[pbs-devel] [PATCH proxmox-backup] fix #3393: tools/xattr: allow xattr 'security.NTACL'

[pbs-devel] [PATCH proxmox-backup] fix #3393: tools/xattr: allow xattr 'security.NTACL'

[Dominik Csapak]

in some configurations, samba stores NTFS-ACLs in this xattr[0], so
we should backup (if we can)

altough the 'security' namespace is special (e.g. in use by
selinux, etc.) this value is normally only used by samba and we
should be able to back it up.

to restore it, the user needs at least 'CAP_SYS_ADMIN' rights, otherwise
it cannot be set

0: https://www.samba.org/samba/docs/current/man-html/vfs_acl_xattr.8.html

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
---
tested here by setting it manually with setfattr and restored
successfully as root (as user i got a permission denied warning)

 src/tools/xattr.rs | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/tools/xattr.rs b/src/tools/xattr.rs
index 6b712d14..500af326 100644
--- a/src/tools/xattr.rs
+++ b/src/tools/xattr.rs
@@ -170,6 +170,10 @@ pub fn is_valid_xattr_name(c_name: &CStr) -> bool {
     if name.starts_with(b"user.") || name.starts_with(b"trusted.") {
         return true;
     }
+    // samba saves windows ACLs there
+    if name == b"security.NTACL" {
+        return true;
+    }
     is_security_capability(c_name)
 }
 
-- 
2.20.1

[pbs-devel] applied: [PATCH proxmox-backup] fix #3393: tools/xattr: allow xattr 'security.NTACL'

[Wolfgang Bumiller]

considering the reason behind not storing all of the 'security'
namespace is simply the possible special semantics, and this one, at
least to my knowledge, not actually having one, I think this is fine

applied

On Tue, Apr 20, 2021 at 11:19:53AM +0200, Dominik Csapak wrote:
> in some configurations, samba stores NTFS-ACLs in this xattr[0], so
> we should backup (if we can)
> 
> altough the 'security' namespace is special (e.g. in use by
> selinux, etc.) this value is normally only used by samba and we
> should be able to back it up.
> 
> to restore it, the user needs at least 'CAP_SYS_ADMIN' rights, otherwise
> it cannot be set
> 
> 0: https://www.samba.org/samba/docs/current/man-html/vfs_acl_xattr.8.html
> 
> Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
> ---
> tested here by setting it manually with setfattr and restored
> successfully as root (as user i got a permission denied warning)
> 
>  src/tools/xattr.rs | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/src/tools/xattr.rs b/src/tools/xattr.rs
> index 6b712d14..500af326 100644
> --- a/src/tools/xattr.rs
> +++ b/src/tools/xattr.rs
> @@ -170,6 +170,10 @@ pub fn is_valid_xattr_name(c_name: &CStr) -> bool {
>      if name.starts_with(b"user.") || name.starts_with(b"trusted.") {
>          return true;
>      }
> +    // samba saves windows ACLs there
> +    if name == b"security.NTACL" {
> +        return true;
> +    }
>      is_security_capability(c_name)
>  }
>  
> -- 
> 2.20.1