From nobody Sat Aug 3 16:00:39 2024 X-Original-To: freebsd-hackers@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4WbnVL2v50z5SfDZ for ; Sat, 03 Aug 2024 16:00:42 +0000 (UTC) (envelope-from shawn.webb@hardenedbsd.org) Received: from mail-io1-xd31.google.com (mail-io1-xd31.google.com [IPv6:2607:f8b0:4864:20::d31]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "WR4" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4WbnVL1Hhkz4TZ3 for ; Sat, 3 Aug 2024 16:00:42 +0000 (UTC) (envelope-from shawn.webb@hardenedbsd.org) Authentication-Results: mx1.freebsd.org; none Received: by mail-io1-xd31.google.com with SMTP id ca18e2360f4ac-81fb419f77bso253290439f.2 for ; Sat, 03 Aug 2024 09:00:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hardenedbsd.org; s=google; t=1722700841; x=1723305641; darn=freebsd.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=k3zaJ9DRmpXWHsaHBlbJGoNSUEkDA+VeXTfEgdF8pUo=; b=EKeu1/yWDmhkoLIS8y8xpy4nfuta4Zp1wheY4kuYDXfgoMhugXei5ZC01DFq00cTrU 65awKfhQduCD8mqktUgQR6n3Hu/fYgYCWMdcvn//N53Oj23p5LGSjyVDHQlEh+HvmU/N WxYBN0OJJzuSauj/LIAKm6PKz5VYgBQD3eBz7dwrOGCFOJtSnmTkeNIvzHPAvQR2oLEV d6+QgrjFo0wJsMvXTWloN1p4Xqxn1FYQuV/DcqoX2Ph1HYL0XoDFDsB1u+eBwd4SKCAt G08XhDCBQQA5iI8/ZctQSgBj9rOrNcHZCiSeq1RFArAu19ARyP2M4JzkEyLt0cQZBEtq 2T3g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1722700841; x=1723305641; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=k3zaJ9DRmpXWHsaHBlbJGoNSUEkDA+VeXTfEgdF8pUo=; b=MP/8yPPCY/WQ4VnPIrcmECMwc9/V0HSr8QWXVyUr1KhUwxakx/jjDbJYIBuixa3nx6 AxMHhZoUxNUSZuZv5gkarGK0l4o5HewvZr+rGInn+YudneWLU5VfDoDjfA8WR0lYl8y+ Ug7ViBhhotoBh885y+LKEiCkvGN763Om56wqlNfbKIRahkJ824pPyUlvU66vm7tVuQkO xHSsJKaxD7y+39vkvsJgf0nk+vL9MWeeLFoerwHMDO/G6g6thyDSSsdSUFFwZDtp/VnP uPJWszQBZBxc9GYoy/dxoa4CfzA4zapEdYhDH1xo+XfU7M3CZteIo8dL9LybqKBzzykd b0vw== X-Forwarded-Encrypted: i=1; AJvYcCXvUW9fULTxTVPK8Hc+DbLXw0mN0TYLSYhwjzI91nR4xUD8jyjBLBASwLpmkQU5mIJZIhy+a0rInWDTFXG2Epo2HI3uI+zhdeDmBqU= X-Gm-Message-State: AOJu0YytQkF601awDfORizdZazQlZeSusK0Hj8CNV+QQ1RHGbsqdiRfE doGBUWxguM9CVam8cjtNewGn4lNovUf83re5A+4b6vRYXqKuipbXqrQMI1GPXncyVW5llUympcX 4 X-Google-Smtp-Source: AGHT+IFa20bPXeSh4GJkH516fPJKuNcEpH7LCJ0pEN0DcGF/IlSawj9IpmEguiuQuJveoPnX/KAC2g== X-Received: by 2002:a05:6602:15c5:b0:806:f495:3b34 with SMTP id ca18e2360f4ac-81fd43509a9mr885419739f.2.1722700841026; Sat, 03 Aug 2024 09:00:41 -0700 (PDT) Received: from mutt-hbsd (174-24-73-190.clsp.qwest.net. [174.24.73.190]) by smtp.gmail.com with ESMTPSA id ca18e2360f4ac-821ef0bbfb2sm19815539f.2.2024.08.03.09.00.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 03 Aug 2024 09:00:40 -0700 (PDT) Date: Sat, 3 Aug 2024 16:00:39 +0000 From: Shawn Webb To: Alan Somers Cc: Jamie Landeg-Jones , freebsd-hackers@freebsd.org Subject: Re: RFC: ACLs on fusefs Message-ID: X-Operating-System: FreeBSD mutt-hbsd 15.0-CURRENT-HBSD FreeBSD 15.0-CURRENT-HBSD X-PGP-Key: https://git.hardenedbsd.org/hardenedbsd/pubkeys/-/blob/master/Shawn_Webb/03A4CBEBB82EA5A67D9F3853FF2E67A277F8E1FA.pub.asc References: <202408030413.4734D5gd042998@donotpassgo.dyslexicfish.net> List-Id: