From 6bb6b1ec077a88319cff979bb888cc4d15e62bd0 Mon Sep 17 00:00:00 2001 From: Robin Humble Date: Fri, 26 May 2017 03:59:28 +1000 Subject: [PATCH] LU-9562 llite: Remove filtering of seclabel xattr The security.capability xattr is used to implement File Capabilities in recent Linux versions (eg. RHEL7). Capabilities are a fine grained approach to granting executables elevated privileges. eg. /bin/ping can have capabilities cap_net_admin,cap_net_raw+ep instead of being setuid root. This xattr has long been filtered out by llite, initially for stability reasons (b15587), and later over performance concerns as this xattr is read for every file with eg. 'ls --color'. Since LU-2869 xattr's are cached on clients, alleviating most performance concerns. Removing llite's filtering of the security.capability xattr enables using Lustre as a root filesystem, which is used on some large clusters. Signed-off-by: Robin Humble Change-Id: I88d7dec447ffc091c92fb2fb230ef549e5fb4c79 Reviewed-on: https://review.whamcloud.com/27292 Tested-by: Jenkins Tested-by: Maloo Reviewed-by: John L. Hammond Reviewed-by: Sebastien Buisson Reviewed-by: Oleg Drokin --- lustre/llite/xattr.c | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/lustre/llite/xattr.c b/lustre/llite/xattr.c index 4d42956..527ee40 100644 --- a/lustre/llite/xattr.c +++ b/lustre/llite/xattr.c @@ -147,11 +147,6 @@ int ll_setxattr_common(struct inode *inode, const char *name, strcmp(name, "lustre.lov") == 0)) RETURN(0); - /* b15587: ignore security.capability xattr for now */ - if ((xattr_type == XATTR_SECURITY_T && - strcmp(name, "security.capability") == 0)) - RETURN(0); - /* LU-549: Disable security.selinux when selinux is disabled */ if (xattr_type == XATTR_SECURITY_T && !selinux_is_enabled() && strcmp(name, "security.selinux") == 0) @@ -343,11 +338,6 @@ int ll_getxattr_common(struct inode *inode, const char *name, if (rc) RETURN(rc); - /* b15587: ignore security.capability xattr for now */ - if ((xattr_type == XATTR_SECURITY_T && - strcmp(name, "security.capability") == 0)) - RETURN(-ENODATA); - /* LU-549: Disable security.selinux when selinux is disabled */ if (xattr_type == XATTR_SECURITY_T && !selinux_is_enabled() && strcmp(name, "security.selinux") == 0) -- 1.8.3.1