Re: [RFC PATCH 1/2] fs/xattr: add *at family syscalls

On 8/31/2022 3:17 PM, Al Viro wrote:

[linux-arch Cc'd for ABI-related stuff]

The LSM list [off-list ref] should be on
this thread as SELinux isn't the only security module that uses xattrs
extensively.

On Tue, Aug 30, 2022 at 05:28:39PM +0200, Christian Göttsche wrote:

quoted

Add the four syscalls setxattrat(), getxattrat(), listxattrat() and
removexattrat() to enable extended attribute operations via file
descriptors.  This can be used from userspace to avoid race conditions,
especially on security related extended attributes, like SELinux labels
("security.selinux") via setfiles(8).

Use the do_{name}at() pattern from fs/open.c.
Use a single flag parameter for extended attribute flags (currently
XATTR_CREATE and XATTR_REPLACE) and *at() flags to not exceed six
syscall arguments in setxattrat().

	I've no problems with the patchset aside of the flags part;
however, note that XATTR_CREATE and XATTR_REPLACE are actually exposed
to the network - the values are passed to nfsd by clients.
See nfsd4_decode_setxattr() and
        BUILD_BUG_ON(XATTR_CREATE != SETXATTR4_CREATE);
	BUILD_BUG_ON(XATTR_REPLACE != SETXATTR4_REPLACE);
in encode_setxattr() on the client side.

	Makes me really nervous about constraints like that.  Sure,
AT_... flags you are using are in the second octet and these are in
the lowest one, but...