[lkml]   [2018]   [Feb]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH v6 4/5] fuse: Ensure posix acls are translated outside of init_user_ns
Miklos Szeredi <> writes:

> On Wed, Feb 21, 2018 at 9:29 PM, Eric W. Biederman
> <> wrote:
>> Ensure the translation happens by failing to read or write
>> posix acls when the filesystem has not indicated it supports
>> posix acls.
> For the first iteration this is fine, but we could convert the raw
> xattrs as well, if we later want to, right?

I will say maybe. This is tricky. The code would not be too hard,
and the function to do the work posix_acl_fix_xattr_userns already
exists in fs/posix_acl.c

I don't actually expect that to work longterm. I expect the direction
the kernel internals are moving is that all filesystems that implement
posix acls will be expected to implement .get_acl and .set_acl.

I would have to reread the old thread that got us to this point with
posix acls before I could really understand the backwards compatible
fuse use case, and I would have to reread the rest of the acl processing
in the kernel before I could recall exactly what makes sense.

If there was an obvious way to whitelist xattrs that fuse can support
for user namespaces I think I would go for that. Just to avoid future
problems with future xattrs.


 \ /
  Last update: 2018-02-22 20:19    [W:0.108 / U:1.560 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site