On Wed, Sep 22, 2021 at 12:00:17PM +0100, Dr. David Alan Gilbert wrote:
> * Vivek Goyal (vgo...@redhat.com) wrote:
> > As of now we have a knob "-o xattr/no_xattr" which either enables
> > all xattrs or disables all xattrs.
>
> Hi Vivek,
> Thanks for this.
>
> > We need something more fine grained where we can selectively disable
> > only certain xattrs (and not all).
> >
> > For example, in some cases we want to disable "security.selinux"
> > xattr. This is equivalent to virtiofs not supporting security.selinux
> > and guest kernel will fallback to a single label for whole fs
> > (virtiofs_t).
> >
> > So add an option "-o block_xattr=<list-of-xattrs>" which will allow
> > specifying a list of xattrs to block.
>
> This is quite interesting; I'd not noticed you had the exisitng blocking
> mechanism,
Yes, that's for blocking posix acl xattrs if needed. If xattr map
support blocking, then we could probably insert an internal rule
to block posix acl xattrs. But that's more of a cleanup exercise
I will take up some other time.
> however, as discussed, I think my preference is if this could
> be done as a modification of the xattrmap it would avoid another set of
> options.
>
> The mapping code already has 'type's of:
>
> prefix, ok, bad
>
> I think you just need to add a 'reject' type
> that produces the error code you need.
How about "unsupported" and then return -EOPNOTSUPP?
I am looking at selinux kernel code and it expect -EOPNOTSUPP to decide
that selinux xattr is not supported and looks into fallback options.
static int sb_check_xattr_support(struct super_block *sb)
{
rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
if (rc < 0 && rc != -ENODATA) {
if (rc == -EOPNOTSUPP) {
pr_warn("SELinux: (dev %s, type %s) has no security
xattr handler\n",
sb->s_id, sb->s_type->name);
goto fallback;
...
...
}
Vivek
