archive mirror
 help / color / mirror / Atom feed
From: Vivek Goyal <>
Subject: [RFC PATCH v2 0/1] Relax restrictions on user.* xattr
Date: Thu,  8 Jul 2021 13:57:37 -0400	[thread overview]
Message-ID: <> (raw)


This is V2 of the patch. Posted V1 here.

Right now we don't allow setting user.* xattrs on symlinks and special
files at all. Initially I thought that real reason behind this
restriction is quota limitations but from last conversation it seemed
that real reason is that permission bits on symlink and special files
are special and different from regular files and directories, hence
this restriction is in place.

Given it probably is not a quota issue (I tested with xfs user quota
enabled and quota restrictions kicked in on symlink), I dropped the
idea of allowing user.* xattr if process has CAP_SYS_RESOURCE.

Instead this version of patch allows reading/writing user.* xattr
on symlink and special files if caller is owner or priviliged (has
CAP_FOWNER) w.r.t inode.

We need this for virtiofs daemon. I also found one more user. Giuseppe,
seems to set user.* xattr attrs on unpriviliged fuse-overlay as well
and he ran into similar issue. So fuse-overlay should benefit from
this change as well.

Who wants to set user.* xattr on symlink/special files

In virtiofs, actual file server is virtiosd daemon running on host.
There we have a mode where xattrs can be remapped to something else.
For example security.selinux can be remapped to
user.virtiofsd.securit.selinux on the host.

This remapping is useful when SELinux is enabled in guest and virtiofs
as being used as rootfs. Guest and host SELinux policy might not match
and host policy might deny security.selinux xattr setting by guest
onto host. Or host might have SELinux disabled and in that case to
be able to set security.selinux xattr, virtiofsd will need to have
CAP_SYS_ADMIN (which we are trying to avoid). Being able to remap
guest security.selinux (or other xattrs) on host to something else
is also better from security point of view.

But when we try this, we noticed that SELinux relabeling in guest
is failing on some symlinks. When I debugged a little more, I 
came to know that "user.*" xattrs are not allowed on symlinks
or special files.

So if we allow owner (or CAP_FOWNER) to set user.* xattr, it will
allow virtiofs to arbitrarily remap guests's xattrs to something
else on host and that solves this SELinux issue nicely and provides
two SELinux policies (host and guest) to co-exist nicely without
interfering with each other.


Vivek Goyal (1):
  xattr: Allow user.* xattr on symlink and special files

 fs/xattr.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)


             reply	other threads:[~2021-07-08 18:00 UTC|newest]

Thread overview: 19+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-07-08 17:57 Vivek Goyal [this message]
2021-07-08 17:57 ` [PATCH v2 1/1] xattr: Allow user.* xattr on symlink and special files Vivek Goyal
2021-07-09  9:19   ` Christian Brauner
2021-07-09 15:27     ` Vivek Goyal
2021-07-09 15:34       ` Casey Schaufler
2021-07-09 17:59         ` Vivek Goyal
2021-07-09 20:10           ` Bruce Fields
2021-07-12 14:02             ` Vivek Goyal
2021-07-12 15:41               ` J. Bruce Fields
2021-07-12 17:47                 ` Vivek Goyal
2021-07-12 19:31                   ` J. Bruce Fields
2021-07-12 21:22                     ` Vivek Goyal
2021-07-13 14:17                   ` Casey Schaufler
2021-08-30 18:45                     ` Vivek Goyal
2021-07-09 20:36         ` Theodore Ts'o
2021-07-12 17:50           ` Vivek Goyal
2021-07-12 12:49         ` [Virtio-fs] " Greg Kurz
2021-07-13 14:28           ` Casey Schaufler
2021-07-09 16:00 ` [RFC PATCH v2 0/1] Relax restrictions on user.* xattr Daniel Walsh

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \
    --subject='Re: [RFC PATCH v2 0/1] Relax restrictions on user.* xattr' \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).