Re: Patch for restorecond to not report an error if filesystem does not support XATTR

[Joshua Brindle <jbrindle@tresys.com>]

Stephen Smalley wrote:
> 
> Interesting question...the policy Makefile and the fixfiles script have
> always just used a hardcoded list of filesystem types known to support
> file security labeling.  And the policy configuration explicitly
> specifies the filesystem types for which SELinux tries to use xattrs, as
> the mere presence of an xattr handler has never been a sufficient test.
> Possibly we should be extracting that list from policy and making it
> available for programs that need to know it.
> 
> Even testing the result of setxattr for EOPNOTSUPP is not 100%, as
> setxattr will also fall back to setting the incore value if a) you pass
> permission checks and b) the filesystem provides no setxattr method at
> all (NFS happens to provide one, but it only supports ACLs).  So it
> could succeed (e.g. devpts nodes) or fail with -EACCES (e.g. proc).
> 

Can we make an selinuxfs node that just outputs the list of fs_use_xattr 
filesystems?


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.