Re: [PATCH 2/8] move xattr permission checks into the VFS

[Christoph Hellwig <hch@lst.de>]

On Mon, Oct 31, 2005 at 10:22:09PM -0500, Trond Myklebust wrote:
> > +	/*
> > +	 * No restriction for security.* and system.* from the VFS.  Decision
> > +	 * on these is left to the underlying filesystem / security module.
> > +	 */
> > +	if (!strncmp(name, XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN) ||
> > +	    !strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
> > +		return 0;

> The call to permission() here is not always applicable. Some filesystems
> may have different permissions when it comes to the right to read or set
> ACLs (both AFS and NFSv4, for instance, have such features).
> 
> For the NFSv4 client, therefore, I'd like to be able to override this
> particular check (and leave it up to the server to verify that we are
> authorised).

See the code above.  system namespace attributes (which ACLs are) are
never handled in the VFS but always left to the filesystem.