The commit is pushed to "branch-rh7-3.10.0-327.18.2.vz7.14.x-ovz" and will
appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-327.18.2.vz7.14.11
------>
commit 942da1259b13f49cf10078a20442e98f7aaa1558
Author: Stanislav Kinsburskiy <skinsbur...@virtuozzo.com>
Date: Fri Jun 3 16:44:09 2016 +0400
ve: drop xattr policy toggle
This toggle was introduced to solve this bug (rhel5-based kernels):
https://bugs.openvz.org/browse/OVZ-6409
The root of the bug briefly: customer could add immutable attribute to a
file in
a container, thus preventing container removal, becuase this attribute was
bypassed (via simfs) to the actual file system.
The toggle introduced 3-fold policy:
1) "Allow": set of extended attrributes is granted (default in RHEL7 !!!)
2) "Ignore": set of extended attributes is skipped (do nothing and return
0).
3) "Forbid": set of extended attributes is not allowed.
Maybe this approach was applicable to rhel5 kernel, but it's absolutely
useless and harmful in rhel7 because:
1) Current ve xattr policy is "Allow", thus it doesn't prevent to set
immutable attribute.
2) Immutable attribute is set via ioctl, and doesn't pass vfs_setxattr
callback.
3) Set of immutable attribute is protected by CAP_LINUX_IMMUTABLE, which is
dropped in containers.
Signed-off-by: Stanislav Kinsburskiy <skinsbur...@virtuozzo.com>
khorenko@:
* "fs.ve-xattr-policy" sysctl does not prohibit user from setting immutable
atribute on files
* immutable attribute on file does not prevent Container destroy for
ploop-based Containers
* we don't see any reasons now to prohibit managing extended file attributes
(pfcache specific attributes cannot be managed from inside CT anyway)
=> let's clean the code
---
fs/xattr.c | 9 ---------
include/uapi/linux/xattr.h | 7 -------
kernel/ve/veowner.c | 8 --------
3 files changed, 24 deletions(-)
diff --git a/fs/xattr.c b/fs/xattr.c
index df05b6a..3377dff 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -125,15 +125,6 @@ vfs_setxattr(struct dentry *dentry, const char *name,
const void *value,
struct inode *inode = dentry->d_inode;
int error;
-#if defined(CONFIG_VE) && defined(CONFIG_SYSCTL)
- if (!ve_is_super(get_exec_env())) {
- if (ve_xattr_policy == VE_XATTR_POLICY_IGNORE)
- return 0;
- else if (ve_xattr_policy == VE_XATTR_POLICY_REJECT)
- return -EPERM;
- }
-#endif
-
error = xattr_permission(inode, name, MAY_WRITE);
if (error)
return error;
diff --git a/include/uapi/linux/xattr.h b/include/uapi/linux/xattr.h
index bb0c657..40bbc04 100644
--- a/include/uapi/linux/xattr.h
+++ b/include/uapi/linux/xattr.h
@@ -10,13 +10,6 @@
#ifndef _UAPI_LINUX_XATTR_H
#define _UAPI_LINUX_XATTR_H
-#ifdef CONFIG_VE
-extern int ve_xattr_policy;
-#define VE_XATTR_POLICY_ACCEPT 0
-#define VE_XATTR_POLICY_IGNORE 1
-#define VE_XATTR_POLICY_REJECT 2
-#endif
-
#define XATTR_CREATE 0x1 /* set value, fail if attr already exists */
#define XATTR_REPLACE 0x2 /* set value, fail if attr does not exist */
diff --git a/kernel/ve/veowner.c b/kernel/ve/veowner.c
index 1a7e735..005cdaf 100644
--- a/kernel/ve/veowner.c
+++ b/kernel/ve/veowner.c
@@ -52,7 +52,6 @@ static void prepare_proc(void)
* OpenVZ sysctl
* ------------------------------------------------------------------------
*/
-int ve_xattr_policy = VE_XATTR_POLICY_ACCEPT;
static int ve_area_access_check;
/*
@@ -72,13 +71,6 @@ static struct ctl_table vz_fs_table[] = {
.proc_handler = proc_dointvec,
},
{
- .procname = "ve-xattr-policy",
- .data = &ve_xattr_policy,
- .maxlen = sizeof(int),
- .mode = 0644,
- .proc_handler = &proc_dointvec,
- },
- {
.procname = "fsync-enable",
.data = &ve0.fsync_enable,
.maxlen = sizeof(int),
_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel
