Whamcloud - gitweb
LU-9562 llite: Remove filtering of seclabel xattr 92/27292/2
authorRobin Humble <plaguedbypenguins@gmail.com>
Thu, 25 May 2017 17:59:28 +0000 (03:59 +1000)
committerOleg Drokin <oleg.drokin@intel.com>
Wed, 7 Jun 2017 20:31:54 +0000 (20:31 +0000)
commit6bb6b1ec077a88319cff979bb888cc4d15e62bd0
tree7273cfba6d6315525ec95f810edd00a7b559974f
parent115c4ce835ac591c6d9b5f19c31b2d67c30748d3
LU-9562 llite: Remove filtering of seclabel xattr

The security.capability xattr is used to implement File
Capabilities in recent Linux versions (eg. RHEL7).
Capabilities are a fine grained approach to granting
executables elevated privileges. eg. /bin/ping can have
capabilities cap_net_admin,cap_net_raw+ep instead of being
setuid root.

This xattr has long been filtered out by llite, initially for
stability reasons (b15587), and later over performance
concerns as this xattr is read for every file with eg.
'ls --color'. Since LU-2869 xattr's are cached on clients,
alleviating most performance concerns.

Removing llite's filtering of the security.capability xattr
enables using Lustre as a root filesystem, which is used on
some large clusters.

Signed-off-by: Robin Humble <plaguedbypenguins@gmail.com>
Change-Id: I88d7dec447ffc091c92fb2fb230ef549e5fb4c79
Reviewed-on: https://review.whamcloud.com/27292
Tested-by: Jenkins
Tested-by: Maloo <hpdd-maloo@intel.com>
Reviewed-by: John L. Hammond <john.hammond@intel.com>
Reviewed-by: Sebastien Buisson <sbuisson@ddn.com>
Reviewed-by: Oleg Drokin <oleg.drokin@intel.com>
lustre/llite/xattr.c