Skip to content
  • German Maglione's avatar
    xattr mapping add a new type "unsupported" · 20c3c1a3
    German Maglione authored
    
    
    Right now for xattr remapping, we support types of "prefix", "ok" or
    "bad". Type "bad" returns -EPERM on setxattr() and hides xattr in
    listxattr(). For getxattr(), mapping code returns -EPERM but
    getxattr() code converts it to -ENODATA.
    
    A new semantics is needed where if an xattr is unsupported, then
    getxattr()/setxattr() return -ENOTSUP and listxattr() should hide
    the xattr. This is needed to simulate that security.selinux is not
    supported by virtiofs filesystem and in that case client falls back
    to some default label specified by policy.
    
    So add a new type "unsupported" which returns -ENOTSUP on getxattr()
    and setxattr() and hides xattrs in listxattr().
    
    For example, one can use following mapping rule to not support
    security.selinux xattr and allow others.
    
    "-o xattrmap=/unsupported/all/security.selinux/security.selinux//ok/all///"
    
    Signed-off-by: default avatarGerman Maglione <gmaglione@redhat.com>
    20c3c1a3