[Bug 273517] [Linuxulator]: getxattr EPERM for non-root users inside chroots

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=273517

            Bug ID: 273517
           Summary: [Linuxulator]: getxattr EPERM for non-root users
                    inside chroots
           Product: Base System
           Version: 14.0-CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: jwmullally@gmail.com

Hi,

## Summary:
It seems that on FreeBSD 14.0-ALPHA3 for non-root users in Linux chroots,
getxattr returns EPERM which causes some coreutils commands to fail (e.g. cp
-a), whereas on FreeBSD 13.1 getxattr simply returned EOPNOTSUPP which lets the
tools skip that step and continue successfully.

It might be the same issue as
https://lists.freebsd.org/archives/freebsd-current/2023-August/004433.html
"Possible issue with linux xattr support?"

## Example impact:
"apt update" failing in a fresh debootstrap due to "cp -a" failure in the
apt-key script, which runs as another user "_apt". This works OK on FreeBSD
13.1. (See here
https://forums.freebsd.org/threads/debian-12-bookworm-jail-encounters-gpg-error-in-freebsd-14-0.90093/#post-620794
for more details )


## Steps to reproduce:

### On fresh install FreeBSD system, where /root homedir is on UFS partition
pkg install sysutils/debootstrap
kldload linux64 fdescfs linprocfs linsysfs tmpfs
service linux onestart
cd /root
mkdir debian_build
cd debian_build
mkdir dev dev/fd dev/shm proc sys tmp
mount -t linprocfs none `pwd`/proc
mount -t devfs none `pwd`/dev
mount -t fdescfs none `pwd`/dev/fd
mount -t tmpfs none `pwd`/dev/shm
mount -t linsysfs none `pwd`/sys
mount -t tmpfs none `pwd`/tmp
chmod 1777 dev/shm tmp
debootstrap bullseye . http://deb.debian.org/debian
chroot . /bin/bash

### Inside the chroot
adduser --disabled-password --gecos "" someguy
su someguy
cd /home/someguy

### Comparing cp -a / cp --preserve=mode on both FreeBSD 13 and 14

someguy@freebsd14:~$ uname -a
FreeBSD freebsd14 14.0-ALPHA3 FreeBSD 14.0-ALPHA3 amd64 1400097 #0
stable/14-n265022-2af9390e54ed: Fri Aug 25 05:45:56 UTC 2023    
root@releng1.nyi.freebsd.org:/usr/obj/usr/src/amd64.amd64/sys/GENERIC amd64

someguy@freebsd13:~$ strace cp --preserve=mode hello hello2
fgetxattr(3, "system.posix_acl_access", 0x7fffffffdcc0, 132) = -1 EOPNOTSUPP
(Operation not supported)
fsetxattr(4, "system.posix_acl_access",
"\2\0\0\0\1\0\6\0\377\377\377\377\4\0\4\0\377\377\377\377
\0\4\0\377\377\377\377", 28, 0) = -1 EOPNOTSUPP (Operation not supported)
+++ exited with 0 +++

someguy@freebsd14:~$ strace cp --preserve=mode hello hello2
fgetxattr(3, "system.posix_acl_access", 0x7fffffffbd30, 132) = -1 EPERM
(Operation not permitted)
+++ exited with 1 +++

### ls -l fails on FreeBSD 14

someguy@freebsd14:~$ ls -l
ls: hello: Operation not permitted
ls: hello2: Operation not permitted
total 0K
-rw-r--r-- 1 someguy someguy    0 Sep  1 20:11 hello
-rw-r--r-- 1 someguy someguy    0 Sep  1 21:14 hello2

someguy@freebsd14:~$ strace ls -l 2>&1 | grep getxattr
getxattr("hello", "system.posix_acl_access", NULL, 0) = -1 EPERM (Operation not
permitted)
getxattr("hello2", "system.posix_acl_access", NULL, 0) = -1 EPERM (Operation
not permitted)


### apt update apt-key failure:
root@freebsd14:/# ps auxfww
root       949  0.0  0.1  13404  2964 ?        Ss   15:39   0:00 login [pam]
root       950  0.0  0.1  13368  3152 ?        S    15:39   0:01  \_ -sh
root     25160  0.0  0.2   6036  4400 ?        S    18:11   0:03      \_
/bin/bash
root     26053  0.0  0.5  14720 11140 ?        T    18:25   0:00          \_
apt -oAPT::Status-Fd=1 -oDebug::Acquire::gpgv=1 update
_apt     26056  0.0  0.7  20448 14932 ?        T    18:25   0:00          |  
\_ /usr/lib/apt/methods/http
_apt     26058  0.0  0.4  13884  9832 ?        T    18:25   0:00          |  
\_ /usr/lib/apt/methods/gpgv
_apt     26059  0.0  0.4  14140  9944 ?        T    18:25   0:00          |    
  \_ /usr/lib/apt/methods/gpgv
_apt     26060  0.0  0.0   2464  1652 ?        T    18:25   0:00          |    
      \_ /bin/sh /usr/bin/apt-key --quiet --readonly verify --status-fd 3
/tmp/apt.sig.OO1MDD /tmp/apt.data.FtsGdD
_apt     26061  0.0  0.0   2376  1552 ?        T    18:25   0:00          |    
          \_ sleep 3600

root@freebsd14:~# su _apt -s /bin/dash
$ id
uid=100(_apt) gid=65534(nogroup) groups=65534(nogroup)

_apt@freebsd14:/$ /bin/sh -x /usr/bin/apt-key --quiet --readonly verify
--status-fd 1 /tmp/apt.sig.OO1MDD /tmp/apt.data.FtsGdD
# ...
+ ls -la /tmp/apt-key-gpghome.ptBlRcbxDY
ls: /tmp/apt-key-gpghome.ptBlRcbxDY: Operation not permitted
ls: /tmp/apt-key-gpghome.ptBlRcbxDY/.: Operation not permitted
ls: /tmp/apt-key-gpghome.ptBlRcbxDY/..: Operation not permitted
ls: /tmp/apt-key-gpghome.ptBlRcbxDY/pubring.gpg: Operation not permitted
total 56K
drwx------ 2 _apt root    64 Sep  1 19:41 .
drwxrwxrwt 3 root root   256 Sep  1 19:41 ..
-rw-r--r-- 1 _apt root 56156 Sep  1 19:41 pubring.gpg
+ cp -a /tmp/apt-key-gpghome.ptBlRcbxDY/pubring.gpg
/tmp/apt-key-gpghome.ptBlRcbxDY/pubring.orig.gpg
cp: ‘/tmp/apt-key-gpghome.ptBlRcbxDY/pubring.gpg’: Operation not permitted

-- 
You are receiving this mail because:
You are the assignee for the bug.