On Fri, 2016-08-26 at 22:12 +0100, One Thousand Gnomes wrote:

quoted

A non-security use case would be to run the binary (without 
modification) with a different ELF interpreter (assuming this 
allows to override binfmt_elf, but self-sandboxing would need that 
as well).  This would make it easier to use older or newer libcs 
for select binaries on the system.  Right now, one has to write 
wrappers for that, and the explicit dynamic linker invocation is 
not completely transparent to the application.

If it gets in I'll be using it to label CP/M COM files so that they 
can be auto-run nicely when crossbuilding stuff in part with the 
original tools but a modern build environment 8)

Sandboxing is an obvious use but there are more bizarre ones such as
marking a file system image to get auto-run under a virtual machine 
or make containers fire up as if they were commands.

So I asked previously but didn't get an answer.  If this is useful for
sandboxing and being in the sandbox depends on the xattr value,
shouldn't it be in one of the privileged xattr namespaces, not the
user. one?

James

It's effectively also the long missing but much needed "this document
belongs to this app" meta data that MacOS and the like have had for
decades.

Alan
--
To unsubscribe from this list: send the line "unsubscribe linux
-fsdevel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html