linux-kernel - Re: [PATCH v2 1/1] xattr: Allow user.* xattr on symlink and special files

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 12 Jul 2021 10:02:47 -0400
From:   Vivek Goyal <vgoyal@...hat.com>
To:     Bruce Fields <bfields@...hat.com>
Cc:     Casey Schaufler <casey@...aufler-ca.com>,
        Christian Brauner <christian.brauner@...ntu.com>,
        linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
        viro@...iv.linux.org.uk, virtio-fs@...hat.com, dwalsh@...hat.com,
        dgilbert@...hat.com, casey.schaufler@...el.com,
        linux-security-module@...r.kernel.org, selinux@...r.kernel.org,
        tytso@....edu, miklos@...redi.hu, gscrivan@...hat.com,
        jack@...e.cz, Christoph Hellwig <hch@...radead.org>
Subject: Re: [PATCH v2 1/1] xattr: Allow user.* xattr on symlink and special
 files

On Fri, Jul 09, 2021 at 04:10:16PM -0400, Bruce Fields wrote:
> On Fri, Jul 9, 2021 at 1:59 PM Vivek Goyal <vgoyal@...hat.com> wrote:
> > nfs seems to have some issues.
> 
> I'm not sure what the expected behavior is for nfs.  All I have for
> now is some generic troubleshooting ideas, sorry:
> 
> > - I can set user.foo xattr on symlink and query it back using xattr name.
> >
> >   getfattr -h -n user.foo foo-link.txt
> >
> >   But when I try to dump all xattrs on this file, user.foo is being
> >   filtered out it looks like. Not sure why.
> 
> Logging into the server and seeing what's set there could help confirm
> whether it's the client or server that's at fault.  (Or watching the
> traffic in wireshark; there are GET/SET/LISTXATTR ops that should be
> easy to spot.)
> 
> > - I can't set "user.foo" xattr on a device node on nfs and I get
> >   "Permission denied". I am assuming nfs server is returning this.
> 
> Wireshark should tell you whether it's the server or client doing that.
> 
> The RFC is https://datatracker.ietf.org/doc/html/rfc8276, and I don't
> see any explicit statement about what the server should do in the case
> of symlinks or device nodes, but I do see "Any regular file or
> directory may have a set of extended attributes", so that was clearly
> the assumption.  Also, NFS4ERR_WRONG_TYPE is listed as a possible
> error return for the xattr ops.  But on a quick skim I don't see any
> explicit checks in the nfsd code, so I *think* it's just relying on
> the vfs for any file type checks.

Hi Bruce,

Thanks for the response. I am just trying to do set a user.foo xattr on
a device node on nfs.

setfattr -n "user.foo" -v "bar" /mnt/nfs/test-dev

and I get -EACCESS.

I put some printk() statements and EACCESS is being returned from here.

nfs4_xattr_set_nfs4_user() {
        if (!nfs_access_get_cached(inode, current_cred(), &cache, true)) {
                if (!(cache.mask & NFS_ACCESS_XAWRITE)) {
                        return -EACCES;
                }
        }
}

Value of cache.mask=0xd at the time of error.

Thanks
Vivek