LU-9562 llite: Remove filtering of seclabel xattr

The security.capability xattr is used to implement File
Capabilities in recent Linux versions (eg. RHEL7).
Capabilities are a fine grained approach to granting
executables elevated privileges. eg. /bin/ping can have
capabilities cap_net_admin,cap_net_raw+ep instead of being
setuid root.

This xattr has long been filtered out by llite, initially for
stability reasons (b15587), and later over performance
concerns as this xattr is read for every file with eg.
'ls --color'. Since LU-2869 xattr's are cached on clients,
alleviating most performance concerns.

Removing llite's filtering of the security.capability xattr
enables using Lustre as a root filesystem, which is used on
some large clusters.

Signed-off-by: Robin Humble <plaguedbypenguins@gmail.com>
Change-Id: I88d7dec447ffc091c92fb2fb230ef549e5fb4c79
Reviewed-on: https://review.whamcloud.com/27292
Tested-by: Jenkins
Tested-by: Maloo <hpdd-maloo@intel.com>
Reviewed-by: John L. Hammond <john.hammond@intel.com>
Reviewed-by: Sebastien Buisson <sbuisson@ddn.com>
Reviewed-by: Oleg Drokin <oleg.drokin@intel.com>

diff --git a/lustre/llite/xattr.c b/lustre/llite/xattr.c
index 4d42956..527ee40 100644 (file)
--- a/lustre/llite/xattr.c
+++ b/lustre/llite/xattr.c
@@ -147,11 +147,6 @@ int ll_setxattr_common(struct inode *inode, const char *name,
                 strcmp(name, "lustre.lov") == 0))
                RETURN(0);
 
-       /* b15587: ignore security.capability xattr for now */
-       if ((xattr_type == XATTR_SECURITY_T &&
-           strcmp(name, "security.capability") == 0))
-               RETURN(0);
-
        /* LU-549:  Disable security.selinux when selinux is disabled */
        if (xattr_type == XATTR_SECURITY_T && !selinux_is_enabled() &&
            strcmp(name, "security.selinux") == 0)
@@ -343,11 +338,6 @@ int ll_getxattr_common(struct inode *inode, const char *name,
         if (rc)
                 RETURN(rc);
 
-        /* b15587: ignore security.capability xattr for now */
-        if ((xattr_type == XATTR_SECURITY_T &&
-            strcmp(name, "security.capability") == 0))
-                RETURN(-ENODATA);
-
         /* LU-549:  Disable security.selinux when selinux is disabled */
         if (xattr_type == XATTR_SECURITY_T && !selinux_is_enabled() &&
             strcmp(name, "security.selinux") == 0)