[-V2,00/16] New ACL format for better NFSv4 acl interoperability

On Mon, 19 Jul 2010 21:19:50 +0200, Andreas Gruenbacher <agruen@suse.de> wrote:
> Aneesh,
> 
> here is a patch on top of the richacl-upstream queue.
> 
> So far, we were assuming that acls are always masked, and the file masks
> could be set so that they would not mask any permissions.  This is fine
> for permission checking, but richacl_apply_masks() didn't recognize when
> the file masks were set to mask nothing, and was still transforming such
> acls unnecessarily.  This could lead to correct but surprising results.
> 
> Instead of using a flag here we could check if the file masks are set to
> "ineffective" values, but that would require the same computation as
> richacl_compute_max_masks(), which can be a slow on large acls.  It is a
> lot easier to instead remember if the file masks are "effective".
> 
> (We still need to compute the file masks in nfsd where no file masks are
> supplied so that the file permission bits will be set to a reasonable
> value. user space will always pass valid file masks in, so we are covered
> in that side.)

We need to update ACL4_VALID_FLAGS to now consider ACL4_MASKED as a
valid flag. This is also needed for userspace. On a related note,
should we move ACL4_MASKED and ACL4_POSIX_MAPPED to be the higher
bits ? That would make sure we will be able to accomodate new flag
value NFSv4 define. Something like 




-aneesh


--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

On Tuesday 20 July 2010 11:31:07 Aneesh Kumar K. V wrote:
> We need to update ACL4_VALID_FLAGS to now consider ACL4_MASKED as a
> valid flag.  This is also needed for userspace.

Good point, I missed that.

> On a related note, should we move ACL4_MASKED and ACL4_POSIX_MAPPED to
> be the higher bits ? That would make sure we will be able to accomodate
> new flag value NFSv4 define.

That makes sense, except that ACL4_POSIX_MAPPED hasn't entered the scene in 
the patches posted here, and I'm still not convinced that we'll actually need 
it.

Thanks,
Andreas
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

On Tue, 20 Jul 2010 12:11:53 +0200, Andreas Gruenbacher <agruen@suse.de> wrote:
> On Tuesday 20 July 2010 11:31:07 Aneesh Kumar K. V wrote:
> > We need to update ACL4_VALID_FLAGS to now consider ACL4_MASKED as a
> > valid flag.  This is also needed for userspace.
> 
> Good point, I missed that.

I updated the patch and will push the change to korg after running some
test.

> 
> > On a related note, should we move ACL4_MASKED and ACL4_POSIX_MAPPED to
> > be the higher bits ? That would make sure we will be able to accomodate
> > new flag value NFSv4 define.
> 
> That makes sense, except that ACL4_POSIX_MAPPED hasn't entered the scene in 
> the patches posted here, and I'm still not convinced that we'll actually need 
> it.
> 

The userspace change did result in a different output for the below ex:

richacl --set 'flags:a 101:w::deny 101:rw::allow 101:w:a:deny 101:rw:a:allow' f

this now gives

/mnt/d# richacl  --get --numeric  f
f:
 flags:a
   101:-w-----------::deny
   101:rw-----------::allow
   101:-w-----------:a:deny
   101:rw-----------:a:allow

that 'w' in rw::allow is redundant, because we have a deny entry before.

-aneesh
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

On Tuesday 20 July 2010 17:23:36 Aneesh Kumar K. V wrote:
> The userspace change did result in a different output [...]

Yes, this is expected -- we now leave acls alone more often.

Thanks,
Andreas
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html