fuse: Add a new mount option capability

Originally all security.* xattrs were forbidden if selinux is disabled,
which was causing Samba's acl_xattr module to not work, as it would
store the NTACL in security.NTACL. To fix this http://review.gluster.org/#/c/12826/
was sent, which forbid only security.selinux. This opened up a getxattr
call on security.capability before every write fop and others.

Capabilities can be used without selinux, hence if selinux is disabled,
security.capability cannot be forbidden. Hence adding a new mount
option called capability.

Only when "--capability" or "--selinux" mount option is used,
security.capability is sent to the brick, else it is forbidden.

Change-Id: I77f60e0fb541deaa416159e45c78dd2ae653105e
BUG: 1309462
Signed-off-by: Poornima G <pgurusid@redhat.com>
Reviewed-on: http://review.gluster.org/13540
Smoke: Gluster Build System <jenkins@build.gluster.com>
NetBSD-regression: NetBSD Build System <jenkins@build.gluster.org>
CentOS-regression: Gluster Build System <jenkins@build.gluster.com>
Reviewed-by: Raghavendra G <rgowdapp@redhat.com>

1 files changed, 15 insertions, 0 deletions

diff --git a/glusterfsd/src/glusterfsd.c b/glusterfsd/src/glusterfsd.c
index 4edb5894c60..5df33c2476e 100644
--- a/glusterfsd/src/glusterfsd.c
+++ b/glusterfsd/src/glusterfsd.c
@@ -151,6 +151,8 @@ static struct argp_option gf_options[] = {
          "Mount the filesystem with POSIX ACL support"},
         {"selinux", ARGP_SELINUX_KEY, 0, 0,
          "Enable SELinux label (extened attributes) support on inodes"},
+        {"capability", ARGP_CAPABILITY_KEY, 0, 0,
+         "Enable Capability (extened attributes) support on inodes"},
 
         {"print-netgroups", ARGP_PRINT_NETGROUPS, "NETGROUP-FILE", 0,
          "Validate the netgroups file and print it out"},
@@ -366,6 +368,15 @@ set_fuse_mount_options (glusterfs_ctx_t *ctx, dict_t *options)
                 }
         }
 
+        if (cmd_args->capability) {
+                ret = dict_set_static_ptr (options, "capability", "on");
+                if (ret < 0) {
+                        gf_msg ("glusterfsd", GF_LOG_ERROR, 0, glusterfsd_msg_4,
+                                "capability");
+                        goto err;
+                }
+        }
+
         if (cmd_args->aux_gfid_mount) {
                 ret = dict_set_static_ptr (options, "virtual-gfid-access",
                                            "on");
@@ -794,6 +805,10 @@ parse_opts (int key, char *arg, struct argp_state *state)
                 gf_remember_xlator_option ("*-md-cache.cache-selinux=true");
                 break;
 
+        case ARGP_CAPABILITY_KEY:
+                cmd_args->capability = 1;
+                break;
+
         case ARGP_AUX_GFID_MOUNT_KEY:
                 cmd_args->aux_gfid_mount = 1;
                 break;