[Cluster-devel] [RFC 11/11] gfs2: Invalide security labels of inodes that go invalid

[Andreas Gruenbacher]

Christoph,

thanks for your review.

2015-08-21 8:49 GMT+02:00 Christoph Hellwig <hch at infradead.org>:
> On Thu, Aug 20, 2015 at 08:19:58PM +0200, Andreas Gruenbacher wrote:
>> Invalide security labels of inodes when they go invalid.  SELinux will reload
>> the "security.selinux" xattr via iop->igetxattr on the next access.
>
> And if that's all that you needed just skip the detour trough the VFS
> interfaces.

We have more than one file system that has a similar consistency model
as gfs2 so it's not really a one-off hack, and we have selinux as well
as smack, with several different xattr names.

Assuming that selinux or smack only have an inode available, how would
they (re)load an inode's security label other than going through the
vfs?

I could imagine bypassing the xattr handler abstraction in the
affected file systems, but that doesn't seem much better either.

Thanks,
Andreas