From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753090AbdHNQVM (ORCPT ); Mon, 14 Aug 2017 12:21:12 -0400 Received: from smtp3.ccs.ornl.gov ([160.91.203.39]:59112 "EHLO smtp3.ccs.ornl.gov" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753121AbdHNQVJ (ORCPT ); Mon, 14 Aug 2017 12:21:09 -0400 From: James Simmons To: Greg Kroah-Hartman , devel@driverdev.osuosl.org, Andreas Dilger , Oleg Drokin Cc: Linux Kernel Mailing List , Lustre Development List , Robin Humble , James Simmons Subject: [PATCH v2 01/14] staging: lustre: llite: Remove filtering of seclabel xattr Date: Mon, 14 Aug 2017 12:20:51 -0400 Message-Id: <1502727664-29438-2-git-send-email-jsimmons@infradead.org> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1502727664-29438-1-git-send-email-jsimmons@infradead.org> References: <1502727664-29438-1-git-send-email-jsimmons@infradead.org> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Robin Humble The security.capability xattr is used to implement File Capabilities in recent Linux versions. Capabilities are a fine grained approach to granting executables elevated privileges. eg. /bin/ping can have capabilities cap_net_admin, cap_net_raw+ep instead of being setuid root. This xattr has long been filtered out by llite, initially for stability reasons (b15587), and later over performance concerns as this xattr is read for every file with eg. 'ls --color'. Since LU-2869 xattr's are cached on clients, alleviating most performance concerns. Removing llite's filtering of the security.capability xattr enables using Lustre as a root filesystem, which is used on some large clusters. Signed-off-by: Robin Humble Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-9562 Reviewed-on: https://review.whamcloud.com/27292 Reviewed-by: John L. Hammond Reviewed-by: Sebastien Buisson Reviewed-by: Oleg Drokin Signed-off-by: James Simmons --- Changelog: v1) Initial submit with wrong patch attached. v2) Proper patch this time. drivers/staging/lustre/lustre/llite/xattr.c | 9 --------- 1 file changed, 9 deletions(-) diff --git a/drivers/staging/lustre/lustre/llite/xattr.c b/drivers/staging/lustre/lustre/llite/xattr.c index d0cad7e..56f42b8 100644 --- a/drivers/staging/lustre/lustre/llite/xattr.c +++ b/drivers/staging/lustre/lustre/llite/xattr.c @@ -117,11 +117,6 @@ static int xattr_type_filter(struct ll_sb_info *sbi, (handler->flags == XATTR_LUSTRE_T && !strcmp(name, "lov")))) return 0; - /* b15587: ignore security.capability xattr for now */ - if ((handler->flags == XATTR_SECURITY_T && - !strcmp(name, "capability"))) - return 0; - /* LU-549: Disable security.selinux when selinux is disabled */ if (handler->flags == XATTR_SECURITY_T && !selinux_is_enabled() && strcmp(name, "selinux") == 0) @@ -380,10 +375,6 @@ static int ll_xattr_get_common(const struct xattr_handler *handler, if (rc) return rc; - /* b15587: ignore security.capability xattr for now */ - if ((handler->flags == XATTR_SECURITY_T && !strcmp(name, "capability"))) - return -ENODATA; - /* LU-549: Disable security.selinux when selinux is disabled */ if (handler->flags == XATTR_SECURITY_T && !selinux_is_enabled() && !strcmp(name, "selinux")) -- 1.8.3.1