A well-formed NFSv4 ACL will always contain OWNER@/GROUP@/EVERYONE@
ACEs, but there is no requirement for inheritable entries for those
entities. POSIX ACLs must always have owner/group/other entries, even for a
default ACL.
nfsd builds the default ACL from inheritable ACEs, but the current code
just leaves any unspecified ACEs zeroed out. The result is that adding a
default user or group ACE to an inode can leave it with unwanted deny
entries.
For instance, a newly created directory with no acl will look something
like this:
# NFSv4 translation by server
A::OWNER@:rwaDxtTcCy
A::GROUP@:rxtcy
A::EVERYONE@:rxtcy
# POSIX ACL of underlying file
user::rwx
group::r-x
other::r-x
...if I then add new v4 ACE:
nfs4_setfacl -a A:fd:1000:rwx /mnt/local/test
...I end up with a result like this today:
user::rwx
user:1000:rwx
group::r-x
mask::rwx
other::r-x
default:user::---
default:user:1000:rwx
default:group::---
default:mask::rwx
default:other::---
A::OWNER@:rwaDxtTcCy
A::1000:rwaDxtcy
A::GROUP@:rxtcy
A::EVERYONE@:rxtcy
D:fdi:OWNER@:rwaDx
A:fdi:OWNER@:tTcCy
A:fdi:1000:rwaDxtcy
A:fdi:GROUP@:tcy
A:fdi:EVERYONE@:tcy
...which is not at all expected. Adding a single inheritable allow ACE
should not result in everyone else losing access.
The setfacl command solves a silimar issue by copying owner/group/other
entries from the effective ACL when none of them are set:
"If a Default ACL entry is created, and the Default ACL contains no
owner, owning group, or others entry, a copy of the ACL owner,
owning group, or others entry is added to the Default ACL.
Having nfsd do the same provides a more sane result (with no deny ACEs
in the resulting set):
user::rwx
user:1000:rwx
group::r-x
mask::rwx
other::r-x
default:user::rwx
default:user:1000:rwx
default:group::r-x
default:mask::rwx
default:other::r-x
A::OWNER@:rwaDxtTcCy
A::1000:rwaDxtcy
A::GROUP@:rxtcy
A::EVERYONE@:rxtcy
A:fdi:OWNER@:rwaDxtTcCy
A:fdi:1000:rwaDxtcy
A:fdi:GROUP@:rxtcy
A:fdi:EVERYONE@:rxtcy
Reported-by: Ondrej Valousek <[email protected]>
Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2136452
Suggested-by: Andreas Gruenbacher <[email protected]>
Signed-off-by: Jeff Layton <[email protected]>
---
Changes in v2:
- always set missing ACEs whenever default ACL has any ACEs that are
explicitly set. This better conforms to how setfacl works.
- drop now-unneeded "empty" boolean
- Link to v1: https://lore.kernel.org/r/[email protected]
---
fs/nfsd/nfs4acl.c | 32 ++++++++++++++++++++++++++++----
1 file changed, 28 insertions(+), 4 deletions(-)
diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c
index 518203821790..b931d4383517 100644
--- a/fs/nfsd/nfs4acl.c
+++ b/fs/nfsd/nfs4acl.c
@@ -441,7 +441,7 @@ struct posix_ace_state_array {
* calculated so far: */
struct posix_acl_state {
- int empty;
+ unsigned char valid;
struct posix_ace_state owner;
struct posix_ace_state group;
struct posix_ace_state other;
@@ -457,7 +457,6 @@ init_state(struct posix_acl_state *state, int cnt)
int alloc;
memset(state, 0, sizeof(struct posix_acl_state));
- state->empty = 1;
/*
* In the worst case, each individual acl could be for a distinct
* named user or group, but we don't know which, so we allocate
@@ -500,7 +499,7 @@ posix_state_to_acl(struct posix_acl_state *state, unsigned int flags)
* and effective cases: when there are no inheritable ACEs,
* calls ->set_acl with a NULL ACL structure.
