From: Andreas Gruenbacher <agruenba@redhat.com>
To: Vivek Goyal <vgoyal@redhat.com>
Cc: fstests <fstests@vger.kernel.org>,
linux-fsdevel <linux-fsdevel@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
virtio-fs@redhat.com, dwalsh@redhat.com, dgilbert@redhat.com,
christian.brauner@ubuntu.com, casey.schaufler@intel.com,
LSM <linux-security-module@vger.kernel.org>,
selinux@vger.kernel.org, "Theodore Ts'o" <tytso@mit.edu>,
Miklos Szeredi <miklos@szeredi.hu>,
gscrivan@redhat.com, "Fields, Bruce" <bfields@redhat.com>,
stephen.smalley.work@gmail.com,
Dave Chinner <david@fromorbit.com>,
Alexander Viro <viro@zeniv.linux.org.uk>
Subject: Re: [PATCH 3/1] xfstests: generic/062: Do not run on newer kernels
Date: Fri, 3 Sep 2021 08:56:08 +0200 [thread overview]
Message-ID: <CAHc6FU5quZWQtZ3fRfM_ZseUsweEbJA0aAkZvQEF5u9MJhrqdQ@mail.gmail.com> (raw)
In-Reply-To: <CAHc6FU4ytU5eo4bmJcL6MW+qJZAtYTX0=wTZnv4myhDBv-qZHQ@mail.gmail.com>
On Fri, Sep 3, 2021 at 8:31 AM Andreas Gruenbacher <agruenba@redhat.com> wrote:
> On Thu, Sep 2, 2021 at 5:47 PM Vivek Goyal <vgoyal@redhat.com> wrote:
> > xfstests: generic/062: Do not run on newer kernels
> >
> > This test has been written with assumption that setting user.* xattrs will
> > fail on symlink and special files. When newer kernels support setting
> > user.* xattrs on symlink and special files, this test starts failing.
>
> It's actually a good thing that this test case triggers for the kernel
> change you're proposing; that change should never be merged. The
> user.* namespace is meant for data with the same access permissions as
> the file data, and it has been for many years. We may have
> applications that assume the existing behavior. In addition, this
> change would create backwards compatibility problems for things like
> backups.
>
> I'm not convinced that what you're actually proposing (mapping
> security.selinux to a different attribute name) actually makes sense,
> but that's a question for the selinux folks to decide. Mapping it to a
> user.* attribute is definitely wrong though. The modified behavior
> would affect anybody, not only users of selinux and/or virtiofs. If
> mapping attribute names is actually the right approach, then you need
> to look at trusted.* xattrs, which exist specifically for this kind of
> purpose. You've noted that trusted.* xattrs aren't supported over nfs.
> That's unfortunate, but not an acceptable excuse for messing up user.*
> xattrs.
Another possibility would be to make selinux use a different
security.* attribute for this nested selinux case. That way, the
"host" selinux would retain some control over the labels the "guest"
uses.
Thanks,
Andreas
next prev parent reply other threads:[~2021-09-03 6:56 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-02 15:22 [PATCH v3 0/1] Relax restrictions on user.* xattr Vivek Goyal
2021-09-02 15:22 ` [PATCH v3 1/1] xattr: Allow user.* xattr on symlink and special files Vivek Goyal
2021-09-02 15:38 ` [PATCH 2/1] man-pages: xattr.7: Update text for user extended xattr behavior change Vivek Goyal
2021-09-02 15:43 ` [PATCH v3 0/1] Relax restrictions on user.* xattr Casey Schaufler
2021-09-02 17:05 ` Vivek Goyal
2021-09-02 17:42 ` Vivek Goyal
2021-09-02 18:55 ` Casey Schaufler
2021-09-02 20:06 ` Vivek Goyal
2021-09-02 22:34 ` Casey Schaufler
2021-09-03 15:26 ` Vivek Goyal
2021-09-03 18:49 ` Casey Schaufler
2021-09-06 7:45 ` [Virtio-fs] " Sergio Lopez
2021-09-06 14:55 ` Dr. David Alan Gilbert
2021-09-13 19:05 ` Casey Schaufler
2021-09-14 12:51 ` Vivek Goyal
2021-09-14 13:56 ` Casey Schaufler
2021-09-14 13:59 ` Bruce Fields
2021-09-14 14:32 ` Vivek Goyal
2021-09-14 15:01 ` Bruce Fields
2021-09-15 16:33 ` Dr. Greg
2021-09-02 15:47 ` [PATCH 3/1] xfstests: generic/062: Do not run on newer kernels Vivek Goyal
2021-09-03 4:55 ` Dave Chinner
2021-09-03 6:31 ` Andreas Gruenbacher
2021-09-03 6:56 ` Andreas Gruenbacher [this message]
2021-09-03 14:42 ` Bruce Fields
2021-09-03 15:43 ` Vivek Goyal
2021-09-03 15:50 ` Bruce Fields
2021-09-03 16:01 ` Casey Schaufler
2021-09-03 16:03 ` Vivek Goyal
2021-09-03 6:31 ` Zorro Lang
2021-09-02 15:50 ` [PATCH 4/1] xfstest: Add a new test to test xattr operations Vivek Goyal
2021-09-02 17:52 ` [PATCH v3 0/1] Relax restrictions on user.* xattr Andreas Gruenbacher
2021-09-02 18:48 ` Vivek Goyal
2021-09-02 19:19 ` Casey Schaufler
2021-09-06 14:39 ` Dr. David Alan Gilbert
2021-09-06 14:56 ` Miklos Szeredi
2021-09-07 21:40 ` Vivek Goyal
2021-09-08 7:37 ` Miklos Szeredi
2021-09-08 14:20 ` Eric W. Biederman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAHc6FU5quZWQtZ3fRfM_ZseUsweEbJA0aAkZvQEF5u9MJhrqdQ@mail.gmail.com \
--to=agruenba@redhat.com \
--cc=bfields@redhat.com \
--cc=casey.schaufler@intel.com \
--cc=christian.brauner@ubuntu.com \
--cc=david@fromorbit.com \
--cc=dgilbert@redhat.com \
--cc=dwalsh@redhat.com \
--cc=fstests@vger.kernel.org \
--cc=gscrivan@redhat.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=miklos@szeredi.hu \
--cc=selinux@vger.kernel.org \
--cc=stephen.smalley.work@gmail.com \
--cc=tytso@mit.edu \
--cc=vgoyal@redhat.com \
--cc=viro@zeniv.linux.org.uk \
--cc=virtio-fs@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).