fuse: Add a new mount option capability

Originally all security.* xattrs were forbidden if selinux is disabled,
which was causing Samba's acl_xattr module to not work, as it would
store the NTACL in security.NTACL. To fix this http://review.gluster.org/#/c/12826/
was sent, which forbid only security.selinux. This opened up a getxattr
call on security.capability before every write fop and others.

Capabilities can be used without selinux, hence if selinux is disabled,
security.capability cannot be forbidden. Hence adding a new mount
option called capability.

Only when "--capability" or "--selinux" mount option is used,
security.capability is sent to the brick, else it is forbidden.

Backport of : http://review.gluster.org/#/c/13540/ &
              http://review.gluster.org/#/c/13653/

BUG: 1309462
Change-Id: Ib8d4f32d9f1458f4d71a05785f92b526aa7033ff
Signed-off-by: Poornima G <pgurusid@redhat.com>
Reviewed-on: http://review.gluster.org/13626
Tested-by: Vijay Bellur <vbellur@redhat.com>
Smoke: Gluster Build System <jenkins@build.gluster.com>
CentOS-regression: Gluster Build System <jenkins@build.gluster.com>
NetBSD-regression: NetBSD Build System <jenkins@build.gluster.org>
Reviewed-by: Vijay Bellur <vbellur@redhat.com>

1 files changed, 26 insertions, 0 deletions

diff --git a/xlators/mount/fuse/src/fuse-helpers.c b/xlators/mount/fuse/src/fuse-helpers.c
index 0f8abf03d32..3ccd46efaeb 100644
--- a/xlators/mount/fuse/src/fuse-helpers.c
+++ b/xlators/mount/fuse/src/fuse-helpers.c
@@ -652,3 +652,29 @@ fuse_ignore_xattr_set (fuse_private_t *priv, char *key)
 
         return ret;
 }
+
+int
+fuse_check_selinux_cap_xattr (fuse_private_t *priv, char *name)
+{
+        int ret = -1;
+
+        if (strcmp (name, "security.selinux") &&
+                        strcmp (name, "security.capability")) {
+                /* if xattr name is not of interest, no validations needed */
+                ret = 0;
+                goto out;
+        }
+
+        if ((strcmp (name, "security.selinux") == 0) &&
+            (priv->selinux)) {
+                ret = 0;
+        }
+
+        if ((strcmp (name, "security.capability") == 0) &&
+            ((priv->capability) || (priv->selinux))) {
+                ret = 0;
+        }
+
+out:
+        return ret;
+}