Build fails due to setting xattrs that affect SELinux, "permission denied"

[decathorpe]

I discovered this when running tests for syncthing v1.22, which fail on a system with SELinux enabled with this error message:

--- FAIL: TestXattr (0.00s)
    basicfs_test.go:597: set xattrs /tmp/TestXattr2645321982/001/test: Removexattr "security.selinux": permission denied
FAIL
FAIL	github.com/syncthing/syncthing/lib/fs	23.380s
FAIL

I assume that removing the security.selinux xattr from a file is not allowed unless the user has acquired superuser privileges first, so syncthing should probably leave attributes that are related to SELinux alone (as far as I can see, that's only the security.selinux attribute).

---

syncthing version: v1.22.0
operating system: tested on Fedora Linux 36 ,37, and Rawhide (development branch)
architecture: x86_64

[calmh]

Yes, lots of attributes will require elevated permissions, as noted in the docs. What isn't noted in the docs yet is that you can filter out attributes you don't want to sync;

<folder id="...">
  ...
  <syncXattrs>true</syncXattrs>
  <xattrFilter>
    <entry match="security.*" permit="false"></entry>
    <entry match="*" permit="true"></entry>
  </xattrFilter>
</folder>

(the xattrfilter being a somewhat complicated config value means it's not currently supported in the config editor...)

[decathorpe]

So .. is the test failure harmless because this will not occur in real-world usage, or does the failure indicate that the feature is not ready for systems where SELinux is enabled?

[calmh]

The test failure is because the test doesn't expect there to be attributes on the newly created test file that it can't touch, because I didn't expect that when I wrote the test. In real world usage this will pop up when the user checks sync xattrs and isn't running as a privileged user and isn't filtering xattrs. I think that's expected. However it would be nice if it were possible to build on an selinux-enabled system as well...