*/
- if (state->empty && (flags & NFS4_ACL_TYPE_DEFAULT))
+ if (!state->valid && (flags & NFS4_ACL_TYPE_DEFAULT))
return NULL;
/*
@@ -622,9 +621,10 @@ static void process_one_v4_ace(struct posix_acl_state *state,
struct nfs4_ace *ace)
{
u32 mask = ace->access_mask;
+ short type = ace2type(ace);
int i;
- state->empty = 0;
+ state->valid |= type;
switch (ace2type(ace)) {
case ACL_USER_OBJ:
@@ -726,6 +726,30 @@ static int nfs4_acl_nfsv4_to_posix(struct nfs4_acl *acl,
if (!(ace->flag & NFS4_ACE_INHERIT_ONLY_ACE))
process_one_v4_ace(&effective_acl_state, ace);
}
+
+ /*
+ * At this point, the default ACL may have zeroed-out entries for owner,
+ * group and other. That usually results in a non-sensical resulting ACL
+ * that denies all access except to any ACE that was explicitly added.
+ *
+ * The setfacl command solves a similar problem with this logic:
+ *
+ * "If a Default ACL entry is created, and the Default ACL contains
+ * no owner, owning group, or others entry, a copy of the ACL
+ * owner, owning group, or others entry is added to the Default ACL."
+ *
+ * Copy any missing ACEs from the effective set, if any ACEs were
+ * explicitly set.
+ */
+ if (default_acl_state.valid) {
+ if (!(default_acl_state.valid & ACL_USER_OBJ))
+ default_acl_state.owner = effective_acl_state.owner;
+ if (!(default_acl_state.valid & ACL_GROUP_OBJ))
+ default_acl_state.group = effective_acl_state.group;
+ if (!(default_acl_state.valid & ACL_OTHER))
+ default_acl_state.other = effective_acl_state.other;
+ }
+
*pacl = posix_state_to_acl(&effective_acl_state, flags);
if (IS_ERR(*pacl)) {
ret = PTR_ERR(*pacl);
---
base-commit: 7bfb36a2ee1d329a501ba4781db4145dc951c798
change-id: 20230719-nfsd-acl-5ab61537e4e6
Best regards,
--
Jeff Layton <[email protected]>
On Mon, Jul 24, 2023 at 08:13:05AM -0400, Jeff Layton wrote:
> A well-formed NFSv4 ACL will always contain OWNER@/GROUP@/EVERYONE@
> ACEs, but there is no requirement for inheritable entries for those
> entities. POSIX ACLs must always have owner/group/other entries, even for a
> default ACL.
>
> nfsd builds the default ACL from inheritable ACEs, but the current code
> just leaves any unspecified ACEs zeroed out. The result is that adding a
> default user or group ACE to an inode can leave it with unwanted deny
> entries.
>
> For instance, a newly created directory with no acl will look something
> like this:
>
> # NFSv4 translation by server
> A::OWNER@:rwaDxtTcCy
> A::GROUP@:rxtcy
> A::EVERYONE@:rxtcy
>
> # POSIX ACL of underlying file
> user::rwx
> group::r-x
> other::r-x
>
> ...if I then add new v4 ACE:
>
> nfs4_setfacl -a A:fd:1000:rwx /mnt/local/test
>
> ...I end up with a result like this today:
>
> user::rwx
> user:1000:rwx
> group::r-x
> mask::rwx
> other::r-x
> default:user::---
> default:user:1000:rwx
> default:group::---
> default:mask::rwx
> default:other::---
>
> A::OWNER@:rwaDxtTcCy
> A::1000:rwaDxtcy
> A::GROUP@:rxtcy
> A::EVERYONE@:rxtcy
> D:fdi:OWNER@:rwaDx
> A:fdi:OWNER@:tTcCy
> A:fdi:1000:rwaDxtcy
> A:fdi:GROUP@:tcy
> A:fdi:EVERYONE@:tcy
>
> ...which is not at all expected. Adding a single inheritable allow ACE
> should not result in everyone else losing access.
>
> The setfacl command solves a silimar issue by copying owner/group/other
> entries from the effective ACL when none of them are set:
>
> "If a Default ACL entry is created, and the Default ACL contains no
> owner, owning group, or others entry, a copy of the ACL owner,
> owning group, or others entry is added to the Default ACL.
