Comment 16 for bug 1636890

I think I see what's going on. Ecryptfs copies up attributes from the lower filesystem's inode directly. However the practice of overlayfs is to only copy up i_uid, i_gid, and i_mode from the lower inode into the overlayfs inode, and to fetch other attributes from the lower inode on getattr.

The pattern I'm seeing is that inodes that overlayfs has "copied up" from the lowerdir to the upperdir show up okay. I suspect then that it's the vfs updating the timestamps in the overlayfs inodes whenever the event happens that triggered the copy-up.