I made ignoring `EPERM` and `ENOTSUPP` errors from `lsetxattr` when extracting a file from a tarball conditional on a new `BestEffortXattrs` flag in `archive.TarOptions` and plumbed the flag through to the `vfs` driver. I added a new storage option `vfs.xattrs=i_want_broken_containers` to the driver to set the flag. A warning is logged at daemon startup and in `docker info` output if this storage option is enabled.

**- How to verify it**
With the new unit test

**- Description for the changelog**
<!--
Write a short (one line) summary that describes the changes in this
pull request for inclusion in the changelog:
-->
- Unpacking layers containing files with extended attributes onto a filesystem which does not support extended attributes will now fail. Previously, the extended attributes would be discarded if they could not be set, which could potentially result in containers malfunctioning. Most storage drivers already require the backing filesystem to support extended attributes so this change should have no impact on most users. The `vfs` driver is a notable exception; the previous behaviour can be restored by configuring it with `--storage-opt vfs.xattrs=i_want_broken_containers`. Enabling this storage option is highly discouraged and bug reports submitted against a daemon with this option set will be summarily closed without comment.

**- A picture of a cute animal (not mandatory but encouraged)**


daemon/graphdriver/vfs/driver.go
package vfs // import "github.com/docker/docker/daemon/graphdriver/vfs"

import (
	"fmt"
	"os"
	"path/filepath"

	"github.com/docker/docker/daemon/graphdriver"
	"github.com/docker/docker/errdefs"
	"github.com/docker/docker/pkg/containerfs"
	"github.com/docker/docker/pkg/idtools"
	"github.com/docker/docker/pkg/parsers"
	"github.com/docker/docker/quota"
	units "github.com/docker/go-units"
	"github.com/opencontainers/selinux/go-selinux/label"
	"github.com/pkg/errors"
)

var (
	// CopyDir defines the copy method to use.
	CopyDir = dirCopy
)

func init() {
	graphdriver.Register("vfs", Init)
}

// Init returns a new VFS driver.
// This sets the home directory for the driver and returns NaiveDiffDriver.
func Init(home string, options []string, idMap idtools.IdentityMapping) (graphdriver.Driver, error) {
	d := &Driver{
		home:      home,
		idMapping: idMap,
	}

	if err := d.parseOptions(options); err != nil {
		return nil, err
	}

	dirID := idtools.Identity{
		UID: idtools.CurrentIdentity().UID,
		GID: d.idMapping.RootPair().GID,
	}
	if err := idtools.MkdirAllAndChown(home, 0710, dirID); err != nil {
		return nil, err
	}

	setupDriverQuota(d)

	if size := d.getQuotaOpt(); !d.quotaSupported() && size > 0 {
		return nil, quota.ErrQuotaNotSupported
	}

	return graphdriver.NewNaiveDiffDriver(d, d.idMapping), nil
}

// Driver holds information about the driver, home directory of the driver.
// Driver implements graphdriver.ProtoDriver. It uses only basic vfs operations.
// In order to support layering, files are copied from the parent layer into the new layer. There is no copy-on-write support.
// Driver must be wrapped in NaiveDiffDriver to be used as a graphdriver.Driver
type Driver struct {
	driverQuota
	home      string
	idMapping idtools.IdentityMapping
}

func (d *Driver) String() string {
	return "vfs"
}

// Status is used for implementing the graphdriver.ProtoDriver interface. VFS does not currently have any status information.
func (d *Driver) Status() [][2]string {
	return nil
}

// GetMetadata is used for implementing the graphdriver.ProtoDriver interface. VFS does not currently have any meta data.
func (d *Driver) GetMetadata(id string) (map[string]string, error) {
	return nil, nil
}

// Cleanup is used to implement graphdriver.ProtoDriver. There is no cleanup required for this driver.
func (d *Driver) Cleanup() error {
	return nil
}

func (d *Driver) parseOptions(options []string) error {
	for _, option := range options {
		key, val, err := parsers.ParseKeyValueOpt(option)
		if err != nil {
			return errdefs.InvalidParameter(err)
		}
		switch key {
		case "size":
			size, err := units.RAMInBytes(val)
			if err != nil {
				return errdefs.InvalidParameter(err)
			}
			if err = d.setQuotaOpt(uint64(size)); err != nil {
				return errdefs.InvalidParameter(errors.Wrap(err, "failed to set option size for vfs"))
			}
		default:
			return errdefs.InvalidParameter(errors.Errorf("unknown option %s for vfs", key))
		}
	}
	return nil
}

