Re: [RFC PATCH] f*xattr: allow O_PATH descriptors

On Thu, 9 Jun 2022 at 06:36, Amir Goldstein [off-list ref] wrote:

On Wed, Jun 8, 2022 at 9:01 PM Andreas Dilger [off-list ref] wrote:

quoted

On Jun 7, 2022, at 9:31 AM, Christian Göttsche [off-list ref] wrote:

quoted

From: Miklos Szeredi <redacted>

Support file descriptors obtained via O_PATH for extended attribute
operations.

Extended attributes are for example used by SELinux for the security
context of file objects. To avoid time-of-check-time-of-use issues while
setting those contexts it is advisable to pin the file in question and
operate on a file descriptor instead of the path name. This can be
emulated in userspace via /proc/self/fd/NN [1] but requires a procfs,
which might not be mounted e.g. inside of chroots, see[2].

Will this allow get/set xattrs directly on symlinks?  That is one problem
that we have with some of the xattrs that are inherited on symlinks, but
there is no way to change them.  Allowing setxattr directly on a symlink
would be very useful.

It is possible.
See: https://github.com/libfuse/libfuse/pull/514

Does it really? (It should not since xtattr(7) mentions some quota
related issues.)
In my tests setting extended attributes via O_PATH on symlinks fails
with ENOTSUP (even as root), except for special ones, like
"security.selinux".

That's why Miklos withdrew this patch:
https://lore.kernel.org/linux-fsdevel/CAOssrKeV7g0wPg4ozspG4R7a+5qARqWdG+GxWtXB-MCfbVM=9A@mail.gmail.com/ (local)

Thanks,
Amir.