>
> Having nfsd do the same provides a more sane result (with no deny ACEs
> in the resulting set):
>
> user::rwx
> user:1000:rwx
> group::r-x
> mask::rwx
> other::r-x
> default:user::rwx
> default:user:1000:rwx
> default:group::r-x
> default:mask::rwx
> default:other::r-x
>
> A::OWNER@:rwaDxtTcCy
> A::1000:rwaDxtcy
> A::GROUP@:rxtcy
> A::EVERYONE@:rxtcy
> A:fdi:OWNER@:rwaDxtTcCy
> A:fdi:1000:rwaDxtcy
> A:fdi:GROUP@:rxtcy
> A:fdi:EVERYONE@:rxtcy
>
> Reported-by: Ondrej Valousek <[email protected]>
> Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2136452
> Suggested-by: Andreas Gruenbacher <[email protected]>
> Signed-off-by: Jeff Layton <[email protected]>
> ---
> Changes in v2:
> - always set missing ACEs whenever default ACL has any ACEs that are
> explicitly set. This better conforms to how setfacl works.
> - drop now-unneeded "empty" boolean
> - Link to v1: https://lore.kernel.org/r/[email protected]
> ---
> fs/nfsd/nfs4acl.c | 32 ++++++++++++++++++++++++++++----
> 1 file changed, 28 insertions(+), 4 deletions(-)
>
> diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c
> index 518203821790..b931d4383517 100644
> --- a/fs/nfsd/nfs4acl.c
> +++ b/fs/nfsd/nfs4acl.c
> @@ -441,7 +441,7 @@ struct posix_ace_state_array {
> * calculated so far: */
>
> struct posix_acl_state {
> - int empty;
> + unsigned char valid;
> struct posix_ace_state owner;
> struct posix_ace_state group;
> struct posix_ace_state other;
> @@ -457,7 +457,6 @@ init_state(struct posix_acl_state *state, int cnt)
> int alloc;
>
> memset(state, 0, sizeof(struct posix_acl_state));
> - state->empty = 1;
> /*
> * In the worst case, each individual acl could be for a distinct
> * named user or group, but we don't know which, so we allocate
> @@ -500,7 +499,7 @@ posix_state_to_acl(struct posix_acl_state *state, unsigned int flags)
> * and effective cases: when there are no inheritable ACEs,
> * calls ->set_acl with a NULL ACL structure.
> */
> - if (state->empty && (flags & NFS4_ACL_TYPE_DEFAULT))
> + if (!state->valid && (flags & NFS4_ACL_TYPE_DEFAULT))
> return NULL;
>
> /*
> @@ -622,9 +621,10 @@ static void process_one_v4_ace(struct posix_acl_state *state,
> struct nfs4_ace *ace)
> {
> u32 mask = ace->access_mask;
> + short type = ace2type(ace);
> int i;
>
> - state->empty = 0;
> + state->valid |= type;
>
> switch (ace2type(ace)) {
Mechanical issue: the patch adds @type, but uses it just once.
The switch here also wants the value of ace2type(ace).
> case ACL_USER_OBJ:
> @@ -726,6 +726,30 @@ static int nfs4_acl_nfsv4_to_posix(struct nfs4_acl *acl,
> if (!(ace->flag & NFS4_ACE_INHERIT_ONLY_ACE))
> process_one_v4_ace(&effective_acl_state, ace);
> }
> +
> + /*
> + * At this point, the default ACL may have zeroed-out entries for owner,
> + * group and other. That usually results in a non-sensical resulting ACL
> + * that denies all access except to any ACE that was explicitly added.
> + *
> + * The setfacl command solves a similar problem with this logic:
> + *
> + * "If a Default ACL entry is created, and the Default ACL contains
> + * no owner, owning group, or others entry, a copy of the ACL
> + * owner, owning group, or others entry is added to the Default ACL."
> + *
> + * Copy any missing ACEs from the effective set, if any ACEs were
> + * explicitly set.
