On 05/20/2012 05:35 PM, Alex Efros wrote:
Hi!
I'm not sure is this right place to ask…
Oh no! You committed a grave sin asking here ... j/k :) You can always
ask and if we don't know then we'll redirect.
What is current status for filesystem's xattr, acl and caps?
Working on it but progress is slow in gentoo. The biggest obstacles are
almost out of the way though with portage and tar both supporting xattr
now but only in ~arch.
I'm usually keep all of this disabled in kernel, because I don't use them
and wanna avoid needless complexity. But today consolekit (which I don't
use, but which is installed anyway as someone's dependency) asked me to
enable CONFIG_TMPFS_POSIX_ACL. And I decide to check all this crap once again.
I may be wrong here, but after glance look at it I got this impression:
XATTR
Needed only if you use ACL or CAPS (or wanna play with custom file
attributes).
ACL
Not sure about consolekit requirement above, but otherwise it looks
useless (if you don't need to use complicated file permissions).
CAPS
Looks promising, it's always good to remove suid bit, BUT:
a) looks like only app which uses it now on my workstation is
wireshark, even /bin/ping is still installed suid
b) pam_cap.so doesn't used by default (not sure why) so you can't change
user's default capabilities using /etc/security/capability.conf
So, until most/all suid apps in portage get CAPS support for me it looks
like it's better to switch off all these things.
Okay this is where I have to redirect you because I'm not aware of this
particular issue, ie why consolekit needs tmpfs posix acls. To be
clear, this means acl support on files that are on a tmpfs system. This
was pushed upstream by redhat that needed it for selinux. But if you're
not running a selinux system, i'm not sure why consolekit would need this.
In general though, its safe to turn on xattr/acl/caps even if you don't
use them, and in some cases, eg selinux or the new pax markings, you
must have xattr.
I don't think this answers your question but it does give you more context.
--
Anthony G. Basile, Ph. D.
Chair of Information Technology
D'Youville College
Buffalo, NY 14201
(716) 829-8197
