hat may not be ok for the ovl_rename2 case.
What we want is for inode permissions to be checked, but only the bit in xattr_permission() checking for trusted.* to accept ns_capable.
We could special-case that in xattr_permission(), but that's not particularly nice.
hat may not be ok for the ovl_rename2 case.
What we want is for inode permissions to be checked, but only the
bit in xattr_permission() checking for trusted.* to accept ns_capable.
We could special-case that in xattr_permission(), but that's not
particularly nice.