[pbs-devel] applied: [PATCH proxmox-backup] fix #3393: tools/xattr: allow xattr 'security.NTACL'

[Wolfgang Bumiller <w.bumiller@proxmox.com>]

considering the reason behind not storing all of the 'security'
namespace is simply the possible special semantics, and this one, at
least to my knowledge, not actually having one, I think this is fine

applied

On Tue, Apr 20, 2021 at 11:19:53AM +0200, Dominik Csapak wrote:
> in some configurations, samba stores NTFS-ACLs in this xattr[0], so
> we should backup (if we can)
> 
> altough the 'security' namespace is special (e.g. in use by
> selinux, etc.) this value is normally only used by samba and we
> should be able to back it up.
> 
> to restore it, the user needs at least 'CAP_SYS_ADMIN' rights, otherwise
> it cannot be set
> 
> 0: https://www.samba.org/samba/docs/current/man-html/vfs_acl_xattr.8.html
> 
> Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
> ---
> tested here by setting it manually with setfattr and restored
> successfully as root (as user i got a permission denied warning)
> 
>  src/tools/xattr.rs | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/src/tools/xattr.rs b/src/tools/xattr.rs
> index 6b712d14..500af326 100644
> --- a/src/tools/xattr.rs
> +++ b/src/tools/xattr.rs
> @@ -170,6 +170,10 @@ pub fn is_valid_xattr_name(c_name: &CStr) -> bool {
>      if name.starts_with(b"user.") || name.starts_with(b"trusted.") {
>          return true;
>      }
> +    // samba saves windows ACLs there
> +    if name == b"security.NTACL" {
> +        return true;
> +    }
>      is_security_capability(c_name)
>  }
>  
> -- 
> 2.20.1