Date: Tue, 29 Aug 2023 19:02:22 +0200 From: Felix Palmen <zirias@freebsd.org> To: current@freebsd.org Subject: Re: Possible issue with linux xattr support? Message-ID: <uvavvxn7vgjhf5fswoxcawuolvviq2idedxyt4fe6vtjlewsex@aqssespkdh4e> In-Reply-To: <ZO4En1UJqcr4GGiw@heemeyer.club> References: <3q2k3tje2ig2s6wzy4hzvjmoyejiecminvcvevivumtukxrgki@btnpjbztyfa6> <ZOuNvisMH_GXHHX2@heemeyer.club> <pzu4sxp4wvfpn3mzzo2giw3otvg6z5ewia6rr2tdgpkjurfcfe@aat2k6ywm6jm> <ZOuoH6Llw8PKgMJQ@heemeyer.club> <wuwg3egv3rilgfaa5hor47v3yjwzvxlt5krj4la4wvugcnhkg3@vgrtgfr7rc6i> <EA27BAE1-C687-47F9-BB6D-B72A85A5CA8D@cschubert.com> <elx6cvceobzgw66fskkfhhicsdpsur5xaktluu5tk7m7p4qwno@s7qmm4kyuvag> <ZOzD9noXVrslppot@heemeyer.club> <smfbmu35sxh2f3hu5nrpdwb355trlucd2bbp4ag5ke7v3zf3il@s3ua2x4i3nzj> <ZO4En1UJqcr4GGiw@heemeyer.club>
next in thread | previous in thread | raw e-mail | index | archive | help
--a3db4e65lkqu7zix Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable * Dmitry Chagin <dchagin@freebsd.org> [20230829 17:45]: > On Tue, Aug 29, 2023 at 12:59:11PM +0200, Felix Palmen wrote: > > Thanks, I can confirm this avoids the issue in both cases I experienced > > (install from GNU coreutils and python). > >=20 > thanks, this is the first half of the fix, it works for you due to you > are running tools under unprivileged user, afaiu. The second I have > tested by myself :) Sure, poudriere is running all builds as "nobody" by default. > > If I understand this patch correctly, it completely avoids EPERM, > > masking it as not supported, so callers should consider it non-fatal, > > allowing to silently ignore writing of "system" attributes while still > > keeping other functionality? > >=20 > system namespace is accessible only for privileged user, for others Linux > returns ENOTSUP. So many tools ignores this error, eg ls. >=20 > the second: https://people.freebsd.org/~dchagin/sea_jailed.patch Ok, I did some tests in a poudriere jail using Linux bash, as root. First, with only the first patch: | bash-5.2# getfattr -d /bin/sh | getfattr: /bin/sh: Operation not supported | bash-5.2# setfattr -n user.foo -v bar /bin/sh | bash-5.2# getfattr -n user.foo /bin/sh | getfattr: Removing leading '/' from absolute path names | # file: bin/sh | user.foo=3D"bar" | bash-5.2# setfattr -x user.foo /bin/sh | bash-5.2# setfattr -x system.foo /bin/sh | setfattr: /bin/sh: Operation not supported So, using user.* works, using system.* doesn't, and maybe a bit surprising(?), dumping all attributes which by default excludes the system namespace doesn't work either. Then with the second patch applied as well: | bash-5.2# getfattr -d /bin/sh | bash-5.2# setfattr -n system.foo -v bar /bin/sh | bash-5.2# getfattr -d /bin/sh -m- | getfattr: Removing leading '/' from absolute path names | # file: bin/sh | system.foo=3D"bar" |=20 | bash-5.2# setfattr -x system.foo /bin/sh | bash-5.2# getfattr -d /bin/sh -m- | bash-5.2# This looks perfectly fine, thanks a lot! I still wonder, is the first patch needed anyways? Maybe I fail to understand something here. Won't it map *every* EPERM to ENOSUP and can't this be an issue? Cheers, Felix --=20 Felix Palmen <zirias@FreeBSD.org> {private} felix@palmen-it.de -- ports committer -- {web} http://palmen-it.de {pgp public key} http://palmen-it.de/pub.txt {pgp fingerprint} 6936 13D5 5BBF 4837 B212 3ACC 54AD E006 9879 F231 --a3db4e65lkqu7zix Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iNUEABYKAH0WIQRpNhPVW79IN7ISOsxUreAGmHnyMQUCZO4kj18UgAAAAAAuAChp c3N1ZXItZnByQG5vdGF0aW9ucy5vcGVucGdwLmZpZnRoaG9yc2VtYW4ubmV0Njkz NjEzRDU1QkJGNDgzN0IyMTIzQUNDNTRBREUwMDY5ODc5RjIzMQAKCRBUreAGmHny McBUAQChmO4kixIRXyxXusZ4N1YgnFbrLhMzYRLSIZdZ9q/5hQD/Zxt9giKs9TID loW+qOODNJJramUr6cJ1AFL9QbdIjAs= =GjFg -----END PGP SIGNATURE----- --a3db4e65lkqu7zix--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?uvavvxn7vgjhf5fswoxcawuolvviq2idedxyt4fe6vtjlewsex>