Have lgetxattr return ENODATA.

It is a workaround to lgetxattr/lsetxattr working with security.capacity when running docker in gvisor.

PiperOrigin-RevId: 563194162

pkg/sentry/fsimpl/gofer/gofer.go

@@ -1399,7 +1399,7 @@ func (d *dentry) checkPermissions(creds *auth.Credentials, ats vfs.AccessTypes)
 }
 
 func (d *dentry) checkXattrPermissions(creds *auth.Credentials, name string, ats vfs.AccessTypes) error {
-	// Deny access to the "security" and "system" namespaces since applications
+	// Deny access to the "system" namespaces since applications
 	// may expect these to affect kernel behavior in unimplemented ways
 	// (b/148380782). Allow all other extended attributes to be passed through
 	// to the remote filesystem. This is inconsistent with Linux's 9p client,
@@ -1407,7 +1407,7 @@ func (d *dentry) checkXattrPermissions(creds *auth.Credentials, name string, ats
 	//
 	// NOTE(b/202533394): Also disallow "trusted" namespace for now. This is
 	// consistent with the VFS1 gofer client.
-	if strings.HasPrefix(name, linux.XATTR_SECURITY_PREFIX) || strings.HasPrefix(name, linux.XATTR_SYSTEM_PREFIX) || strings.HasPrefix(name, linux.XATTR_TRUSTED_PREFIX) {
+	if strings.HasPrefix(name, linux.XATTR_SYSTEM_PREFIX) || strings.HasPrefix(name, linux.XATTR_TRUSTED_PREFIX) {
 		return linuxerr.EOPNOTSUPP
 	}
 	mode := linux.FileMode(d.mode.Load())

pkg/sentry/fsimpl/tmpfs/tmpfs.go

@@ -195,6 +195,8 @@ func (fstype FilesystemType) GetFilesystem(ctx context.Context, vfsObj *vfs.Virt
 	allowXattrPrefix := map[string]struct{}{
 		linux.XATTR_TRUSTED_PREFIX: struct{}{},
 		linux.XATTR_USER_PREFIX:    struct{}{},
+		// The "security" namespace is allowed, but it always returns an error.
+		linux.XATTR_SECURITY_PREFIX: struct{}{},
 	}
 
 	tmpfsOpts, tmpfsOptsOk := opts.InternalData.(FilesystemOpts)

pkg/sentry/vfs/permissions.go

@@ -323,6 +323,11 @@ func CheckXattrPermissions(creds *auth.Credentials, ats AccessTypes, mode linux.
 		if filetype == linux.ModeDirectory && mode&linux.ModeSticky != 0 && ats.MayWrite() && !CanActAsOwner(creds, kuid) {
 			return linuxerr.EPERM
 		}
+	case strings.HasPrefix(name, linux.XATTR_SECURITY_PREFIX):
+		if ats.MayRead() {
+			return linuxerr.ENODATA
+		}
+		return linuxerr.EOPNOTSUPP
 	}
 	return nil
 }

test/syscalls/linux/xattr.cc

@@ -105,6 +105,21 @@ TEST_F(XattrTest, XattrInvalidPrefix) {
               SyscallFailsWithErrno(EOPNOTSUPP));
 }
 
+TEST_F(XattrTest, SecurityCapacityXattr) {
+  SKIP_IF(!IsRunningOnGvisor());
+  const char* path = test_file_name_.c_str();
+  const char name[] = "security.capacity";
+  const std::string val = "";
+  EXPECT_THAT(lsetxattr(path, name, &val, val.size(), 0),
+              SyscallFailsWithErrno(EOPNOTSUPP));
+
+  int buf = 0;
+  EXPECT_THAT(lgetxattr(path, name, &buf, /*size=*/128),
+              SyscallFailsWithErrno(ENODATA));
+
+  EXPECT_THAT(lremovexattr(path, name), SyscallFailsWithErrno(EOPNOTSUPP));
+}
+
 // Do not allow save/restore cycles after making the test file read-only, as
 // the restore will fail to open it with r/w permissions.
 TEST_F(XattrTest, XattrReadOnly) {