Comment 10 for bug 1531747

Revision history for this message
Serge Hallyn (serge-hallyn) wrote :

hat may not be ok for the ovl_rename2 case.

What we want is for inode permissions to be checked, but only the
bit in xattr_permission() checking for trusted.* to accept ns_capable.

We could special-case that in xattr_permission(), but that's not
particularly nice.