All of lore.kernel.org
 help / color / mirror / Atom feed
* [RFC PATCH 0/1] xattr: Allow user.* xattr on symlink/special files if caller has CAP_SYS_RESOURCE
@ 2021-06-25 19:12 ` Vivek Goyal
  0 siblings, 0 replies; 76+ messages in thread
From: Vivek Goyal @ 2021-06-25 19:12 UTC (permalink / raw)
  To: linux-fsdevel, linux-kernel, viro
  Cc: virtio-fs, dwalsh, dgilbert, berrange, vgoyal

Hi,

In virtiofs, actual file server is virtiosd daemon running on host.
There we have a mode where xattrs can be remapped to something else.
For example security.selinux can be remapped to
user.virtiofsd.securit.selinux on the host.

This remapping is useful when SELinux is enabled in guest and virtiofs
as being used as rootfs. Guest and host SELinux policy might not match
and host policy might deny security.selinux xattr setting by guest
onto host. Or host might have SELinux disabled and in that case to
be able to set security.selinux xattr, virtiofsd will need to have
CAP_SYS_ADMIN (which we are trying to avoid). Being able to remap
guest security.selinux (or other xattrs) on host to something else
is also better from security point of view.

But when we try this, we noticed that SELinux relabeling in guest
is failing on some symlinks. When I debugged a little more, I 
came to know that "user.*" xattrs are not allowed on symlinks
or special files.

"man xattr" seems to suggest that primary reason to disallow is
that arbitrary users can set unlimited amount of "user.*" xattrs
on these files and bypass quota check.

If that's the primary reason, I am wondering is it possible to relax
the restrictions if caller has CAP_SYS_RESOURCE. This capability
allows caller to bypass quota checks. So it should not be
a problem atleast from quota perpective.

That will allow me to give CAP_SYS_RESOURCE to virtiofs deamon
and remap xattrs arbitrarily. 

Thanks
Vivek

Vivek Goyal (1):
  xattr: Allow user.* xattr on symlink/special files with
    CAP_SYS_RESOURCE

 fs/xattr.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

-- 
2.25.4


^ permalink raw reply	[flat|nested] 76+ messages in thread

end of thread, other threads:[~2021-07-01 16:58 UTC | newest]

