Re: Possible issue with linux xattr support?

On 8/29/23 14:15, Felix Palmen wrote:
> * Kyle Evans <kevans@FreeBSD.org> [20230829 14:07]:
>> On 8/29/23 14:02, Shawn Webb wrote:
>>> Back in 2019, I had a similar issue: I needed access to be able to
>>> read/write to the system extended attribute namespace from within a
>>> jailed context. I wrote a rather simple patch that provides that
>>> support on a per-jail basis:
>>>
>>> https://git.hardenedbsd.org/hardenedbsd/HardenedBSD/-/commit/96c85982b45e44a6105664c7068a92d0a61da2a3
>>>
>>> Hopefully that's useful to someone.
>>>
>>> Thanks,
>>>
>>
>> FWIW (which likely isn't much), I like this approach much better; it makes
>> more sense to me that it's a feature controlled by the creator of the jail
>> and not one allowed just by using a compat ABI within a jail.
> 
> Well, a typical GNU userland won't work in a jail without this, that's
> what I know now. But I'm certainly with you, it doesn't feel logical
> that a Linux binary can do something in a jail a FreeBSD binary can't.
> 
> So, indeed, making it a jail option sounds better.
> 
> Unless, bringing back a question raised earlier in this thread: What's
> the reason to restrict this in a jailed context in the first place? IOW,
> could it just be allowed unconditionally?
> 

I don't think we can answer this definitively, FreeBSD has a pretty wide 
variety of users. I note that we don't /need/ to answer it, either, with 
Shawn's patch; it defaults to system xattrs allowed and an individual 
sysadmin can make that decision for their own context (and supporting 
the knob is relatively low-cost).

The only part I'm not sure I agree with is the addition of the new flag 
to PR_ALLOW_DIFFERENCES. That allows it to be disabled by system root 
for jail "foo", but root in jail "foo" can create another jail "foo.bar" 
in which it *is* enabled (rather than only allowing "foo.bar" to have it 
enabled if its parent does). IMO the name PR_ALLOW_DIFFERENCES is a bit 
off, because to me it would imply that it just allows the flag to be set 
in one jail and unset in its child jail.

Thanks,

Kyle Evans