[Bug 277908] zfs: cannot lookup extended attributes in capability mode

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=277908

--- Comment #3 from Alan Somers <asomers@FreeBSD.org> ---
This patch fixes the problem for me.  A similar patch is probably necessary to
set extended attributes.  However, as security-sensitive code, we need to get
this reviewed carefully.

diff --git a/sys/contrib/openzfs/module/os/freebsd/zfs/zfs_vnops_os.c
b/sys/contrib/openzfs/module/os/freebsd/zfs/zfs_vnops_os.c
index 7f4f8e2e2f78..a4bfb75ff647 100644
--- a/sys/contrib/openzfs/module/os/freebsd/zfs/zfs_vnops_os.c
+++ b/sys/contrib/openzfs/module/os/freebsd/zfs/zfs_vnops_os.c
@@ -5362,7 +5362,7 @@ zfs_getextattr_dir(struct vop_getextattr_args *ap, const
char *attrname)
 #else
        NDINIT_ATVP(&nd, LOOKUP, NOFOLLOW, UIO_SYSSPACE, attrname, xvp);
 #endif
-       error = vn_open_cred(&nd, &flags, 0, VN_OPEN_INVFS, ap->a_cred, NULL);
+       error = vn_open_cred(&nd, &flags, 0, VN_OPEN_INVFS |
VN_OPEN_NOCAPCHECK, ap->a_cred, NULL);
        if (error != 0)
                return (SET_ERROR(error));
        vp = nd.ni_vp;

-- 
You are receiving this mail because:
You are the assignee for the bug.