Re: [PATCH] remove CONFIG_XFS_SECURITY

[Timothy Shimmin <tes@xxxxxxx>]

Eric Sandeen wrote:
> Eric Sandeen wrote:
> > Is there any point to this option?  Sure, it disables the ability
> > to set security attributes at runtime, but it doesn't slim down 
> > any code.
> >
> > Any reason to not remove it, and always allow security attributes
> > to be set?
>
> Ack? Nak?  Comments?
Fine by me. I'm not sure of the point either.
However, don't need to modify the attr_secure_capable function,
might as well delete it and
just use fs_noerr for the capable hook field.

--Tim

(BTW, will check in attr2 fixes soon - need to write a qa test ;-)


> -Eric
>
> > Signed-off-by: Eric Sandeen <sandeen@xxxxxxxxxxx>
> >
> > ---
> >
> > Index: linux-2.6.24-rc3/fs/xfs/Kconfig
> > ===================================================================
> > --- linux-2.6.24-rc3.orig/fs/xfs/Kconfig
> > +++ linux-2.6.24-rc3/fs/xfs/Kconfig
> > @@ -35,18 +35,6 @@ config XFS_QUOTA
> >  	  with or without the generic quota support enabled (CONFIG_QUOTA) -
> >  	  they are completely independent subsystems.
> >  
> > -config XFS_SECURITY
> > -	bool "XFS Security Label support"
> > -	depends on XFS_FS
> > -	help
> > -	  Security labels support alternative access control models
> > -	  implemented by security modules like SELinux.  This option
> > -	  enables an extended attribute namespace for inode security
> > -	  labels in the XFS filesystem.
> > -
> > -	  If you are not using a security module that requires using
> > -	  extended attributes for inode security labels, say N.
> > -
> >  config XFS_POSIX_ACL
> >  	bool "XFS POSIX ACL support"
> >  	depends on XFS_FS
> > Index: linux-2.6.24-rc3/fs/xfs/linux-2.6/xfs_super.h
> > ===================================================================
> > --- linux-2.6.24-rc3.orig/fs/xfs/linux-2.6/xfs_super.h
> > +++ linux-2.6.24-rc3/fs/xfs/linux-2.6/xfs_super.h
> > @@ -50,13 +50,8 @@ extern void xfs_qm_exit(void);
> >  # define set_posix_acl_flag(sb)	do { } while (0)
> >  #endif
> >  
> > -#ifdef CONFIG_XFS_SECURITY
> > -# define XFS_SECURITY_STRING	"security attributes, "
> > -# define ENOSECURITY		0
> > -#else
> > -# define XFS_SECURITY_STRING
> > -# define ENOSECURITY		EOPNOTSUPP
> > -#endif
> > +/* Used to be "configurable" so keep it around. */
> > +#define XFS_SECURITY_STRING	"security attributes, "
> >  
> >  #ifdef CONFIG_XFS_RT
> >  # define XFS_REALTIME_STRING	"realtime, "
> > Index: linux-2.6.24-rc3/fs/xfs/xfs_attr.c
> > ===================================================================
> > --- linux-2.6.24-rc3.orig/fs/xfs/xfs_attr.c
> > +++ linux-2.6.24-rc3/fs/xfs/xfs_attr.c
> > @@ -2651,7 +2651,7 @@ attr_secure_capable(
> >  	bhv_vnode_t	*vp,
> >  	cred_t		*cred)
> >  {
> > -	return -ENOSECURITY;
> > +	return 0;
> >  }
> >  
> >  STATIC int