Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1711147 > unrolled thread

[PATCH v2 01/14] staging: lustre: llite: Remove filtering of seclabel xattr

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  [PATCH v2 01/14] staging: lustre: llite: Remove filtering of seclabel xattr James Simmons <jsimmons@infradead.org> - 2017-08-14 18:30 +0200
    Re: [PATCH v2 01/14] staging: lustre: llite: Remove filtering of  seclabel xattr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-17 18:30 +0200
      Re: [PATCH v2 01/14] staging: lustre: llite: Remove filtering of  seclabel xattr James Simmons <jsimmons@infradead.org> - 2017-08-20 05:00 +0200

#1711147 — [PATCH v2 01/14] staging: lustre: llite: Remove filtering of seclabel xattr

From: Robin Humble <plaguedbypenguins@gmail.com>

The security.capability xattr is used to implement File
Capabilities in recent Linux versions. Capabilities are a
fine grained approach to granting executables elevated
privileges. eg. /bin/ping can have capabilities
cap_net_admin, cap_net_raw+ep instead of being setuid root.

This xattr has long been filtered out by llite, initially for
stability reasons (b15587), and later over performance
concerns as this xattr is read for every file with eg.
'ls --color'. Since LU-2869 xattr's are cached on clients,
alleviating most performance concerns.

Removing llite's filtering of the security.capability xattr
enables using Lustre as a root filesystem, which is used on
some large clusters.

Signed-off-by: Robin Humble <plaguedbypenguins@gmail.com>
Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-9562
Reviewed-on: https://review.whamcloud.com/27292
Reviewed-by: John L. Hammond <john.hammond@intel.com>
Reviewed-by: Sebastien Buisson <sbuisson@ddn.com>
Reviewed-by: Oleg Drokin <oleg.drokin@intel.com>
Signed-off-by: James Simmons <jsimmons@infradead.org>
---
Changelog:

v1) Initial submit with wrong patch attached.
v2) Proper patch this time.

 drivers/staging/lustre/lustre/llite/xattr.c | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/drivers/staging/lustre/lustre/llite/xattr.c b/drivers/staging/lustre/lustre/llite/xattr.c
index d0cad7e..56f42b8 100644
--- a/drivers/staging/lustre/lustre/llite/xattr.c
+++ b/drivers/staging/lustre/lustre/llite/xattr.c
@@ -117,11 +117,6 @@ static int xattr_type_filter(struct ll_sb_info *sbi,
 	     (handler->flags == XATTR_LUSTRE_T && !strcmp(name, "lov"))))
 		return 0;
 
-	/* b15587: ignore security.capability xattr for now */
-	if ((handler->flags == XATTR_SECURITY_T &&
-	     !strcmp(name, "capability")))
-		return 0;
-
 	/* LU-549:  Disable security.selinux when selinux is disabled */
 	if (handler->flags == XATTR_SECURITY_T && !selinux_is_enabled() &&
 	    strcmp(name, "selinux") == 0)
@@ -380,10 +375,6 @@ static int ll_xattr_get_common(const struct xattr_handler *handler,
 	if (rc)
 		return rc;
 
-	/* b15587: ignore security.capability xattr for now */
-	if ((handler->flags == XATTR_SECURITY_T && !strcmp(name, "capability")))
-		return -ENODATA;
-
 	/* LU-549:  Disable security.selinux when selinux is disabled */
 	if (handler->flags == XATTR_SECURITY_T && !selinux_is_enabled() &&
 	    !strcmp(name, "selinux"))
-- 
1.8.3.1

[toc] | [next] | [standalone]

#1714186 — Re: [PATCH v2 01/14] staging: lustre: llite: Remove filtering of seclabel xattr

On Mon, Aug 14, 2017 at 12:20:51PM -0400, James Simmons wrote:
> From: Robin Humble <plaguedbypenguins@gmail.com>
> 
> The security.capability xattr is used to implement File
> Capabilities in recent Linux versions. Capabilities are a
> fine grained approach to granting executables elevated
> privileges. eg. /bin/ping can have capabilities
> cap_net_admin, cap_net_raw+ep instead of being setuid root.
> 
> This xattr has long been filtered out by llite, initially for
> stability reasons (b15587), and later over performance
> concerns as this xattr is read for every file with eg.
> 'ls --color'. Since LU-2869 xattr's are cached on clients,
> alleviating most performance concerns.
> 
> Removing llite's filtering of the security.capability xattr
> enables using Lustre as a root filesystem, which is used on
> some large clusters.
> 
> Signed-off-by: Robin Humble <plaguedbypenguins@gmail.com>
> Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-9562
> Reviewed-on: https://review.whamcloud.com/27292
> Reviewed-by: John L. Hammond <john.hammond@intel.com>
> Reviewed-by: Sebastien Buisson <sbuisson@ddn.com>
> Reviewed-by: Oleg Drokin <oleg.drokin@intel.com>
> Signed-off-by: James Simmons <jsimmons@infradead.org>
> ---
> Changelog:
> 
> v1) Initial submit with wrong patch attached.
> v2) Proper patch this time.

I don't see a v1 patch anywhere...

Anyway, when you do this, please make your subject such that I can sort
the emails properly and they show up in the correct order, so put the
"v2" after the patch number like this:

   Subject: [PATCH 01/14 v2] staging: lustre: llite: Remove filtering of

I think git does that correctly for you automatically if you use it...

thanks,

greg k-h

[toc] | [prev] | [next] | [standalone]

#1715856 — Re: [PATCH v2 01/14] staging: lustre: llite: Remove filtering of seclabel xattr

> On Mon, Aug 14, 2017 at 12:20:51PM -0400, James Simmons wrote:
> > From: Robin Humble <plaguedbypenguins@gmail.com>
> > 
> > The security.capability xattr is used to implement File
> > Capabilities in recent Linux versions. Capabilities are a
> > fine grained approach to granting executables elevated
> > privileges. eg. /bin/ping can have capabilities
> > cap_net_admin, cap_net_raw+ep instead of being setuid root.
> > 
> > This xattr has long been filtered out by llite, initially for
> > stability reasons (b15587), and later over performance
> > concerns as this xattr is read for every file with eg.
> > 'ls --color'. Since LU-2869 xattr's are cached on clients,
> > alleviating most performance concerns.
> > 
> > Removing llite's filtering of the security.capability xattr
> > enables using Lustre as a root filesystem, which is used on
> > some large clusters.
> > 
> > Signed-off-by: Robin Humble <plaguedbypenguins@gmail.com>
> > Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-9562
> > Reviewed-on: https://review.whamcloud.com/27292
> > Reviewed-by: John L. Hammond <john.hammond@intel.com>
> > Reviewed-by: Sebastien Buisson <sbuisson@ddn.com>
> > Reviewed-by: Oleg Drokin <oleg.drokin@intel.com>
> > Signed-off-by: James Simmons <jsimmons@infradead.org>
> > ---
> > Changelog:
> > 
> > v1) Initial submit with wrong patch attached.
> > v2) Proper patch this time.
> 
> I don't see a v1 patch anywhere...

Its the patch I asked you to drop earlier. Same commit message but I mixed
up the patch with another patch.

> Anyway, when you do this, please make your subject such that I can sort
> the emails properly and they show up in the correct order, so put the
> "v2" after the patch number like this:
> 
>    Subject: [PATCH 01/14 v2] staging: lustre: llite: Remove filtering of
> 
> I think git does that correctly for you automatically if you use it...

Will do.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web