Modify extended attribute protection model to authorize based on

attribute namespace and DAC protection on file:
	- Attribute names beginning with '$' are in the system namespace
	- The attribute name "$" is reserved
	- System namespace attributes may only be read/set by suser()
	  or by kernel (cred == NULL)
	- Other attribute names are in the application namespace
	- The attribute name "" is reserved
	- Application namespace attributes are protected in the manner
	  of the target file permission

o Kernel changes
	- Add ufs_extattr_valid_attrname() to check whether the requested
	  attribute "set" or "enable" is appropriate (i.e., non-reserved)
	- Modify ufs_extattr_credcheck() to accept target file vnode, not
	  to take inode uid
	- Modify ufs_extattr_credcheck() to check namespace, then enforce
	  either kernel/suser for system namespace, or vaccess() for
	  application namespace
o EA backing file format changes
	- Remove permission fields from extended attribute backing file
	  header
	- Bump extended attribute backing file header version to 3
o Update extattrctl.c and extattrctl.8
	- Remove now deprecated -r and -w arguments to initattr, as
	  permissions are now implicit
	- (unrelated) fix error reporting and unlinking during failed
	  initattr to remove duplicate/inaccurate error messages, and to
	  only unlink if the failure wasn't in the backing file open()

Obtained from:	TrustedBSD Project

2 files changed, 18 insertions, 76 deletions

diff --git a/usr.sbin/extattrctl/extattrctl.8 b/usr.sbin/extattrctl/extattrctl.8
index 223118c..f65fe1a 100644
--- a/usr.sbin/extattrctl/extattrctl.8
+++ b/usr.sbin/extattrctl/extattrctl.8
@@ -41,8 +41,6 @@
 .Nm extattrctl
 .Cm initattr
 .Op Fl p Ar path
-.Op Fl r Ar kroa
-.Op Fl w Ar kroa
 .Ar attrsize
 .Ar attrfile
 .Nm extattrctl
@@ -63,7 +61,7 @@ as well as initialization of attribute backing files, and enabling and
 disabling of specific extended attributes on a file system.
 .Pp
 The first argument on the command line indicates the operation to be
-performend.  Operation must be one of the following:
+performed.  Operation must be one of the following:
 .Bl -tag -width indent
 .It Cm start Ar path
 Start extended attribute support on the file system named using
@@ -77,8 +75,6 @@ Extended attribute support must previously have been started.
 .It Xo
 .Cm initattr
 .Op Fl p Ar path
-.Op Fl r Ar kroa
-.Op Fl w Ar kroa
 .Ar attrsize attrfile
 .Xc
 Create and initialize a file to use as an attribute backing file.
@@ -95,25 +91,6 @@ This has the advantage of guaranteeing that space will be available
 for attributes when they are written, preventing low disk space conditions
 from denying attribute service.
 .Pp
-The
-.Fl r
-and
-.Fl w
-options can be used to set the read and write permissions on the named
-attribute, respectively.
-There are four levels possible for both read and write:
-.Dq k
-limits reading or writing to the kernel,
-.Dq r
-limits activities to root,
-.Dq o
-limits activities to root and the owner of the file having the attribute
-read or written, and
-.Dq q
-allows any user to perform the attribute operation.
-The default is to limit activities to the root user, or
-.Dq r .
-.Pp
 This file should not exist before running
 .Cm initattr.
 .It Cm enable Ar path Ar attrname Ar attrfile
@@ -145,9 +122,8 @@ Start extended attributes on the root file system.
 .Dl extattrctl initattr 17 /.attribute/md5
 .Pp
 Create an attribute backing file in /.attribute/md5, and set the maximum
-size of each attribute to 17 bytes.  Sparse files are used for storing the
-attributes, and the default permissions limiting access to the root user
-are implied.
+size of each attribute to 17 bytes, with a sparse file used for storing
+the attributes.
 .Pp
 .Dl extattrctl enable / md5 /.attribute/md5
 .Pp
diff --git a/usr.sbin/extattrctl/extattrctl.c b/usr.sbin/extattrctl/extattrctl.c
index 6b8c5d1..c5c2508 100644
--- a/usr.sbin/extattrctl/extattrctl.c
+++ b/usr.sbin/extattrctl/extattrctl.c
@@ -54,41 +54,12 @@ usage(void)
 	    "usage:\n"
 	    "  extattrctl start [path]\n"
 	    "  extattrctl stop [path]\n"
-	    "  extattrctl initattr [-p path] [-r [kroa]] [-w [kroa]] "
-	    "[attrsize] [attrfile]\n"
+	    "  extattrctl initattr [-p path] [attrsize] [attrfile]\n"
 	    "  extattrctl enable [path] [attrname] [attrfile]\n"
 	    "  extattrctl disable [path] [attrname]\n");
 	exit(-1);
 }
 