Thread overview: 76+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-06-25 19:12 [RFC PATCH 0/1] xattr: Allow user.* xattr on symlink/special files if caller has CAP_SYS_RESOURCE Vivek Goyal
2021-06-25 19:12 ` [Virtio-fs] " Vivek Goyal
2021-06-25 19:12 ` [PATCH 1/1] xattr: Allow user.* xattr on symlink/special files with CAP_SYS_RESOURCE Vivek Goyal
2021-06-25 19:12   ` [Virtio-fs] " Vivek Goyal
2021-06-28 12:33   ` Christian Brauner
2021-06-28 12:33     ` [Virtio-fs] " Christian Brauner
2021-06-28 15:00   ` Vivek Goyal
2021-06-28 15:00     ` [Virtio-fs] " Vivek Goyal
2021-06-29  3:13   ` [xattr] 8d8cd767b6: ltp.setxattr02.fail kernel test robot
2021-06-29  3:13     ` [Virtio-fs] " kernel test robot
2021-06-29  3:13     ` kernel test robot
2021-06-29  3:13     ` [LTP] " kernel test robot
2021-06-29 12:59     ` Vivek Goyal
2021-06-29 12:59       ` [Virtio-fs] " Vivek Goyal
2021-06-29 12:59       ` Vivek Goyal
2021-06-29 12:59       ` [LTP] " Vivek Goyal
2021-06-25 21:49 ` [RFC PATCH 0/1] xattr: Allow user.* xattr on symlink/special files if caller has CAP_SYS_RESOURCE Schaufler, Casey
2021-06-25 21:49   ` [Virtio-fs] " Schaufler, Casey
2021-06-28 11:58   ` Dr. David Alan Gilbert
2021-06-28 11:58     ` [Virtio-fs] " Dr. David Alan Gilbert
2021-06-28 13:17   ` Vivek Goyal
2021-06-28 13:17     ` [Virtio-fs] " Vivek Goyal
2021-06-28 13:36     ` Daniel Walsh
2021-06-28 13:36       ` [Virtio-fs] " Daniel Walsh
2021-06-28 16:04       ` Casey Schaufler
2021-06-28 16:04         ` [Virtio-fs] " Casey Schaufler
2021-06-28 16:28         ` Dr. David Alan Gilbert
2021-06-28 16:28           ` [Virtio-fs] " Dr. David Alan Gilbert
2021-06-28 17:41           ` Casey Schaufler
2021-06-28 17:41             ` [Virtio-fs] " Casey Schaufler
2021-06-29  9:00             ` Dr. David Alan Gilbert
2021-06-29  9:00               ` [Virtio-fs] " Dr. David Alan Gilbert
2021-06-29 14:38               ` Casey Schaufler
2021-06-29 14:38                 ` [Virtio-fs] " Casey Schaufler
2021-06-29 15:20                 ` Vivek Goyal
2021-06-29 15:20                   ` [Virtio-fs] " Vivek Goyal
2021-06-29 16:13                   ` Casey Schaufler
2021-06-29 16:13                     ` [Virtio-fs] " Casey Schaufler
2021-06-29 16:35                     ` Dr. David Alan Gilbert
2021-06-29 16:35                       ` [Virtio-fs] " Dr. David Alan Gilbert
2021-06-29 16:51                       ` Casey Schaufler
2021-06-29 16:51                         ` [Virtio-fs] " Casey Schaufler
2021-06-29 17:35                     ` Vivek Goyal
2021-06-29 17:35                       ` [Virtio-fs] " Vivek Goyal
2021-06-29 20:28                       ` Daniel Walsh
2021-06-29 20:28                         ` [Virtio-fs] " Daniel Walsh
2021-06-30  4:12                         ` Theodore Ts'o
2021-06-30  4:12                           ` [Virtio-fs] " Theodore Ts'o
2021-06-30  8:07                           ` Dr. David Alan Gilbert
2021-06-30  8:07                             ` [Virtio-fs] " Dr. David Alan Gilbert
2021-06-30 14:47                             ` Theodore Ts'o
2021-06-30 14:47                               ` [Virtio-fs] " Theodore Ts'o
2021-06-30 15:01                               ` Dr. David Alan Gilbert
2021-06-30 15:01                                 ` [Virtio-fs] " Dr. David Alan Gilbert
2021-06-30 19:59                                 ` Theodore Ts'o
2021-06-30 19:59                                   ` [Virtio-fs] " Theodore Ts'o
2021-06-30 20:32                                   ` Vivek Goyal
2021-06-30 20:32                                     ` [Virtio-fs] " Vivek Goyal
2021-07-01  8:48                                   ` Dr. David Alan Gilbert
2021-07-01  8:48                                     ` [Virtio-fs] " Dr. David Alan Gilbert
2021-07-01 12:21                                     ` Vivek Goyal
2021-07-01 12:21                                       ` [Virtio-fs] " Vivek Goyal
2021-07-01 13:10                                     ` Vivek Goyal
2021-07-01 13:10                                       ` [Virtio-fs] " Vivek Goyal
2021-07-01 16:58                                       ` Casey Schaufler
2021-07-01 16:58                                         ` [Virtio-fs] " Casey Schaufler
2021-06-30 16:09                               ` Vivek Goyal
2021-06-30 16:09                                 ` [Virtio-fs] " Vivek Goyal
2021-06-30 14:27                           ` Vivek Goyal
2021-06-30 14:27                             ` [Virtio-fs] " Vivek Goyal
2021-06-29 16:25                 ` Theodore Ts'o
2021-06-29 16:25                   ` [Virtio-fs] " Theodore Ts'o
2021-06-28 17:22         ` Vivek Goyal
2021-06-28 17:22           ` [Virtio-fs] " Vivek Goyal
2021-06-28 18:55         ` Daniel Walsh
2021-06-28 18:55           ` [Virtio-fs] " Daniel Walsh

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.