Re: [PATCH] docs: describe the security considerations with virtiofsd xattr mapping

2021-06-30 Thread Dr. David Alan Gilbert
* Daniel P. Berrangé (berra...@redhat.com) wrote: > Different guest xattr prefixes have distinct access control rules applied > by the guest. When remapping a guest xattr care must be taken that the > remapping does not allow the a guest user to bypass guest kernel access > control rules. > > For

Re: [PATCH] docs: describe the security considerations with virtiofsd xattr mapping

2021-06-16 Thread Dr. David Alan Gilbert
* Daniel P. Berrangé (berra...@redhat.com) wrote: > Different guest xattr prefixes have distinct access control rules applied > by the guest. When remapping a guest xattr care must be taken that the > remapping does not allow the a guest user to bypass guest kernel access > control rules. > > For

Re: [Virtio-fs] [PATCH] docs: describe the security considerations with virtiofsd xattr mapping

2021-06-16 Thread Dr. David Alan Gilbert
* Vivek Goyal (vgo...@redhat.com) wrote: > On Tue, Jun 15, 2021 at 04:46:45PM +0100, Daniel P. Berrangé wrote: > > On Fri, Jun 11, 2021 at 11:42:22AM -0400, Vivek Goyal wrote: > > > On Fri, Jun 11, 2021 at 01:04:27PM +0100, Daniel P. Berrangé wrote: > > > > Different guest xattr prefixes have disti

Re: [Virtio-fs] [PATCH] docs: describe the security considerations with virtiofsd xattr mapping

2021-06-15 Thread Vivek Goyal
On Tue, Jun 15, 2021 at 04:46:45PM +0100, Daniel P. Berrangé wrote: > On Fri, Jun 11, 2021 at 11:42:22AM -0400, Vivek Goyal wrote: > > On Fri, Jun 11, 2021 at 01:04:27PM +0100, Daniel P. Berrangé wrote: > > > Different guest xattr prefixes have distinct access control rules applied > > > by the gue

Re: [Virtio-fs] [PATCH] docs: describe the security considerations with virtiofsd xattr mapping

2021-06-15 Thread Daniel P . Berrangé
On Fri, Jun 11, 2021 at 11:42:22AM -0400, Vivek Goyal wrote: > On Fri, Jun 11, 2021 at 01:04:27PM +0100, Daniel P. Berrangé wrote: > > Different guest xattr prefixes have distinct access control rules applied > > by the guest. When remapping a guest xattr care must be taken that the > > remapping d

Re: [Virtio-fs] [PATCH] docs: describe the security considerations with virtiofsd xattr mapping

2021-06-11 Thread Vivek Goyal
On Fri, Jun 11, 2021 at 01:04:27PM +0100, Daniel P. Berrangé wrote: > Different guest xattr prefixes have distinct access control rules applied > by the guest. When remapping a guest xattr care must be taken that the > remapping does not allow the a guest user to bypass guest kernel access > contro

[PATCH] docs: describe the security considerations with virtiofsd xattr mapping

2021-06-11 Thread Daniel P . Berrangé
Different guest xattr prefixes have distinct access control rules applied by the guest. When remapping a guest xattr care must be taken that the remapping does not allow the a guest user to bypass guest kernel access control rules. For example if 'trusted.*' which requires CAP_SYS_ADMIN is remappe