Date: Tue, 29 Aug 2023 21:15:03 +0200 From: Felix Palmen <zirias@freebsd.org> To: current@freebsd.org Subject: Re: Possible issue with linux xattr support? Message-ID: <izo5sjuirgprs6dwcski2xtqqa3fqnjh47jpwrb5v4q4sqmark@3vybbvcdap4z> In-Reply-To: <af11b09e-7b93-7c17-a8b8-6cea86291176@FreeBSD.org> References: <pzu4sxp4wvfpn3mzzo2giw3otvg6z5ewia6rr2tdgpkjurfcfe@aat2k6ywm6jm> <ZOuoH6Llw8PKgMJQ@heemeyer.club> <wuwg3egv3rilgfaa5hor47v3yjwzvxlt5krj4la4wvugcnhkg3@vgrtgfr7rc6i> <EA27BAE1-C687-47F9-BB6D-B72A85A5CA8D@cschubert.com> <elx6cvceobzgw66fskkfhhicsdpsur5xaktluu5tk7m7p4qwno@s7qmm4kyuvag> <ZOzD9noXVrslppot@heemeyer.club> <smfbmu35sxh2f3hu5nrpdwb355trlucd2bbp4ag5ke7v3zf3il@s3ua2x4i3nzj> <ZO4En1UJqcr4GGiw@heemeyer.club> <20230829190258.uc67572553e4fq3v@mutt-hbsd> <af11b09e-7b93-7c17-a8b8-6cea86291176@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--yqp6s6wip2kmguhz Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable * Kyle Evans <kevans@FreeBSD.org> [20230829 14:07]: > On 8/29/23 14:02, Shawn Webb wrote: > > Back in 2019, I had a similar issue: I needed access to be able to > > read/write to the system extended attribute namespace from within a > > jailed context. I wrote a rather simple patch that provides that > > support on a per-jail basis: > >=20 > > https://git.hardenedbsd.org/hardenedbsd/HardenedBSD/-/commit/96c85982b4= 5e44a6105664c7068a92d0a61da2a3 > >=20 > > Hopefully that's useful to someone. > >=20 > > Thanks, > >=20 >=20 > FWIW (which likely isn't much), I like this approach much better; it makes > more sense to me that it's a feature controlled by the creator of the jail > and not one allowed just by using a compat ABI within a jail. Well, a typical GNU userland won't work in a jail without this, that's what I know now. But I'm certainly with you, it doesn't feel logical that a Linux binary can do something in a jail a FreeBSD binary can't. So, indeed, making it a jail option sounds better. Unless, bringing back a question raised earlier in this thread: What's the reason to restrict this in a jailed context in the first place? IOW, could it just be allowed unconditionally? Cheers, Felix --=20 Felix Palmen <zirias@FreeBSD.org> {private} felix@palmen-it.de -- ports committer -- {web} http://palmen-it.de {pgp public key} http://palmen-it.de/pub.txt {pgp fingerprint} 6936 13D5 5BBF 4837 B212 3ACC 54AD E006 9879 F231 --yqp6s6wip2kmguhz Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iNUEABYKAH0WIQRpNhPVW79IN7ISOsxUreAGmHnyMQUCZO5DsV8UgAAAAAAuAChp c3N1ZXItZnByQG5vdGF0aW9ucy5vcGVucGdwLmZpZnRoaG9yc2VtYW4ubmV0Njkz NjEzRDU1QkJGNDgzN0IyMTIzQUNDNTRBREUwMDY5ODc5RjIzMQAKCRBUreAGmHny MTaDAQC8CMMvBgCn/J9mCMO8zUZnR7JJ9lWfGXCB0ydSTyfObAEAzRTeb4rBIkqE oiQHN5tBxm3rOpEzo2RLM9TVmErM1ww= =dO54 -----END PGP SIGNATURE----- --yqp6s6wip2kmguhz--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?izo5sjuirgprs6dwcski2xtqqa3fqnjh47jpwrb5v4q4sqmark>