> + */
> + if (default_acl_state.valid) {
> + if (!(default_acl_state.valid & ACL_USER_OBJ))
> + default_acl_state.owner = effective_acl_state.owner;
> + if (!(default_acl_state.valid & ACL_GROUP_OBJ))
> + default_acl_state.group = effective_acl_state.group;
> + if (!(default_acl_state.valid & ACL_OTHER))
> + default_acl_state.other = effective_acl_state.other;
> + }
> +
> *pacl = posix_state_to_acl(&effective_acl_state, flags);
> if (IS_ERR(*pacl)) {
> ret = PTR_ERR(*pacl);
>
> ---
> base-commit: 7bfb36a2ee1d329a501ba4781db4145dc951c798
> change-id: 20230719-nfsd-acl-5ab61537e4e6
>
> Best regards,
> --
> Jeff Layton <[email protected]>
>
--
Chuck Lever
On Mon, 2023-07-24 at 09:44 -0400, Chuck Lever wrote:
> On Mon, Jul 24, 2023 at 08:13:05AM -0400, Jeff Layton wrote:
> > A well-formed NFSv4 ACL will always contain OWNER@/GROUP@/EVERYONE@
> > ACEs, but there is no requirement for inheritable entries for those
> > entities. POSIX ACLs must always have owner/group/other entries, even for a
> > default ACL.
> >
> > nfsd builds the default ACL from inheritable ACEs, but the current code
> > just leaves any unspecified ACEs zeroed out. The result is that adding a
> > default user or group ACE to an inode can leave it with unwanted deny
> > entries.
> >
> > For instance, a newly created directory with no acl will look something
> > like this:
> >
> > # NFSv4 translation by server
> > A::OWNER@:rwaDxtTcCy
> > A::GROUP@:rxtcy
> > A::EVERYONE@:rxtcy
> >
> > # POSIX ACL of underlying file
> > user::rwx
> > group::r-x
> > other::r-x
> >
> > ...if I then add new v4 ACE:
> >
> > nfs4_setfacl -a A:fd:1000:rwx /mnt/local/test
> >
> > ...I end up with a result like this today:
> >
> > user::rwx
> > user:1000:rwx
> > group::r-x
> > mask::rwx
> > other::r-x
> > default:user::---
> > default:user:1000:rwx
> > default:group::---
> > default:mask::rwx
> > default:other::---
> >
> > A::OWNER@:rwaDxtTcCy
> > A::1000:rwaDxtcy
> > A::GROUP@:rxtcy
> > A::EVERYONE@:rxtcy
> > D:fdi:OWNER@:rwaDx
> > A:fdi:OWNER@:tTcCy
> > A:fdi:1000:rwaDxtcy
> > A:fdi:GROUP@:tcy
> > A:fdi:EVERYONE@:tcy
> >
> > ...which is not at all expected. Adding a single inheritable allow ACE
> > should not result in everyone else losing access.
> >
> > The setfacl command solves a silimar issue by copying owner/group/other
> > entries from the effective ACL when none of them are set:
> >
> > "If a Default ACL entry is created, and the Default ACL contains no
> > owner, owning group, or others entry, a copy of the ACL owner,
> > owning group, or others entry is added to the Default ACL.
> >
> > Having nfsd do the same provides a more sane result (with no deny ACEs
> > in the resulting set):
> >
> > user::rwx
> > user:1000:rwx
> > group::r-x
> > mask::rwx
> > other::r-x
> > default:user::rwx
> > default:user:1000:rwx
> > default:group::r-x
> > default:mask::rwx
> > default:other::r-x
> >
> > A::OWNER@:rwaDxtTcCy
> > A::1000:rwaDxtcy
> > A::GROUP@:rxtcy
> > A::EVERYONE@:rxtcy
> > A:fdi:OWNER@:rwaDxtTcCy
> > A:fdi:1000:rwaDxtcy
> > A:fdi:GROUP@:rxtcy
> > A:fdi:EVERYONE@:rxtcy
> >
> > Reported-by: Ondrej Valousek <[email protected]>
> > Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2136452
> > Suggested-by: Andreas Gruenbacher <[email protected]>
> > Signed-off-by: Jeff Layton <[email protected]>
> > ---
> > Changes in v2:
> > - always set missing ACEs whenever default ACL has any ACEs that are
> > explicitly set. This better conforms to how setfacl works.
