nfs4_ace_from_string: ignore inheritance ACEs on non-directories.
Subsystems (2)
PATCH 1/1 nfs4_ace_from_string: ignore inheritance ACEs on non-directories.
If you try to use
nfs4_setfacl -R -a A:d:........ directory
to recursively set an inheritance ACE on all directories in a tree, it will fail on the first non-directory as setting an inheritance ACE there is not permitted (and as it aborts on the first sign of an error).
So use the is_dir flag to avoid doing that, just as is done with the DELETE_CHILD permission.
---
Hi Bruce,
are you still maintaining nfsv4-acl-tools? Last commit was over a year ago!! I guess that means it is nearly perfect :-)
A customer came across this problem and it seems simple to fix, but if I'm missing something important, please let me know.
NeilBrown
libnfs4acl/nfs4_ace_from_string.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
libnfs4acl/nfs4_ace_from_string.c +8 -4
@@ -185,16 +185,20 @@ struct nfs4_ace * nfs4_ace_from_string(char *ace_buf, int is_dir)for (buflen =strlen (field); buflen >0 ; buflen--) {switch (*field) {case FLAG_FILE_INHERIT : - flags |=NFS4_ACE_FILE_INHERIT_ACE ; +if (is_dir) + flags |=NFS4_ACE_FILE_INHERIT_ACE ;break ;case FLAG_DIR_INHERIT : - flags |=NFS4_ACE_DIRECTORY_INHERIT_ACE ; +if (is_dir) + flags |=NFS4_ACE_DIRECTORY_INHERIT_ACE ;break ;case FLAG_NO_PROPAGATE_INHERIT : - flags |=NFS4_ACE_NO_PROPAGATE_INHERIT_ACE ; +if (is_dir) + flags |=NFS4_ACE_NO_PROPAGATE_INHERIT_ACE ;break ;case FLAG_INHERIT_ONLY : - flags |=NFS4_ACE_INHERIT_ONLY_ACE ; +if (is_dir) + flags |=NFS4_ACE_INHERIT_ONLY_ACE ;break ;case FLAG_SUCCESSFUL_ACCESS : flags |=NFS4_ACE_SUCCESSFUL_ACCESS_ACE_FLAG ;
Signature · 1 line
2.7.1
Quoted 11 lines · NeilBrown
If you try to use
nfs4_setfacl -R -a A:d:........ directoryto recursively set an inheritance ACE on all directories in a tree, it will fail on the first non-directory as setting an inheritance ACE there is not permitted (and as it aborts on the first sign of an error).
So use the
is_dirflag to avoid doing that, just as is done with theDELETE_CHILDpermission.
Quoted 6 lines
Signed-off-by NeilBrown <[email protected]>---
Hi Bruce,
are you still maintaining nfsv4-acl-tools? Last commit was over a year ago!! I guess that means it is nearly perfect :-)
Alas, it could probably use some love. I'm hoping richacls take over, though. Eventually.
Quoted 2 lines
A customer came across this problem and it seems simple to fix, but if I'm missing something important, please let me know.
I didn't trace carefully through the callers, but I suspect this'll also mean that nfs4_setfacl also silently discards inheritable ACEs in some cases where the user could know better, instead of erroring out?
But, honestly, I'm not necessarily even sure which is the better behavior, and -R needs to work, so, applying.
Futher patches, or volunteers for maintenance, welcome....
--b.
Quoted 39 lines
NeilBrown
libnfs4acl/nfs4_ace_from_string.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)libnfs4acl/nfs4_ace_from_string.c +8
-4@@ -185,16 +185,20 @@ struct nfs4_ace * nfs4_ace_from_string(char *ace_buf, int is_dir)for (buflen =strlen (field); buflen >0 ; buflen--) {switch (*field) {case FLAG_FILE_INHERIT : - flags |=NFS4_ACE_FILE_INHERIT_ACE ; +if (is_dir) + flags |=NFS4_ACE_FILE_INHERIT_ACE ;break ;case FLAG_DIR_INHERIT : - flags |=NFS4_ACE_DIRECTORY_INHERIT_ACE ; +if (is_dir) + flags |=NFS4_ACE_DIRECTORY_INHERIT_ACE ;break ;case FLAG_NO_PROPAGATE_INHERIT : - flags |=NFS4_ACE_NO_PROPAGATE_INHERIT_ACE ; +if (is_dir) + flags |=NFS4_ACE_NO_PROPAGATE_INHERIT_ACE ;break ;case FLAG_INHERIT_ONLY : - flags |=NFS4_ACE_INHERIT_ONLY_ACE ; +if (is_dir) + flags |=NFS4_ACE_INHERIT_ONLY_ACE ;break ;case FLAG_SUCCESSFUL_ACCESS : flags |=NFS4_ACE_SUCCESSFUL_ACCESS_ACE_FLAG ;Signature · 1 line
2.7.1
Quoted 22 lines · J. Bruce Fields
Quoted 11 lines · NeilBrown
If you try to use
nfs4_setfacl -R -a A:d:........ directoryto recursively set an inheritance ACE on all directories in a tree, it will fail on the first non-directory as setting an inheritance ACE there is not permitted (and as it aborts on the first sign of an error).
So use the
is_dirflag to avoid doing that, just as is done with theDELETE_CHILDpermission.Quoted 6 lines
Signed-off-by NeilBrown <[email protected]>---
Hi Bruce,
are you still maintaining nfsv4-acl-tools? Last commit was over a year ago!! I guess that means it is nearly perfect :-)Alas, it could probably use some love. I'm hoping richacls take over, though. Eventually.
Quoted 6 lines
Quoted 2 lines
A customer came across this problem and it seems simple to fix, but if I'm missing something important, please let me know.
I didn't trace carefully through the callers, but I suspect this'll also mean that
nfs4_setfaclalso silently discards inheritable ACEs in some cases where the user could know better, instead of erroring out?
I guess so. If you give a file on the command line then you still want the error. If you give a directory and "-R" you don't. I wonder how much work that would be....
Quoted 3 lines
But, honestly, I'm not necessarily even sure which is the better behavior, and -R needs to work, so, applying.
Thanks.
Quoted 2 lines
Futher patches, or volunteers for maintenance, welcome....
:-) Patches, maybe. The rest - not me!!
Thanks,
NeilBrown