Hi!
On Sat, 2023-04-15 at 13:43:01 +0200, наб wrote:
> Package: attr
> Version: 1:2.5.1-4
> Severity: normal
> I would like to inspect the value of the system.posix_acl_access xattr.
> However, no matter which parameter I pass, I always get a forced prefix:
> -- >8 --
> # strace attr -g system.posix_acl_access install 2>&1 | grep xattr
> lgetxattr("install", "user.system.posix_acl_access", 0x56c02c00, 65536) = -1
> EOPNOTSUPP (Operation not supported)
> lgetxattr("install", "user.system.posix_acl_access", 0x56c02c00, 65536) = -1
> EOPNOTSUPP (Operation not supported)
> # strace attr -Sg system.posix_acl_access install 2>&1 | grep xattr
> lgetxattr("install", "security.system.posix_acl_access", 0x574f8c00, 65536) =
> -1 ENODATA (No data available)
> lgetxattr("install", "security.system.posix_acl_access", 0x574f8c00, 65536) =
> -1 ENODATA (No data available)
> # strace attr -Rg system.posix_acl_access install 2>&1 | grep xattr
> lgetxattr("install", "trusted.system.posix_acl_access", 0x5832ac00, 65536) =
> -1 ENODATA (No data available)
> lgetxattr("install", "xfsroot.system.posix_acl_access", 0x5832ac00, 65536) =
> -1 EOPNOTSUPP (Operation not supported)
> -- >8 --
This looks to be working as expected, though.
> Whereas attr(1) says:
> -- >8 --
> When the -R option is given and the process has appropriate
> privileges, operate in the root attribute namespace rather
> that the USER attribute namespace.
>
> The -S option is similar, except it specifies use of the security
> attribute namespace.
> -- >8 --
>
> Which appears to be wrong, since -R makes attr
> "operate in the 'trusted' and 'xfsroot'" namespaces,
> not the root one.
The user namespace is called "user" and it is the default used, the
security namespace is "security", and the root namespace is either
"trusted" or "xfsroot" (for IRIX compatibility).
This is also in the man page:
,--
Extended attributes use 2 disjoint attribute name spaces associated
with every filesystem object. They are the root and user address spa‐
ces. The root address space is accessible only to the superuser, and
then only by specifying a flag argument to the function call. Other
users will not see or be able to modify attributes in the root address
space. The user address space is protected by the normal file permis‐
sions mechanism, so the owner of the file can decide who is able to
see and/or modify the value of attributes on any particular file.
`---
I guess I could extend the description and mention explicitly what the
root namespaces are call, to avoid confusion. I guess I should also
modify it to make it more clear this is a legacy program for IRIX
compatibility.
Thanks,
Guillem