> > - drop now-unneeded "empty" boolean
> > - Link to v1: https://lore.kernel.org/r/[email protected]
> > ---
> > fs/nfsd/nfs4acl.c | 32 ++++++++++++++++++++++++++++----
> > 1 file changed, 28 insertions(+), 4 deletions(-)
> >
> > diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c
> > index 518203821790..b931d4383517 100644
> > --- a/fs/nfsd/nfs4acl.c
> > +++ b/fs/nfsd/nfs4acl.c
> > @@ -441,7 +441,7 @@ struct posix_ace_state_array {
> > * calculated so far: */
> >
> > struct posix_acl_state {
> > - int empty;
> > + unsigned char valid;
> > struct posix_ace_state owner;
> > struct posix_ace_state group;
> > struct posix_ace_state other;
> > @@ -457,7 +457,6 @@ init_state(struct posix_acl_state *state, int cnt)
> > int alloc;
> >
> > memset(state, 0, sizeof(struct posix_acl_state));
> > - state->empty = 1;
> > /*
> > * In the worst case, each individual acl could be for a distinct
> > * named user or group, but we don't know which, so we allocate
> > @@ -500,7 +499,7 @@ posix_state_to_acl(struct posix_acl_state *state, unsigned int flags)
> > * and effective cases: when there are no inheritable ACEs,
> > * calls ->set_acl with a NULL ACL structure.
> > */
> > - if (state->empty && (flags & NFS4_ACL_TYPE_DEFAULT))
> > + if (!state->valid && (flags & NFS4_ACL_TYPE_DEFAULT))
> > return NULL;
> >
> > /*
> > @@ -622,9 +621,10 @@ static void process_one_v4_ace(struct posix_acl_state *state,
> > struct nfs4_ace *ace)
> > {
> > u32 mask = ace->access_mask;
> > + short type = ace2type(ace);
> > int i;
> >
> > - state->empty = 0;
> > + state->valid |= type;
> >
> > switch (ace2type(ace)) {
>
> Mechanical issue: the patch adds @type, but uses it just once.
> The switch here also wants the value of ace2type(ace).
>
>
Doh! I had that fixed in one version of the patch, but had to rework the
branch and lost that delta. I can respin, or if you just want to fix
that in place, then that would be fine too.
> > case ACL_USER_OBJ:
> > @@ -726,6 +726,30 @@ static int nfs4_acl_nfsv4_to_posix(struct nfs4_acl *acl,
> > if (!(ace->flag & NFS4_ACE_INHERIT_ONLY_ACE))
> > process_one_v4_ace(&effective_acl_state, ace);
> > }
> > +
> > + /*
> > + * At this point, the default ACL may have zeroed-out entries for owner,
> > + * group and other. That usually results in a non-sensical resulting ACL
> > + * that denies all access except to any ACE that was explicitly added.
> > + *
> > + * The setfacl command solves a similar problem with this logic:
> > + *
> > + * "If a Default ACL entry is created, and the Default ACL contains
> > + * no owner, owning group, or others entry, a copy of the ACL
> > + * owner, owning group, or others entry is added to the Default ACL."
> > + *
> > + * Copy any missing ACEs from the effective set, if any ACEs were
> > + * explicitly set.
> > + */
> > + if (default_acl_state.valid) {
> > + if (!(default_acl_state.valid & ACL_USER_OBJ))
> > + default_acl_state.owner = effective_acl_state.owner;
> > + if (!(default_acl_state.valid & ACL_GROUP_OBJ))
> > + default_acl_state.group = effective_acl_state.group;
> > + if (!(default_acl_state.valid & ACL_OTHER))
> > + default_acl_state.other = effective_acl_state.other;
> > + }
> > +
> > *pacl = posix_state_to_acl(&effective_acl_state, flags);
> > if (IS_ERR(*pacl)) {
> > ret = PTR_ERR(*pacl);
> >
> > ---
> > base-commit: 7bfb36a2ee1d329a501ba4781db4145dc951c798
> > change-id: 20230719-nfsd-acl-5ab61537e4e6
> >
> > Best regards,
> > --
> > Jeff Layton <[email protected]>
> >
>
--
Jeff Layton <[email protected]>
On Mon, Jul 24, 2023 at 09:54:22AM -0400, Jeff Layton wrote:
> On Mon, 2023-07-24 at 09:44 -0400, Chuck Lever wrote:
> > On Mon, Jul 24, 2023 at 08:13:05AM -0400, Jeff Layton wrote:
> > > A well-formed NFSv4 ACL will always contain OWNER@/GROUP@/EVERYONE@
> > > ACEs, but there is no requirement for inheritable entries for those
> > > entities. POSIX ACLs must always have owner/group/other entries, even for a
> > > default ACL.
