On Mon, Apr 28, 2008 at 12:15:33PM +0200, Miklos Szeredi wrote: > Which begs the question: why is ecryptfs doing that with the xattr > methods? Does it need to bypass the permission checks? Seems very > fishy to me. Yes, it was mainly to avoid the permission checks, since eCryptfs needs to be able to freely manipulate the cryptographic metadata stored in the xattr region of the lower file when the user mounts with the option to use the xattr region. I just used the same function to access the lower xattr (ecryptfs_setxattr(), for instance) for both xattr passthrough and metadata manipulation. This clearly can be changed at this point so that at least the xattr passthrough of xattr ops explicitly done by the user uses the vfs_* xattr calls instead. However, in terms of permissions that eCryptfs needs, there are some semantics that I need to work out. For instance, if eCryptfs absolutely respects a rule that says that the lower file may only be opened append-only, even by root, then eCryptfs cannot do its job, which may include writing out the crypto metadata to the xattr of the lower file. In that case, an operation on the lower fs will succeed, but that exact same operation on the file under eCryptfs will fail, since xattr.c::xattr_permission() will return -EPERM if IS_APPEND(inode), and an open in eCryptfs will automatically entail an xattr write if the mount is done with instructions to write the metadata to the xattr regions of the lower files. Mike -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
