Date: Tue, 29 Aug 2023 15:02:58 -0400 From: Shawn Webb <shawn.webb@hardenedbsd.org> To: Dmitry Chagin <dchagin@freebsd.org> Cc: current@freebsd.org Subject: Re: Possible issue with linux xattr support? Message-ID: <20230829190258.uc67572553e4fq3v@mutt-hbsd> In-Reply-To: <ZO4En1UJqcr4GGiw@heemeyer.club> References: <3q2k3tje2ig2s6wzy4hzvjmoyejiecminvcvevivumtukxrgki@btnpjbztyfa6> <ZOuNvisMH_GXHHX2@heemeyer.club> <pzu4sxp4wvfpn3mzzo2giw3otvg6z5ewia6rr2tdgpkjurfcfe@aat2k6ywm6jm> <ZOuoH6Llw8PKgMJQ@heemeyer.club> <wuwg3egv3rilgfaa5hor47v3yjwzvxlt5krj4la4wvugcnhkg3@vgrtgfr7rc6i> <EA27BAE1-C687-47F9-BB6D-B72A85A5CA8D@cschubert.com> <elx6cvceobzgw66fskkfhhicsdpsur5xaktluu5tk7m7p4qwno@s7qmm4kyuvag> <ZOzD9noXVrslppot@heemeyer.club> <smfbmu35sxh2f3hu5nrpdwb355trlucd2bbp4ag5ke7v3zf3il@s3ua2x4i3nzj> <ZO4En1UJqcr4GGiw@heemeyer.club>
next in thread | previous in thread | raw e-mail | index | archive | help
--mjpddq7i64klevr4 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Aug 29, 2023 at 05:45:51PM +0300, Dmitry Chagin wrote: > On Tue, Aug 29, 2023 at 12:59:11PM +0200, Felix Palmen wrote: > > * Dmitry Chagin <dchagin@freebsd.org> [20230828 18:57]: > > > On Mon, Aug 28, 2023 at 08:03:33AM +0200, Felix Palmen wrote: > > > > * Cy Schubert <Cy.Schubert@cschubert.com> [20230827 16:59]: > > > > >=20 > > > > > If we are to break it to fix a problem, maybe a sysctl to enable/= disable then? > > > >=20 > > > > IMHO depends on the exact nature of the problem. If it's confirmed = that > > > > it (always and only) breaks for jailed processes, just disabling it= for > > > > them would be the better workaround. "No-op" calls won't break anyt= hing. > > > >=20 > > >=20 > > > please, try: https://people.freebsd.org/~dchagin/xattrerror.patch > >=20 > > Thanks, I can confirm this avoids the issue in both cases I experienced > > (install from GNU coreutils and python). > >=20 > thanks, this is the first half of the fix, it works for you due to you > are running tools under unprivileged user, afaiu. The second I have > tested by myself :) >=20 > > If I understand this patch correctly, it completely avoids EPERM, > > masking it as not supported, so callers should consider it non-fatal, > > allowing to silently ignore writing of "system" attributes while still > > keeping other functionality? > >=20 > system namespace is accessible only for privileged user, for others Linux > returns ENOTSUP. So many tools ignores this error, eg ls. >=20 > the second: https://people.freebsd.org/~dchagin/sea_jailed.patch >=20 > Try this under privileged user, please. Back in 2019, I had a similar issue: I needed access to be able to read/write to the system extended attribute namespace from within a jailed context. I wrote a rather simple patch that provides that support on a per-jail basis: https://git.hardenedbsd.org/hardenedbsd/HardenedBSD/-/commit/96c85982b45e44= a6105664c7068a92d0a61da2a3 Hopefully that's useful to someone. Thanks, --=20 Shawn Webb Cofounder / Security Engineer HardenedBSD https://git.hardenedbsd.org/hardenedbsd/pubkeys/-/raw/master/Shawn_Webb/03A= 4CBEBB82EA5A67D9F3853FF2E67A277F8E1FA.pub.asc --mjpddq7i64klevr4 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEA6TL67gupaZ9nzhT/y5nonf44foFAmTuQNAACgkQ/y5nonf4 4frosg//YxLXPFWHzrU6naTUDfzdiGxWYq8vGnCyXh6R83lvcg5mTp8UJAkbT/PV w/UiIFVBUrfNxZ7dpO1IzhSEhzGKL8eawn8ERr7mAwpgDWtZ3j+VlKvGRf8DLORt 1og81DHG40PaX/+nABv+prDSHB/0t3CO1/7C2qOJYgMWrwhwg2OhlGgaDE/utJrY n7zmnQnoPJd3i/RFp4iWjCZkFwZc2JHpdImz695quKFfYSAatW2gme7FYydTNRDY in1w34+9NNq6P4meKguNUuO8TPPLiPD7455JVrdlSo5DKSk5zkBHbNDrPYP2Lnqz XnFUB9KssLNypFzMM+0NzzSJ4Kmht7b48skRJzaWmbc9Y1maYjRiwJBe4IcSYEUv RItSJ3oIbXIdfxC0dP+MpnuunqyHDrXzhs3iXfp6GRd0dPpewUHGKSZ+ARL4gg3l BmqccD0j9Egt5s2YAuhB/i2zrLcc5neKLWorMioMbASGNC9uWSv2ENUyklcoJS2g 4ZEH9qBBYlaS01GiJBYNTyWYkSkbZfH9bmJtcJ3y8cM06H9DV1yNTY/SwK5n+79a RtE9Q2CHfWPcKaqEcl5CXF8WT9jddfanj62PTu5omL0sG338+TY4VWFI1Jq9MgC/ 1YiAJSupWbEhs49Y2igU3HoHHN3tOdrQr4F1iZEjCNv+TxCTZIw= =EziF -----END PGP SIGNATURE----- --mjpddq7i64klevr4--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20230829190258.uc67572553e4fq3v>