> > >
> > > nfsd builds the default ACL from inheritable ACEs, but the current code
> > > just leaves any unspecified ACEs zeroed out. The result is that adding a
> > > default user or group ACE to an inode can leave it with unwanted deny
> > > entries.
> > >
> > > For instance, a newly created directory with no acl will look something
> > > like this:
> > >
> > > # NFSv4 translation by server
> > > A::OWNER@:rwaDxtTcCy
> > > A::GROUP@:rxtcy
> > > A::EVERYONE@:rxtcy
> > >
> > > # POSIX ACL of underlying file
> > > user::rwx
> > > group::r-x
> > > other::r-x
> > >
> > > ...if I then add new v4 ACE:
> > >
> > > nfs4_setfacl -a A:fd:1000:rwx /mnt/local/test
> > >
> > > ...I end up with a result like this today:
> > >
> > > user::rwx
> > > user:1000:rwx
> > > group::r-x
> > > mask::rwx
> > > other::r-x
> > > default:user::---
> > > default:user:1000:rwx
> > > default:group::---
> > > default:mask::rwx
> > > default:other::---
> > >
> > > A::OWNER@:rwaDxtTcCy
> > > A::1000:rwaDxtcy
> > > A::GROUP@:rxtcy
> > > A::EVERYONE@:rxtcy
> > > D:fdi:OWNER@:rwaDx
> > > A:fdi:OWNER@:tTcCy
> > > A:fdi:1000:rwaDxtcy
> > > A:fdi:GROUP@:tcy
> > > A:fdi:EVERYONE@:tcy
> > >
> > > ...which is not at all expected. Adding a single inheritable allow ACE
> > > should not result in everyone else losing access.
> > >
> > > The setfacl command solves a silimar issue by copying owner/group/other
> > > entries from the effective ACL when none of them are set:
> > >
> > > "If a Default ACL entry is created, and the Default ACL contains no
> > > owner, owning group, or others entry, a copy of the ACL owner,
> > > owning group, or others entry is added to the Default ACL.
> > >
> > > Having nfsd do the same provides a more sane result (with no deny ACEs
> > > in the resulting set):
> > >
> > > user::rwx
> > > user:1000:rwx
> > > group::r-x
> > > mask::rwx
> > > other::r-x
> > > default:user::rwx
> > > default:user:1000:rwx
> > > default:group::r-x
> > > default:mask::rwx
> > > default:other::r-x
> > >
> > > A::OWNER@:rwaDxtTcCy
> > > A::1000:rwaDxtcy
> > > A::GROUP@:rxtcy
> > > A::EVERYONE@:rxtcy
> > > A:fdi:OWNER@:rwaDxtTcCy
> > > A:fdi:1000:rwaDxtcy
> > > A:fdi:GROUP@:rxtcy
> > > A:fdi:EVERYONE@:rxtcy
> > >
> > > Reported-by: Ondrej Valousek <[email protected]>
> > > Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2136452
> > > Suggested-by: Andreas Gruenbacher <[email protected]>
> > > Signed-off-by: Jeff Layton <[email protected]>
> > > ---
> > > Changes in v2:
> > > - always set missing ACEs whenever default ACL has any ACEs that are
> > > explicitly set. This better conforms to how setfacl works.