-/*
- * Return a level, or -1
- */
-int
-extattr_level_from_string(char *string)
-{
-
-	if (strlen(string) != 1)
-		return (-1);
-
-	switch(string[0]) {
-	case 'k':
-	case 'K':
-		return (UFS_EXTATTR_PERM_KERNEL);
-	case 'r':
-	case 'R':
-		return (UFS_EXTATTR_PERM_ROOT);
-	case 'o':
-	case 'O':
-		return (UFS_EXTATTR_PERM_OWNER);
-	case 'a':
-	case 'A':
-		return (UFS_EXTATTR_PERM_ANYONE);
-	default:
-		return (-1);
-	}
-}
-
 long
 num_inodes_by_path(char *path)
 {
@@ -111,8 +82,6 @@ initattr(int argc, char *argv[])
 	char	*fs_path = NULL;
 	char	*zero_buf = NULL;
 	long	loop, num_inodes;
-	int	initattr_rlevel = UFS_EXTATTR_PERM_ROOT;
-	int	initattr_wlevel = UFS_EXTATTR_PERM_ROOT;
 	int	ch, i, error;
 
 	optind = 0;
@@ -121,16 +90,6 @@ initattr(int argc, char *argv[])
 		case 'p':
 			fs_path = strdup(optarg);
 			break;
-		case 'r':
-			initattr_rlevel = extattr_level_from_string(optarg);
-			if (initattr_rlevel == -1)
-				usage();
-			break;
-		case 'w':
-			initattr_wlevel = extattr_level_from_string(optarg);
-			if (initattr_wlevel == -1)
-				usage();
-			break;
 		case '?':
 		default:
 			usage();
@@ -146,8 +105,6 @@ initattr(int argc, char *argv[])
 	if ((i = open(argv[1], O_CREAT | O_EXCL | O_WRONLY, 0600)) != -1) {
 		uef.uef_magic = UFS_EXTATTR_MAGIC;
 		uef.uef_version = UFS_EXTATTR_VERSION;
-		uef.uef_write_perm = initattr_wlevel;
-		uef.uef_read_perm = initattr_rlevel;
 		uef.uef_size = atoi(argv[0]);
 		if (write(i, &uef, sizeof(uef)) == -1)
 			error = -1;
@@ -170,7 +127,12 @@ initattr(int argc, char *argv[])
 			}
 		}
 	}
-	if (i == -1 || error == -1) {
+	if (i == -1) {
+		/* unable to open file */
+		perror(argv[1]);
+		return (-1);
+	}
+	if (error == -1) {
 		perror(argv[1]);
 		unlink(argv[1]);
 		return (-1);
@@ -191,29 +153,33 @@ main(int argc, char *argv[])
 		if (argc != 3)
 			usage();
 		error = extattrctl(argv[2], UFS_EXTATTR_CMD_START, 0, 0);
+		if (error)
+			perror("extattrctl start");
 	} else if (!strcmp(argv[1], "stop")) {
 		if (argc != 3)
 			usage();
 		error = extattrctl(argv[2], UFS_EXTATTR_CMD_STOP, 0, 0);
+		if (error)
+			perror("extattrctl stop");
 	} else if (!strcmp(argv[1], "enable")) {
 		if (argc != 5)
 			usage();
 		error = extattrctl(argv[2], UFS_EXTATTR_CMD_ENABLE, argv[3],
 		    argv[4]);
+		if (error)
+			perror("extattrctl enable");
 	} else if (!strcmp(argv[1], "disable")) {
 		if (argc != 4)
 			usage();
 		error = extattrctl(argv[2], UFS_EXTATTR_CMD_DISABLE, argv[3],
 		    NULL);
+		if (error)
+			perror("extattrctl disable");
 	} else if (!strcmp(argv[1], "initattr")) {
 		argc -= 2;
 		argv += 2;
 		error = initattr(argc, argv);
 	} else
 		usage();
-
-	if (error)
-		perror(argv[1]);
-
 	return(error);
 }