Technical discussions relating to FreeBSD List-Archive: https://lists.freebsd.org/archives/freebsd-hackers List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-hackers@FreeBSD.org MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="ren7enky4jnymnu3" Content-Disposition: inline In-Reply-To: X-Spamd-Bar: ---- X-Rspamd-Pre-Result: action=no action; module=replies; Message is reply to one we originated X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[]; ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US] X-Rspamd-Queue-Id: 4WbnVL1Hhkz4TZ3 --ren7enky4jnymnu3 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sat, Aug 03, 2024 at 09:03:38AM -0600, Alan Somers wrote: > On Fri, Aug 2, 2024 at 10:13=E2=80=AFPM Jamie Landeg-Jones wrote: > > > > Alan Somers wrote: > > > > > TLDR; > > > how useful would it be if fusefs(4) could support ACLs? > > > > I, personally, don't use ACLs generally, so have not missed them on > > fusefs. > > > > However, I do make extensive use of XATTRs, so those are what I've > > really missed. > > > > I didn't know xatrs were now supported - is that a new thing, or maybe > > the client I use (borgs sshfs implementation) needs to be updated? > > > > Cheers, Jamie >=20 > Our fusefs has supported xattrs for a long time. But the specific > fuse file system needs support too. Looking right now, I don't see > any support in sysutils/fusefs-sshfs . In fact, I have a (significantly buggy) proof-of-concept fusefs server that stores file payload data as extended attributes. Since the tar file format supports extended attributes, this makes data exfiltration somewhat easier. Though, I suppose, since my proof-of-concept is buggy, using my solution would make data exfil somewhat more difficult. ;-) Hopefully someday, I'll have the time to finish the PoC and make it usable for production. PoC code: https://git.hardenedbsd.org/shawn.webb/altfs Thanks, --=20 Shawn Webb Cofounder / Security Engineer HardenedBSD Tor-ified Signal: +1 303-901-1600 / shawn_webb_opsec.50 https://git.hardenedbsd.org/hardenedbsd/pubkeys/-/raw/master/Shawn_Webb/03A= 4CBEBB82EA5A67D9F3853FF2E67A277F8E1FA.pub.asc --ren7enky4jnymnu3 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEA6TL67gupaZ9nzhT/y5nonf44foFAmauVCAACgkQ/y5nonf4 4fp8wxAAhIuxX9brcIWuwdSfg+tQZuViyrtWH3k6l32LWohknJLnPPMWO/vCNePu UO7G8WeWA3iJQwAxnXt3eOf9EpOEaTSUfTACr78NSK9XTzIvT4DSzNetT9VQ1TKx x7xOENH6jxXNR/x8/K8F2l+8DOmevl7FcP7A4TLDoiLYnibZw5xP+XVnEwEnFFXv gcpBNzNbBfkH1lNTRUiYRkx6gnUTsyAy4xj9auznQdFGsI+951j8lNTK2tu/Fmba 6hUcdUNrOZcejVIkT3Eu29tf0qE6mcODM17zeZ/ShY+ZNnH51aetGWFtur0PgSrI t/a69UJ6XzFjmjaAw2+NmgZuveIXNGdaDXIcDskGCpm87aZMLScXoym4kEgFjYnw VLx04BVG5q3Yjd/f70dhKO/coRYGudndkuDkYNE54ZelQBZALGuUTEq3VAevJN9g i+XX1hjYjEJxsFVKUdkzUaTdy5s+Wr8ODrbrAn15nClGp1UswoU+F1WDe59EJtgE DO4HfOkgt0JFPG29iPgvOapcTw0dOX4zBN1K/nAFT5ejg6M25XXHruGiqC1G1Fdx XjoY+GItzENkNXwXgDxmpHhKrBLb+KkIyGbnQFo4yK/1sJclambmiFlMAl0TG1p/ ZqEY5j7GsMkrrPA5BO+cKLIe+9eLQ8V3ss5c4+1LdjGcEUbm0E8= =HfKq -----END PGP SIGNATURE----- --ren7enky4jnymnu3--