> > > - drop now-unneeded "empty" boolean
> > > - Link to v1: https://lore.kernel.org/r/[email protected]
> > > ---
> > > fs/nfsd/nfs4acl.c | 32 ++++++++++++++++++++++++++++----
> > > 1 file changed, 28 insertions(+), 4 deletions(-)
> > >
> > > diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c
> > > index 518203821790..b931d4383517 100644
> > > --- a/fs/nfsd/nfs4acl.c
> > > +++ b/fs/nfsd/nfs4acl.c
> > > @@ -441,7 +441,7 @@ struct posix_ace_state_array {
> > > * calculated so far: */
> > >
> > > struct posix_acl_state {
> > > - int empty;
> > > + unsigned char valid;
> > > struct posix_ace_state owner;
> > > struct posix_ace_state group;
> > > struct posix_ace_state other;
> > > @@ -457,7 +457,6 @@ init_state(struct posix_acl_state *state, int cnt)
> > > int alloc;
> > >
> > > memset(state, 0, sizeof(struct posix_acl_state));
> > > - state->empty = 1;
> > > /*
> > > * In the worst case, each individual acl could be for a distinct
> > > * named user or group, but we don't know which, so we allocate
> > > @@ -500,7 +499,7 @@ posix_state_to_acl(struct posix_acl_state *state, unsigned int flags)
> > > * and effective cases: when there are no inheritable ACEs,
> > > * calls ->set_acl with a NULL ACL structure.
> > > */
> > > - if (state->empty && (flags & NFS4_ACL_TYPE_DEFAULT))
> > > + if (!state->valid && (flags & NFS4_ACL_TYPE_DEFAULT))
> > > return NULL;
> > >
> > > /*
> > > @@ -622,9 +621,10 @@ static void process_one_v4_ace(struct posix_acl_state *state,
> > > struct nfs4_ace *ace)
> > > {
> > > u32 mask = ace->access_mask;
> > > + short type = ace2type(ace);
> > > int i;
> > >
> > > - state->empty = 0;
> > > + state->valid |= type;
> > >
> > > switch (ace2type(ace)) {
> >
> > Mechanical issue: the patch adds @type, but uses it just once.
> > The switch here also wants the value of ace2type(ace).
> >
> >
>
> Doh! I had that fixed in one version of the patch, but had to rework the
> branch and lost that delta. I can respin, or if you just want to fix
> that in place, then that would be fine too.
I've fixed it in my tree and applied it to nfsd-next. Let me know if
I've done something wrong.
> > > case ACL_USER_OBJ:
> > > @@ -726,6 +726,30 @@ static int nfs4_acl_nfsv4_to_posix(struct nfs4_acl *acl,
> > > if (!(ace->flag & NFS4_ACE_INHERIT_ONLY_ACE))
> > > process_one_v4_ace(&effective_acl_state, ace);
> > > }
> > > +
> > > + /*
> > > + * At this point, the default ACL may have zeroed-out entries for owner,
> > > + * group and other. That usually results in a non-sensical resulting ACL
> > > + * that denies all access except to any ACE that was explicitly added.
> > > + *
> > > + * The setfacl command solves a similar problem with this logic:
> > > + *
> > > + * "If a Default ACL entry is created, and the Default ACL contains
> > > + * no owner, owning group, or others entry, a copy of the ACL
> > > + * owner, owning group, or others entry is added to the Default ACL."
> > > + *
> > > + * Copy any missing ACEs from the effective set, if any ACEs were
> > > + * explicitly set.
> > > + */
> > > + if (default_acl_state.valid) {
> > > + if (!(default_acl_state.valid & ACL_USER_OBJ))
> > > + default_acl_state.owner = effective_acl_state.owner;
> > > + if (!(default_acl_state.valid & ACL_GROUP_OBJ))
> > > + default_acl_state.group = effective_acl_state.group;
> > > + if (!(default_acl_state.valid & ACL_OTHER))
> > > + default_acl_state.other = effective_acl_state.other;
> > > + }
> > > +
> > > *pacl = posix_state_to_acl(&effective_acl_state, flags);
> > > if (IS_ERR(*pacl)) {
> > > ret = PTR_ERR(*pacl);
> > >
> > > ---
> > > base-commit: 7bfb36a2ee1d329a501ba4781db4145dc951c798
> > > change-id: 20230719-nfsd-acl-5ab61537e4e6
> > >
> > > Best regards,
> > > --
> > > Jeff Layton <[email protected]>
> > >
> >
>
> --
> Jeff Layton <[email protected]>
--
Chuck Lever