Re: [PATCH] security: Use org namespace for xattrs on macOS
On Thu, 2020-10-29 at 12:18 +0100, Michal Privoznik wrote:
On 10/29/20 11:49 AM, Andrea Bolognani wrote:
> Assuming macOS doesn't have any root-only namespaces, can we simply
> compile out the feature entirely on that OS? What about other targets
> like Windows?
What do you mean by compile out? The whole security_uitl.c is divided
into two parts: the actual implementation if XATTR_NAMESPACE is set
(which is currently only on Linux + BSD) and stubs which do nothing but
report an error.
Then, these internal APIs are called only from the secdrivers which we
don't build on Windows, do we?
Roman, is there any misbehaviour you're seeing? Or is this just porting
the feature to macOS? I'm not against it, I just don't have anywhere to
test it.
The issue Roman is trying to address with this patch is that
qemusecuritytest fails reporting a bunch of
Security Driver error : Extended attributes are not supported on
this system: Function not implemented
messages.
I'm not very familiar with security drivers but I guess the question
is: are xattrs a critical part of the security story, without which
no isolation is possible at all, or is it conceivable to have
security drivers that provide some amount of protection on macOS even
though they can't go as far as they can on Linux and FreeBSD?
In the former case we should modify the functions dealing with them
so that they become successful no-ops, in the latter we should
probably do what we do on Windows and not build the security drivers
at all on macOS.
At least that's my current reading of the situation :)
--
Andrea Bolognani / Red Hat / Virtualization