From owner-freebsd-pkg@freebsd.org Thu Oct 15 08:44:01 2020 Return-Path: Delivered-To: freebsd-pkg@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 4902A437F08 for ; Thu, 15 Oct 2020 08:44:01 +0000 (UTC) (envelope-from george.saylor@hardenedbsd.org) Received: from mailman.nyi.freebsd.org (unknown [127.0.1.3]) by mx1.freebsd.org (Postfix) with ESMTP id 4CBjW50VSbz4Dc9 for ; Thu, 15 Oct 2020 08:44:01 +0000 (UTC) (envelope-from george.saylor@hardenedbsd.org) Received: by mailman.nyi.freebsd.org (Postfix) id 110CF437A06; Thu, 15 Oct 2020 08:44:01 +0000 (UTC) Delivered-To: pkg@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 10CEF437AEF for ; Thu, 15 Oct 2020 08:44:01 +0000 (UTC) (envelope-from george.saylor@hardenedbsd.org) Received: from mail-lf1-x142.google.com (mail-lf1-x142.google.com [IPv6:2a00:1450:4864:20::142]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "GTS CA 1O1" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4CBjW42gKlz4DYs for ; Thu, 15 Oct 2020 08:44:00 +0000 (UTC) (envelope-from george.saylor@hardenedbsd.org) Received: by mail-lf1-x142.google.com with SMTP id h6so2670690lfj.3 for ; Thu, 15 Oct 2020 01:44:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hardenedbsd.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=i8U7z2Ceu9jnERTuIAMFb2ZVDb3CofSLZeyU3oag1iE=; b=kDdqQfyaY9fmZHSs+EIuLI2h03QQbFpXZLl6xWhL7lDulxCb88Am6aQocc61OFF42v LbGvb/THSTluUMXIxWQDPmtc0+KTJg30gOw/4LzhaNCBmeSvdJ0eQfSoNYM1ZatPncuK D573RoFgiVsRnS1CJtYFxsnW+YPeM0NIddn/JbJalBDVuuwJPLg3+hV3Y4XYVHr/9dD4 bL20VIPcHzJZzlENVGTwbI0tZPuHuUuh7SyFfI/gzJN7UStz8HVrlKvmDTYXqWKAHLM7 pAZ716VFz9Kbh9Poy3ELFQJU+dDu65OxsPQcHKisHC4RGpGxlHXvu/MepVvF/b9vXXqL vWxA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=i8U7z2Ceu9jnERTuIAMFb2ZVDb3CofSLZeyU3oag1iE=; b=f+rJdkK/0I0uI5RoH2tplqvnN46oTajEnU+A3htO+QXD22R3sKI+3V/w+8IRurUlPM 4seFZZVo45efUCG7ygLAan1M6bOHgOH3qvUf1ggzGAvDAwrdc3do+NfLUikIzL5uVMJf ihMFdQ/CC8iAiCJPdgM926RuBXXVw1mR5aJ4XJ/LWJ0JRnqYnfzF22MT9/bHMSjXdQ/J xx59zVhyrjqQJRfbhszhdPKdp119xzm4SOctsfqoUn6OoVFWmljz0oasi6oZA/+C4mAM /pfqHAsOQ9lsRxdpEnHdQ3eBR2i8XAwUnPrYbYo/x1NoAJWY8SYrzJZENU92WDAMdt0z 7TXA== X-Gm-Message-State: AOAM531fdBL0V/RLlG2JxiSxIyoo/kCOlzhk/wyHYfNQv2O0uNf7Z009 X8qx4D/g3fYErz88vcFWHVYNT3uwNvRkoGVXozJATg== X-Google-Smtp-Source: ABdhPJz+LuX1gL2AgWHShrqKDAnN5ztS1fVCbP7khTN9OtSr/2zj5C44SI2gncyVFSYZadlN6gMQVR98CXpYzst45nA= X-Received: by 2002:a19:83cc:: with SMTP id f195mr691727lfd.45.1602751438453; Thu, 15 Oct 2020 01:43:58 -0700 (PDT) MIME-Version: 1.0 References: <20200704141345.xwdf2ckxak2hfpkh@mutt-hbsd> <20200704201100.lkcde42gtlgspwpr@ivaldir.net> In-Reply-To: From: George Saylor Date: Thu, 15 Oct 2020 04:43:46 -0400 Message-ID: Subject: Re: Filesystem extended attributes support To: Shawn Webb Cc: Baptiste Daroussin , pkg@freebsd.org, HardenedBSD Developers X-Rspamd-Queue-Id: 4CBjW42gKlz4DYs X-Spamd-Bar: --- Authentication-Results: mx1.freebsd.org; dkim=pass header.d=hardenedbsd.org header.s=google header.b=kDdqQfya; dmarc=none; spf=pass (mx1.freebsd.org: domain of george.saylor@hardenedbsd.org designates 2a00:1450:4864:20::142 as permitted sender) smtp.mailfrom=george.saylor@hardenedbsd.org X-Spamd-Result: default: False [-3.54 / 15.00]; RCVD_TLS_ALL(0.00)[]; ARC_NA(0.00)[]; R_DKIM_ALLOW(-0.20)[hardenedbsd.org:s=google]; NEURAL_HAM_MEDIUM(-1.03)[-1.033]; FROM_HAS_DN(0.00)[]; RCPT_COUNT_THREE(0.00)[4]; TO_DN_SOME(0.00)[]; R_SPF_ALLOW(-0.20)[+ip6:2a00:1450:4000::/36]; MIME_GOOD(-0.10)[multipart/alternative,text/plain]; PREVIOUSLY_DELIVERED(0.00)[pkg@freebsd.org]; DMARC_NA(0.00)[hardenedbsd.org]; NEURAL_HAM_LONG(-0.99)[-0.994]; TO_MATCH_ENVRCPT_SOME(0.00)[]; DKIM_TRACE(0.00)[hardenedbsd.org:+]; NEURAL_HAM_SHORT(-1.01)[-1.013]; RCVD_IN_DNSWL_NONE(0.00)[2a00:1450:4864:20::142:from]; FROM_EQ_ENVFROM(0.00)[]; MIME_TRACE(0.00)[0:+,1:+,2:~]; ASN(0.00)[asn:15169, ipnet:2a00:1450::/32, country:US]; RCVD_COUNT_TWO(0.00)[2]; MAILMAN_DEST(0.00)[pkg] Content-Type: text/plain; charset="UTF-8" X-Content-Filtered-By: Mailman/MimeDel 2.1.33 X-BeenThere: freebsd-pkg@freebsd.org X-Mailman-Version: 2.1.33 Precedence: list List-Id: Binary package management and package tools discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Oct 2020 08:44:01 -0000 That is great news all. On Wed, Oct 14, 2020, 2:55 PM Shawn Webb wrote: > On Sat, Jul 4, 2020 at 8:11 PM Baptiste Daroussin > wrote: > > > On Sat, Jul 04, 2020 at 10:13:45AM -0400, Shawn Webb wrote: > > > Hey FreeBSD pkg(8) developers, > > > > > > Attached is a patch that implements filesystem extended attributes > > > support. Only the system namespace is supported. In case the patch > > > gets scrubbed from this email, I've posted it here: > > > https://gist.github.com/d0b4653bc5942dbcdcd1db877d37c2dc > > > > > > Anyone who wants to write unit tests is welcomed to do so. > > > > > > This patch to pkg does depend on a separate patch to libarchive: > > > https://github.com/libarchive/libarchive/pull/1409 > > > > > > HardenedBSD has a separate patch to tmpfs that enables incredibly > > > basic extended attribute support. The tmpfs patch is only needed for > > > those who use tmpfs with poudriere. > > > > > > And finally, another patch to the jails subsystem that allows a > > > privileged user within a jail to set system namespace filesystem > > > extended attributes (disabled by default) is needed for poudriere > > > users. > > > > > > The patch to tmpfs and jails is not included here as they are > > > tangential. > > > > Thank you for the patch at quick glance it looks fine to me. I would have > > obviously to wait for libarchive to merge the patch first to be able to > > test it > > and do a proper review at the time. > > > > Don't hesitate to ping me again if you see no progress with libarchive > has > > merged the said patch. > > > > I would have to rework it a bit probably: > > - Add a configure detection of the fact libarchive does or not have the > > necessary support > > - Add regression tests to ensure I don't break this in the future. > > - Maybe add an option to enable/disable it via pkg.conf (not sure yet > about > > that ;)) > > Following up: libarchive merged in the patch. > > https://github.com/libarchive/libarchive/pull/1409 > > Thanks, > > Shawn Webb > Cofounder / Security Engineer > HardenedBSD > > GPG Key ID: 0xFF2E67A277F8E1FA > GPG Key Fingerprint: D206 BB45 15E0 9C49 0CF9 3633 C85B 0AF8 AB23 0FB2 > > https://git-01.md.hardenedbsd.org/HardenedBSD/pubkeys/src/branch/master/Shawn_Webb/03A4CBEBB82EA5A67D9F3853FF2E67A277F8E1FA.pub.asc > a > > On Sat, Jul 4, 2020 at 8:11 PM Baptiste Daroussin > wrote: > >> On Sat, Jul 04, 2020 at 10:13:45AM -0400, Shawn Webb wrote: >> > Hey FreeBSD pkg(8) developers, >> > >> > Attached is a patch that implements filesystem extended attributes >> > support. Only the system namespace is supported. In case the patch >> > gets scrubbed from this email, I've posted it here: >> > https://gist.github.com/d0b4653bc5942dbcdcd1db877d37c2dc >> > >> > Anyone who wants to write unit tests is welcomed to do so. >> > >> > This patch to pkg does depend on a separate patch to libarchive: >> > https://github.com/libarchive/libarchive/pull/1409 >> > >> > HardenedBSD has a separate patch to tmpfs that enables incredibly >> > basic extended attribute support. The tmpfs patch is only needed for >> > those who use tmpfs with poudriere. >> > >> > And finally, another patch to the jails subsystem that allows a >> > privileged user within a jail to set system namespace filesystem >> > extended attributes (disabled by default) is needed for poudriere >> > users. >> > >> > The patch to tmpfs and jails is not included here as they are >> > tangential. >> >> Thank you for the patch at quick glance it looks fine to me. I would have >> obviously to wait for libarchive to merge the patch first to be able to >> test it >> and do a proper review at the time. >> >> Don't hesitate to ping me again if you see no progress with libarchive has >> merged the said patch. >> >> I would have to rework it a bit probably: >> - Add a configure detection of the fact libarchive does or not have the >> ?? necessary support >> - Add regression tests to ensure I don't break this in the future. >> - Maybe add an option to enable/disable it via pkg.conf (not sure yet >> about >> that ;)) >> >> Best regards, >> Bapt >> >