Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <cc4317d9cb8f10aa0b3750bdb6db8b4e77ff26f8.camel@kernel.org>
Subject: Re: A pass-through support for NFSv4 style ACL
From:   Jeff Layton <jlayton@kernel.org>
To:     Ondrej Valousek <ondrej.valousek.xm@renesas.com>,
        Christian Brauner <brauner@kernel.org>
Cc:     "trondmy@hammerspace.com" <trondmy@hammerspace.com>,
        "linux-fsdevel@vger.kernel.org" <linux-fsdevel@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Date:   Tue, 16 May 2023 17:22:30 -0400
In-Reply-To: <TYXPR01MB18549D3A5B0BE777D7F6B284D9799@TYXPR01MB1854.jpnprd01.prod.outlook.com>
References: <20230516124655.82283-1-jlayton@kernel.org>
         <20230516-notorisch-geblickt-6b591fbd77c1@brauner>
         <TYXPR01MB18549D3A5B0BE777D7F6B284D9799@TYXPR01MB1854.jpnprd01.prod.outlook.com>
Content-Type: text/plain; charset="ISO-8859-15"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.48.1 (3.48.1-1.fc38) 
MIME-Version: 1.0
Precedence: bulk

On Tue, 2023-05-16 at 20:50 +0000, Ondrej Valousek wrote:
>=20
> Hi Christian,
>=20
> Would it be possible to patch kernel the way it accepts native (i.e no
> conversion to Posix ACL) NFSv4 style ACLs for filesystems that can
> support them?
> I.E. OpenZFS, NTFS, could be also interesting for Microsofts WSL2=A0 or
> Samba right?
>=20
> I mean, I am not trying to push richacl again knowing they have been
> rejected, but just NFS4 style Acls as they are so similar to Windows
> ACLs.
>=20

Erm, except you kind of are if you want to do this. I don't see how this
idea works unless you resurrect RichACLs or something like them.

> The idea here would be that we could
> - mount NTFS/ZFS filesystem and inspect ACLs using existing tools
> (nfs4_getacl)
> - share with NFSv4 in a pass through mode
> - in Windows WSL2 we could inspect local filesystem ACLs using the
> same tools
>=20
> Does it make any sense or it would require lot of changes to VFS
> subsystem or its a nonsense altogether?
>=20

Eventually you have to actually enforce the ACL. Do NTFS/ZFS already
have code to do this? If not then someone would need to write it.

Also windows and nfs acls do have some differences, so you'll need a
translation layer too.
--=20
Jeff Layton <jlayton@kernel.org>