// CreateReadWrite creates a layer that is writable for use as a container
// file system.
func (d *Driver) CreateReadWrite(id, parent string, opts *graphdriver.CreateOpts) error {
	quotaSize := d.getQuotaOpt()

	if opts != nil {
		for key, val := range opts.StorageOpt {
			switch key {
			case "size":
				if !d.quotaSupported() {
					return quota.ErrQuotaNotSupported
				}
				size, err := units.RAMInBytes(val)
				if err != nil {
					return errdefs.InvalidParameter(err)
				}
				quotaSize = uint64(size)
			default:
				return errdefs.InvalidParameter(errors.Errorf("Storage opt %s not supported", key))
			}
		}
	}

	return d.create(id, parent, quotaSize)
}

// Create prepares the filesystem for the VFS driver and copies the directory for the given id under the parent.
func (d *Driver) Create(id, parent string, opts *graphdriver.CreateOpts) error {
	if opts != nil && len(opts.StorageOpt) != 0 {
		return fmt.Errorf("--storage-opt is not supported for vfs on read-only layers")
	}

	return d.create(id, parent, 0)
}

func (d *Driver) create(id, parent string, size uint64) error {
	dir := d.dir(id)
	rootIDs := d.idMapping.RootPair()

	dirID := idtools.Identity{
		UID: idtools.CurrentIdentity().UID,
		GID: rootIDs.GID,
	}
	if err := idtools.MkdirAllAndChown(filepath.Dir(dir), 0710, dirID); err != nil {
		return err
	}
	if err := idtools.MkdirAndChown(dir, 0755, rootIDs); err != nil {
		return err
	}

	if size != 0 {
		if err := d.setupQuota(dir, size); err != nil {
			return err
		}
	}

	labelOpts := []string{"level:s0"}
	if _, mountLabel, err := label.InitLabels(labelOpts); err == nil {
		label.SetFileLabel(dir, mountLabel)
	}
	if parent == "" {
		return nil
	}
	parentDir, err := d.Get(parent, "")
	if err != nil {
		return fmt.Errorf("%s: %s", parent, err)
	}
	return CopyDir(parentDir, dir)
}

func (d *Driver) dir(id string) string {
	return filepath.Join(d.home, "dir", filepath.Base(id))
}

// Remove deletes the content from the directory for a given id.
func (d *Driver) Remove(id string) error {
	return containerfs.EnsureRemoveAll(d.dir(id))
}

// Get returns the directory for the given id.
func (d *Driver) Get(id, mountLabel string) (string, error) {
	dir := d.dir(id)
	if st, err := os.Stat(dir); err != nil {
		return "", err
	} else if !st.IsDir() {
		return "", fmt.Errorf("%s: not a directory", dir)
	}
	return dir, nil
}

// Put is a noop for vfs that return nil for the error, since this driver has no runtime resources to clean up.
func (d *Driver) Put(id string) error {
	// The vfs driver has no runtime resources (e.g. mounts)
	// to clean up, so we don't need anything here
	return nil
}

// Exists checks to see if the directory exists for the given id.
func (d *Driver) Exists(id string) bool {
	_, err := os.Stat(d.dir(id))
	return err == nil
}

package vfs // import "github.com/docker/docker/daemon/graphdriver/vfs"

import (
	"fmt"
	"os"
	"path/filepath"

	"github.com/docker/docker/daemon/graphdriver"
	"github.com/docker/docker/errdefs"
	"github.com/docker/docker/pkg/containerfs"
	"github.com/docker/docker/pkg/idtools"
	"github.com/docker/docker/pkg/parsers"
	"github.com/docker/docker/quota"
	units "github.com/docker/go-units"
	"github.com/opencontainers/selinux/go-selinux/label"
	"github.com/pkg/errors"
)

const (
	xattrsStorageOpt         = "vfs.xattrs"
	bestEffortXattrsOptValue = "i_want_broken_containers"
)

var (
	// CopyDir defines the copy method to use.
	CopyDir = dirCopy
)

func init() {
	graphdriver.Register("vfs", Init)
}

// Init returns a new VFS driver.
// This sets the home directory for the driver and returns NaiveDiffDriver.
func Init(home string, options []string, idMap idtools.IdentityMapping) (graphdriver.Driver, error) {
	d := &Driver{
		home:      home,
		idMapping: idMap,
	}

	if err := d.parseOptions(options); err != nil {
		return nil, err
	}

	dirID := idtools.Identity{
		UID: idtools.CurrentIdentity().UID,
		GID: d.idMapping.RootPair().GID,
	}
	if err := idtools.MkdirAllAndChown(home, 0710, dirID); err != nil {
		return nil, err
	}

	setupDriverQuota(d)

	if size := d.getQuotaOpt(); !d.quotaSupported() && size > 0 {
		return nil, quota.ErrQuotaNotSupported
	}

	return &graphdriver.NaiveDiffDriver{
		ProtoDriver:      d,
		IDMap:            d.idMapping,
		BestEffortXattrs: d.bestEffortXattrs,
	}, nil
}

