From 5b5f03d2665687ab717f123da1266bcd3a83da0f Mon Sep 17 00:00:00 2001 From: Poornima G Date: Fri, 26 Feb 2016 06:42:14 -0500 Subject: fuse: Add a new mount option capability Originally all security.* xattrs were forbidden if selinux is disabled, which was causing Samba's acl_xattr module to not work, as it would store the NTACL in security.NTACL. To fix this http://review.gluster.org/#/c/12826/ was sent, which forbid only security.selinux. This opened up a getxattr call on security.capability before every write fop and others. Capabilities can be used without selinux, hence if selinux is disabled, security.capability cannot be forbidden. Hence adding a new mount option called capability. Only when "--capability" or "--selinux" mount option is used, security.capability is sent to the brick, else it is forbidden. Change-Id: I77f60e0fb541deaa416159e45c78dd2ae653105e BUG: 1309462 Signed-off-by: Poornima G Reviewed-on: http://review.gluster.org/13540 Smoke: Gluster Build System NetBSD-regression: NetBSD Build System CentOS-regression: Gluster Build System Reviewed-by: Raghavendra G --- glusterfsd/src/glusterfsd.c | 15 +++++++++++++++ glusterfsd/src/glusterfsd.h | 1 + 2 files changed, 16 insertions(+) (limited to 'glusterfsd') diff --git a/glusterfsd/src/glusterfsd.c b/glusterfsd/src/glusterfsd.c index 4edb5894c60..5df33c2476e 100644 --- a/glusterfsd/src/glusterfsd.c +++ b/glusterfsd/src/glusterfsd.c @@ -151,6 +151,8 @@ static struct argp_option gf_options[] = { "Mount the filesystem with POSIX ACL support"}, {"selinux", ARGP_SELINUX_KEY, 0, 0, "Enable SELinux label (extened attributes) support on inodes"}, + {"capability", ARGP_CAPABILITY_KEY, 0, 0, + "Enable Capability (extened attributes) support on inodes"}, {"print-netgroups", ARGP_PRINT_NETGROUPS, "NETGROUP-FILE", 0, "Validate the netgroups file and print it out"}, @@ -366,6 +368,15 @@ set_fuse_mount_options (glusterfs_ctx_t *ctx, dict_t *options) } } + if (cmd_args->capability) { + ret = dict_set_static_ptr (options, "capability", "on"); + if (ret < 0) { + gf_msg ("glusterfsd", GF_LOG_ERROR, 0, glusterfsd_msg_4, + "capability"); + goto err; + } + } + if (cmd_args->aux_gfid_mount) { ret = dict_set_static_ptr (options, "virtual-gfid-access", "on"); @@ -794,6 +805,10 @@ parse_opts (int key, char *arg, struct argp_state *state) gf_remember_xlator_option ("*-md-cache.cache-selinux=true"); break; + case ARGP_CAPABILITY_KEY: + cmd_args->capability = 1; + break; + case ARGP_AUX_GFID_MOUNT_KEY: cmd_args->aux_gfid_mount = 1; break; diff --git a/glusterfsd/src/glusterfsd.h b/glusterfsd/src/glusterfsd.h index 8247469e6e1..2a95683b33a 100644 --- a/glusterfsd/src/glusterfsd.h +++ b/glusterfsd/src/glusterfsd.h @@ -92,6 +92,7 @@ enum argp_option_keys { ARGP_SECURE_MGMT_KEY = 172, ARGP_GLOBAL_TIMER_WHEEL = 173, ARGP_RESOLVE_GIDS_KEY = 174, + ARGP_CAPABILITY_KEY = 175, }; struct _gfd_vol_top_priv_t { -- cgit