Hi, ## Summary: It seems that on FreeBSD 14.0-ALPHA3 for non-root users in Linux chroots, getxattr returns EPERM which causes some coreutils commands to fail (e.g. cp -a), whereas on FreeBSD 13.1 getxattr simply returned EOPNOTSUPP which lets the tools skip that step and continue successfully. It might be the same issue as https://lists.freebsd.org/archives/freebsd-current/2023-August/004433.html "Possible issue with linux xattr support?" ## Example impact: "apt update" failing in a fresh debootstrap due to "cp -a" failure in the apt-key script, which runs as another user "_apt". This works OK on FreeBSD 13.1. (See here https://forums.freebsd.org/threads/debian-12-bookworm-jail-encounters-gpg-error-in-freebsd-14-0.90093/#post-620794 for more details ) ## Steps to reproduce: ### On fresh install FreeBSD system, where /root homedir is on UFS partition pkg install sysutils/debootstrap kldload linux64 fdescfs linprocfs linsysfs tmpfs service linux onestart cd /root mkdir debian_build cd debian_build mkdir dev dev/fd dev/shm proc sys tmp mount -t linprocfs none `pwd`/proc mount -t devfs none `pwd`/dev mount -t fdescfs none `pwd`/dev/fd mount -t tmpfs none `pwd`/dev/shm mount -t linsysfs none `pwd`/sys mount -t tmpfs none `pwd`/tmp chmod 1777 dev/shm tmp debootstrap bullseye . http://deb.debian.org/debian chroot . /bin/bash ### Inside the chroot adduser --disabled-password --gecos "" someguy su someguy cd /home/someguy ### Comparing cp -a / cp --preserve=mode on both FreeBSD 13 and 14 someguy@freebsd14:~$ uname -a FreeBSD freebsd14 14.0-ALPHA3 FreeBSD 14.0-ALPHA3 amd64 1400097 #0 stable/14-n265022-2af9390e54ed: Fri Aug 25 05:45:56 UTC 2023 root@releng1.nyi.freebsd.org:/usr/obj/usr/src/amd64.amd64/sys/GENERIC amd64 someguy@freebsd13:~$ strace cp --preserve=mode hello hello2 fgetxattr(3, "system.posix_acl_access", 0x7fffffffdcc0, 132) = -1 EOPNOTSUPP (Operation not supported) fsetxattr(4, "system.posix_acl_access", "\2\0\0\0\1\0\6\0\377\377\377\377\4\0\4\0\377\377\377\377 \0\4\0\377\377\377\377", 28, 0) = -1 EOPNOTSUPP (Operation not supported) +++ exited with 0 +++ someguy@freebsd14:~$ strace cp --preserve=mode hello hello2 fgetxattr(3, "system.posix_acl_access", 0x7fffffffbd30, 132) = -1 EPERM (Operation not permitted) +++ exited with 1 +++ ### ls -l fails on FreeBSD 14 someguy@freebsd14:~$ ls -l ls: hello: Operation not permitted ls: hello2: Operation not permitted total 0K -rw-r--r-- 1 someguy someguy 0 Sep 1 20:11 hello -rw-r--r-- 1 someguy someguy 0 Sep 1 21:14 hello2 someguy@freebsd14:~$ strace ls -l 2>&1 | grep getxattr getxattr("hello", "system.posix_acl_access", NULL, 0) = -1 EPERM (Operation not permitted) getxattr("hello2", "system.posix_acl_access", NULL, 0) = -1 EPERM (Operation not permitted) ### apt update apt-key failure: root@freebsd14:/# ps auxfww root 949 0.0 0.1 13404 2964 ? Ss 15:39 0:00 login [pam] root 950 0.0 0.1 13368 3152 ? S 15:39 0:01 \_ -sh root 25160 0.0 0.2 6036 4400 ? S 18:11 0:03 \_ /bin/bash root 26053 0.0 0.5 14720 11140 ? T 18:25 0:00 \_ apt -oAPT::Status-Fd=1 -oDebug::Acquire::gpgv=1 update _apt 26056 0.0 0.7 20448 14932 ? T 18:25 0:00 | \_ /usr/lib/apt/methods/http _apt 26058 0.0 0.4 13884 9832 ? T 18:25 0:00 | \_ /usr/lib/apt/methods/gpgv _apt 26059 0.0 0.4 14140 9944 ? T 18:25 0:00 | \_ /usr/lib/apt/methods/gpgv _apt 26060 0.0 0.0 2464 1652 ? T 18:25 0:00 | \_ /bin/sh /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /tmp/apt.sig.OO1MDD /tmp/apt.data.FtsGdD _apt 26061 0.0 0.0 2376 1552 ? T 18:25 0:00 | \_ sleep 3600 root@freebsd14:~# su _apt -s /bin/dash $ id uid=100(_apt) gid=65534(nogroup) groups=65534(nogroup) _apt@freebsd14:/$ /bin/sh -x /usr/bin/apt-key --quiet --readonly verify --status-fd 1 /tmp/apt.sig.OO1MDD /tmp/apt.data.FtsGdD # ... + ls -la /tmp/apt-key-gpghome.ptBlRcbxDY ls: /tmp/apt-key-gpghome.ptBlRcbxDY: Operation not permitted ls: /tmp/apt-key-gpghome.ptBlRcbxDY/.: Operation not permitted ls: /tmp/apt-key-gpghome.ptBlRcbxDY/..: Operation not permitted ls: /tmp/apt-key-gpghome.ptBlRcbxDY/pubring.gpg: Operation not permitted total 56K drwx------ 2 _apt root 64 Sep 1 19:41 . drwxrwxrwt 3 root root 256 Sep 1 19:41 .. -rw-r--r-- 1 _apt root 56156 Sep 1 19:41 pubring.gpg + cp -a /tmp/apt-key-gpghome.ptBlRcbxDY/pubring.gpg /tmp/apt-key-gpghome.ptBlRcbxDY/pubring.orig.gpg cp: ‘/tmp/apt-key-gpghome.ptBlRcbxDY/pubring.gpg’: Operation not permitted
This has already been fixed by https://cgit.freebsd.org/src/commit/?id=1bfc4574f78653e4b64ac9dd31518c96a17fe52b Will be merged to stable/14 in a week's time
Confirmed working without issue on latest FreeBSD 15.0-CURRENT build: root@freebsd15:~ # uname -a FreeBSD freebsd15 15.0-CURRENT FreeBSD 15.0-CURRENT amd64 1500000 #0 main-n265205-03a7c36ddbc0: Thu Sep 7 03:10:34 UTC 2023 root@releng3.nyi.freebsd.org:/usr/obj/usr/src/amd64.amd64/sys/GENERIC amd64 root@freebsd15:~ # debootstrap bullseye debian_build http://deb.debian.org/debian root@freebsd15:~ # chroot debian_build /bin/bash root@freebsd15:/# apt update Get:1 http://deb.debian.org/debian bullseye InRelease [116 kB] Get:2 http://deb.debian.org/debian bullseye/main amd64 Packages [8183 kB] Get:3 http://deb.debian.org/debian bullseye/main Translation-en [6240 kB] Fetched 14.5 MB in 5s (2821 kB/s) Reading package lists... Done Building dependency tree... Done All packages are up to date. root@freebsd15:/# su someguy someguy@freebsd15:~$ strace cp --preserve=mode hello hello2 2>&1 | grep xattr fgetxattr(3, "system.posix_acl_access", 0x7fffffffbd30, 132) = -1 ENODATA (No data available) fsetxattr(4, "system.posix_acl_access", "\2\0\0\0\1\0\6\0\377\377\377\377\4\0\4\0\377\377\377\377 \0\4\0\377\377\377\377", 28, 0) = -1 EOPNOTSUPP (Operation not supported) +++ exited with 0 +++
A commit in branch stable/14 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=a9b8a0ced46efe72ec118a749d191b29ce47712b commit a9b8a0ced46efe72ec118a749d191b29ce47712b Author: Dmitry Chagin <dchagin@FreeBSD.org> AuthorDate: 2023-09-01 08:10:12 +0000 Commit: Dmitry Chagin <dchagin@FreeBSD.org> CommitDate: 2023-09-11 11:58:50 +0000 linux(4): Return ENODATA from getxattr syscalls instead of EPERM On Linux ENODATA mean the named attribute does not exist, or the process has no access to this attribute. Reported by: zirias PR: 273517 Tested by: zirias MFC after: 1 week (cherry picked from commit 4d59b790553ef75b9a4b6a673eab3354f3d012b3) sys/compat/linux/linux_xattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
A commit in branch releng/14.0 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=01d9f0eebf8dceddc465fecac919c1e9d7a586a2 commit 01d9f0eebf8dceddc465fecac919c1e9d7a586a2 Author: Dmitry Chagin <dchagin@FreeBSD.org> AuthorDate: 2023-09-01 08:10:12 +0000 Commit: Dmitry Chagin <dchagin@FreeBSD.org> CommitDate: 2023-09-12 16:42:31 +0000 linux(4): Return ENODATA from getxattr syscalls instead of EPERM On Linux ENODATA mean the named attribute does not exist, or the process has no access to this attribute. Approved by: re (gjb) Reported by: zirias PR: 273517 Tested by: zirias MFC after: 1 week (cherry picked from commit 4d59b790553ef75b9a4b6a673eab3354f3d012b3) (cherry picked from commit a9b8a0ced46efe72ec118a749d191b29ce47712b) sys/compat/linux/linux_xattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)