// Driver holds information about the driver, home directory of the driver.
// Driver implements graphdriver.ProtoDriver. It uses only basic vfs operations.
// In order to support layering, files are copied from the parent layer into the new layer. There is no copy-on-write support.
// Driver must be wrapped in NaiveDiffDriver to be used as a graphdriver.Driver
type Driver struct {
	driverQuota
	home             string
	idMapping        idtools.IdentityMapping
	bestEffortXattrs bool
}

func (d *Driver) String() string {
	return "vfs"
}

// Status is used for implementing the graphdriver.ProtoDriver interface.
func (d *Driver) Status() [][2]string {
	if d.bestEffortXattrs {
		return [][2]string{
			// These strings are looked for in daemon/info_unix.go:fillDriverWarnings()
			// because plumbing is hard and temporary is forever. Forgive me.
			{"Extended file attributes", "best-effort"},
		}
	}
	return nil
}

// GetMetadata is used for implementing the graphdriver.ProtoDriver interface. VFS does not currently have any meta data.
func (d *Driver) GetMetadata(id string) (map[string]string, error) {
	return nil, nil
}

// Cleanup is used to implement graphdriver.ProtoDriver. There is no cleanup required for this driver.
func (d *Driver) Cleanup() error {
	return nil
}

func (d *Driver) parseOptions(options []string) error {
	for _, option := range options {
		key, val, err := parsers.ParseKeyValueOpt(option)
		if err != nil {
			return errdefs.InvalidParameter(err)
		}
		switch key {
		case "size":
			size, err := units.RAMInBytes(val)
			if err != nil {
				return errdefs.InvalidParameter(err)
			}
			if err = d.setQuotaOpt(uint64(size)); err != nil {
				return errdefs.InvalidParameter(errors.Wrap(err, "failed to set option size for vfs"))
			}
		case xattrsStorageOpt:
			if val != bestEffortXattrsOptValue {
				return errdefs.InvalidParameter(errors.Errorf("do not set the " + xattrsStorageOpt + " option unless you are willing to accept the consequences"))
			}
			d.bestEffortXattrs = true
		default:
			return errdefs.InvalidParameter(errors.Errorf("unknown option %s for vfs", key))
		}
	}
	return nil
}

// CreateReadWrite creates a layer that is writable for use as a container
// file system.
func (d *Driver) CreateReadWrite(id, parent string, opts *graphdriver.CreateOpts) error {
	quotaSize := d.getQuotaOpt()

	if opts != nil {
		for key, val := range opts.StorageOpt {
			switch key {
			case "size":
				if !d.quotaSupported() {
					return quota.ErrQuotaNotSupported
				}
				size, err := units.RAMInBytes(val)
				if err != nil {
					return errdefs.InvalidParameter(err)
				}
				quotaSize = uint64(size)
			default:
				return errdefs.InvalidParameter(errors.Errorf("Storage opt %s not supported", key))
			}
		}
	}

	return d.create(id, parent, quotaSize)
}

// Create prepares the filesystem for the VFS driver and copies the directory for the given id under the parent.
func (d *Driver) Create(id, parent string, opts *graphdriver.CreateOpts) error {
	if opts != nil && len(opts.StorageOpt) != 0 {
		return fmt.Errorf("--storage-opt is not supported for vfs on read-only layers")
	}

	return d.create(id, parent, 0)
}

func (d *Driver) create(id, parent string, size uint64) error {
	dir := d.dir(id)
	rootIDs := d.idMapping.RootPair()

	dirID := idtools.Identity{
		UID: idtools.CurrentIdentity().UID,
		GID: rootIDs.GID,
	}
	if err := idtools.MkdirAllAndChown(filepath.Dir(dir), 0710, dirID); err != nil {
		return err
	}
	if err := idtools.MkdirAndChown(dir, 0755, rootIDs); err != nil {
		return err
	}

	if size != 0 {
		if err := d.setupQuota(dir, size); err != nil {
			return err
		}
	}

	labelOpts := []string{"level:s0"}
	if _, mountLabel, err := label.InitLabels(labelOpts); err == nil {
		label.SetFileLabel(dir, mountLabel)
	}
	if parent == "" {
		return nil
	}
	parentDir, err := d.Get(parent, "")
	if err != nil {
		return fmt.Errorf("%s: %s", parent, err)
	}
	return CopyDir(parentDir, dir)
}

func (d *Driver) dir(id string) string {
	return filepath.Join(d.home, "dir", filepath.Base(id))
}

// Remove deletes the content from the directory for a given id.
func (d *Driver) Remove(id string) error {
	return containerfs.EnsureRemoveAll(d.dir(id))
}

// Get returns the directory for the given id.
func (d *Driver) Get(id, mountLabel string) (string, error) {
	dir := d.dir(id)
	if st, err := os.Stat(dir); err != nil {
		return "", err
	} else if !st.IsDir() {
		return "", fmt.Errorf("%s: not a directory", dir)
	}
	return dir, nil
}

// Put is a noop for vfs that return nil for the error, since this driver has no runtime resources to clean up.
func (d *Driver) Put(id string) error {
	// The vfs driver has no runtime resources (e.g. mounts)
	// to clean up, so we don't need anything here
	return nil
}

// Exists checks to see if the directory exists for the given id.
func (d *Driver) Exists(id string) bool {
	_, err := os.Stat(d.dir(id))
	return err == nil
}

As discussed, this could be `vfs.xattrs`