Received: by 2002:a25:4158:0:0:0:0:0 with SMTP id o85csp7254530yba; Thu, 2 May 2019 06:58:17 -0700 (PDT) X-Google-Smtp-Source: APXvYqzrt6HFsTynzk6FPAs/HWJlZ+gkFNsBF3SKm7yVxuXZ3APH41s4d4VcVcLIeFD54HbdjKpp X-Received: by 2002:a63:131d:: with SMTP id i29mr4130509pgl.399.1556805497252; Thu, 02 May 2019 06:58:17 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1556805497; cv=none; d=google.com; s=arc-20160816; b=banGul7b2DdRI2dT8Q+m0Gi16gXCh+ArxIBo6seQJnOCSuHCJGPsSzQ6kwUiSZx50m pQp3YNmz+znDNB+jEI/ShuOqVqyOk25VOU9YnC/MZUbpDQX9F9U1QQvVALjOvhvZxe5u IySdhWh2JrRPAOHI+kzVKGelNuYnZKsVuiLwx9QLRcQ6nX3NJXnFTtDK9SbHE3oRyCAf cHI8Y51upFHB8cMnc1WRHyW2zMwgEgRDJc/5HlH3B5jaSolzSWzSmMtocgnvRWsNe1v/ fkm766oG+1ublqo6bhqFmNxK3kaaS/VNReaa0DhAgfNALGg/Z8CKqGBrPnOr+zhIJF5r H8Kw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:message-id:date:content-id:mime-version :references:in-reply-to:cc:to:subject:from; bh=GJWNCqB6vz4+gnB+SSLbb64zj7YVK57A27MohqCxpS4=; b=lJM+m+IdKFEI4zx+TnXPw3ItIl+obI+tdVODJBJg0bmV3bc1R8H5ltF/fnmlc3Zh+5 QGZuXiB7ZxWwKB7tSoyBNxuY7F6uw8Z77JRtHDd+KZaJUKcj73TSDrU9Ror+hGqZP5Nk YXB0qofauHSGzlkRgUbBWUI0sMK/DZl9rMQLBCxmzp4uAsUFNFHQEkCfaLVm5xdsBLc2 avfUbUY+QKi5frQSsxn8+onZ3YerU0DklPueLCRDuYIlTfG8o8K3G8vZd/gSYCAKYMhy RQfKmgcatTeofQuETt2VG6Uajd2koY4+3oeLUONWjtX5IAH3Au9iToEHKOvrFDxqihL/ LnEA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-nfs-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-nfs-owner@vger.kernel.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id x7si44435872plr.247.2019.05.02.06.57.53; Thu, 02 May 2019 06:58:17 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-nfs-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-nfs-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-nfs-owner@vger.kernel.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726385AbfEBN4q (ORCPT + 99 others); Thu, 2 May 2019 09:56:46 -0400 Received: from mfb02-md.ns.itscom.net ([175.177.155.110]:50377 "EHLO mfb02-md.ns.itscom.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726270AbfEBN4p (ORCPT ); Thu, 2 May 2019 09:56:45 -0400 Received: from mail03-md.ns.itscom.net (mail03-md.ns.itscom.net [175.177.155.113]) by mfb02-md.ns.itscom.net (Postfix) with ESMTP id D155F1748295 for ; Thu, 2 May 2019 22:47:10 +0900 (JST) Received: from cmsa01-mds.s.noc.itscom.net (cmsa01-md.ns.itscom.net [175.177.0.91]) by mail03-md-outgoing.ns.itscom.net (Postfix) with ESMTP id 4F3C4FF0530; Thu, 2 May 2019 22:47:09 +0900 (JST) Received: from jromail.nowhere ([219.110.243.48]) by cmsa-md with ESMTP id MC3JhjzYCz4K5MC3JhE3t5; Thu, 02 May 2019 22:47:09 +0900 Received: from jro by jrobl id 1hMC3J-0000ZV-0P ; Thu, 02 May 2019 22:47:09 +0900 From: "J. R. Okajima" Subject: Re: [PATCH] OVL: add honoracl=off mount option. To: NeilBrown Cc: "J. Bruce Fields" , Andreas Gruenbacher , Miklos Szeredi , Andreas =?utf-8?Q?Gr=C3=BCnbacher?= , Patrick Plagwitz , "linux-unionfs\@vger.kernel.org" , Linux NFS list , Linux FS-devel Mailing List , Linux Kernel Mailing List In-Reply-To: <8736lx4goa.fsf@notabene.neil.brown.name> References: <20161205151933.GA17517@fieldses.org> <20161205162559.GB17517@fieldses.org> <266c571f-e4e2-7c61-5ee2-8ece0c2d06e9@web.de> <20161206185806.GC31197@fieldses.org> <87bm0l4nra.fsf@notabene.neil.brown.name> <8736lx4goa.fsf@notabene.neil.brown.name> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <2199.1556804828.1@jrobl> Date: Thu, 02 May 2019 22:47:08 +0900 Message-ID: <2200.1556804828@jrobl> Sender: linux-nfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org NeilBrown: > If the upper and lower layers use incompatible ACL formats, it is not > possible to copy the ACL xttr from one to the other, so overlayfs > cannot work with them. > This happens particularly with NFSv4 which uses system.nfs4_acl, and > ext4 which uses system.posix_acl_access. FYI, Aufs had met the same problem many years ago, and I introduced some options called ICEX (Ignore Copyup Error on Xattr). (from the design doc in aufs) ---------------------------------------- For example, the src branch supports ACL but the dst branch doesn't because the dst branch may natively un-support it or temporary un-support it due to "noacl" mount option. Of course, the dst branch fs may NOT return an error even if the XATTR is not supported. It is totally up to the branch fs. Anyway when the aufs internal copy-up gets an error from the dst branch fs, then aufs tries removing the just copied entry and returns the error to the userspace. The worst case of this situation will be all copy-up will fail. For the copy-up operation, there two basic approaches. - copy the specified XATTR only (by category above), and return the error unconditionally if it happens. - copy all XATTR, and ignore the error on the specified category only. In order to support XATTR and to implement the correct behaviour, aufs chooses the latter approach and introduces some new branch attributes, "icexsec", "icexsys", "icextr", "icexusr", and "icexoth". They correspond to the XATTR namespaces (see above). Additionally, to be convenient, "icex" is also provided which means all "icex*" attributes are set (here the word "icex" stands for "ignore copy-error on XATTR"). The meaning of these attributes is to ignore the error from setting XATTR on that branch. Note that aufs tries copying all XATTR unconditionally, and ignores the error from the dst branch according to the specified attributes. ---------------------------------------- But recent nfs4 got changed its behaviour around ACL, and it didn't pass my local tests. I had posted about that, but got no reply. J. R. Okajima