Description of problem: Apparently we use GF_IF_INTERNAL_XATTR_GOTO in various strategic places to check for user attempts to *modify* internal xattrs. For example, afr_setxattr checks for trusted.afr.*, dht_setxattr checks for trusted.glusterfs.dht, and so on. However, these checks seem to be absent from entry points to *remove* xattrs - e.g. afr_removexattr, dht_removexattr. There's a patch in progress to add handling for fremovexattr, so that case can be handled as part of the patch, but we also need something for removexattr. Steps to Reproduce: setfattr -x trusted.glusterfs.dht ... Actual results: internal xattrs are removed. Expected results: request should be rejected.
Rajesh, this is already done right? Can you paste the url of patch (from review.gluster.com) and mark it as ON_QA?
modifying of internal xattrs has been prevented with that patch. we are not currently handling removing of the internal xattrs. to be done.. IMO, we should prevent users from removing, modifying and reading the internal xattrs as applicable.
ok... so we still need a patch for removexattr() to handle all these. Ok. keep it open then.
CHANGE: http://review.gluster.com/2836 (fops/removexattr: prevent users from removing glusterfs xattrs) merged in master by Vijay Bellur (vijay)
Now removing internal xattrs of glusterfs is not allowed via mount point. setfattr -x trusted.glusterfs.dht glusterfs-3.0.0pre2/ setfattr: glusterfs-3.0.0pre2/: Operation not permitted