Re: Possible issue with linux xattr support?

On Tue, Aug 29, 2023 at 07:02:22PM +0200, Felix Palmen wrote:
> * Dmitry Chagin <dchagin@freebsd.org> [20230829 17:45]:
> > On Tue, Aug 29, 2023 at 12:59:11PM +0200, Felix Palmen wrote:
> > > Thanks, I can confirm this avoids the issue in both cases I experienced
> > > (install from GNU coreutils and python).
> > > 
> > thanks, this is the first half of the fix, it works for you due to you
> > are running tools under unprivileged user, afaiu. The second I have
> > tested by myself :)
> 
> Sure, poudriere is running all builds as "nobody" by default.
> 
> > > If I understand this patch correctly, it completely avoids EPERM,
> > > masking it as not supported, so callers should consider it non-fatal,
> > > allowing to silently ignore writing of "system" attributes while still
> > > keeping other functionality?
> > > 
> > system namespace is accessible only for privileged user, for others Linux
> > returns ENOTSUP. So many tools ignores this error, eg ls.
> > 
> > the second: https://people.freebsd.org/~dchagin/sea_jailed.patch
> 
> Ok, I did some tests in a poudriere jail using Linux bash, as root.
> First, with only the first patch:
> 
> | bash-5.2# getfattr -d /bin/sh
> | getfattr: /bin/sh: Operation not supported
> | bash-5.2# setfattr -n user.foo -v bar /bin/sh
> | bash-5.2# getfattr -n user.foo /bin/sh
> | getfattr: Removing leading '/' from absolute path names
> | # file: bin/sh
> | user.foo="bar"
> | bash-5.2# setfattr -x user.foo /bin/sh
> | bash-5.2# setfattr -x system.foo /bin/sh
> | setfattr: /bin/sh: Operation not supported
> 
> So, using user.* works, using system.* doesn't, and maybe a bit
> surprising(?), dumping all attributes which by default excludes the
> system namespace doesn't work either.
> 

As expected, the second patch intended to allow access to system
namespace in jailed env.

> Then with the second patch applied as well:
> 
> | bash-5.2# getfattr -d /bin/sh
> | bash-5.2# setfattr -n system.foo -v bar /bin/sh
> | bash-5.2# getfattr -d /bin/sh -m-
> | getfattr: Removing leading '/' from absolute path names
> | # file: bin/sh
> | system.foo="bar"
> | 
> | bash-5.2# setfattr -x system.foo /bin/sh
> | bash-5.2# getfattr -d /bin/sh -m-
> | bash-5.2#
> 
> This looks perfectly fine, thanks a lot!
> 
> I still wonder, is the first patch needed anyways? Maybe I fail to
> understand something here. Won't it map *every* EPERM to ENOSUP and
> can't this be an issue?
> 

fine, thanks. Gnu tools running under unprivileged user will fail, eg
ls, which uses getfattr() to get the posix acl

> Cheers, Felix
> 
> -- 
>  Felix Palmen <zirias@FreeBSD.org>     {private}   felix@palmen-it.de
>  -- ports committer --                     {web}  http://palmen-it.de
>  {pgp public key}  http://palmen-it.de/pub.txt
>  {pgp fingerprint} 6936 13D5 5BBF 4837 B212  3ACC 54AD E006 9879 F231