On Tue, Jun 29, 2021 at 07:38:15AM -0700, Casey Schaufler wrote: > > IMHO the biggest problem is it's badly defined when you want to actually > > share filesystems between guests or between guests and the host. > > Right. The filesystem isn't the right layer for mapping xattrs. Well, let's enumerate the alternatives: * Some kind of stackable LSM? * Some kind of FUSE-like scheme? * Adding an eBPF hook which can perform the mapping The last may be the best bet, since different use cases can use different eBPF programs. The eBPF script can handle both the mapping as well some kind of specialized access control with respect to what entities are allowed set or get xattrs. > >>> It would be lovely if there was something more granular, (e.g. allowing > >>> user.NUMBER. or trusted.NUMBER. to be used by this particular guest). > >> We can't do that without breaking the "kernels aren't container aware" > >> mandate. eBPF scripts, since they are supplied by the user *can* be container aware. :-) - Ted
