libarchive and MAC labels

[Dewayne Geraghty]

> -----Original Message-----
> From: owner-freebsd-security at freebsd.org 
> [mailto:owner-freebsd-security at freebsd.org] On Behalf Of 
> priit at cc.ttu.ee
> Sent: Tuesday, 11 June 2013 1:10 AM
> To: freebsd-security at freebsd.org
> Subject: libarchive and MAC labels
> 
> I've created a patch for libarchive that allows storing and 
> restoring MAC labels from/to a multilabel filesystem using 
> bsdtar. Now before going anywhere with this I had a few questions:
> 
> - how much general interest is there in such a feature? Would 
> this be a welcome addition to libarchive, either "upstream" 
> or as integrated in the system source tree. I would be 
> especially interested in the opinion of people who have 
> already been involved with the MAC development.
> 
> - right now the labels are stored silently, similar to ACL-s 
> and extended attributes. They are not extracted by default, 
> only when the '-p' option is specified (default as root). 
> This seems consistent, however it would also be possible to 
> add a switch so that the labels wouldn't be archived unless 
> explicitly requested.
> 
> - the labels are stored in text representation, as converted 
> by mac_to_text(). This could potentially cause some future 
> breakage, if the text representation ever changes. Also, 
> restoring a label partially (let's say a biba+MLS label with 
> only biba enabled) does not work. Any thoughts on that?
> 
> Thanks,
> Priit.
> _______________________________________________
> freebsd-security at freebsd.org mailing list 
> http://lists.freebsd.org/mailman/listinfo/freebsd-security
> To unsubscribe, send any mail to 
> "freebsd-security-unsubscribe at freebsd.org"

Priit,

Thank-you for addressing a significant backup/recovery shortcoming. 

I've used biba extensively, however if files/directories are backed-up with MLS+biba and recovered in a biba only environment, that
is the sysadmin choice.  Warning messages are fine, but the restoration should continue (if possible).

Regards, Dewayne.