tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

NFSD: Refactor nfsd_setattr()'s ACL error reporting

Support for FATTR4_POSIX_ACCESS_ACL and FATTR4_POSIX_DEFAULT_ACL
attributes in subsequent patches allows clients to set both ACL
types simultaneously during SETATTR and file creation. Each ACL
type can succeed or fail independently, requiring the server to
clear individual attribute bits in the reply bitmap when one
fails while the other succeeds.

The existing na_aclerr field cannot distinguish which ACL type
encountered an error. Separate error fields (na_paclerr for
access ACLs, na_dpaclerr for default ACLs) enable the server to
report per-ACL-type failures accurately.

This refactoring also adds validation previously absent: default
ACL processing rejects non-directory targets with EINVAL and
passes NULL to set_posix_acl() when a_count is zero to delete
the ACL. Access ACL processing rejects zero a_count with EINVAL
for ACL_SCOPE_FILE_SYSTEM semantics (the only scope currently
supported).

The changes preserve compatibility with existing NFSv4 ACL code.
NFSv4 ACL conversion (nfs4_acl_nfsv4_to_posix()) never produces
POSIX ACLs with a_count == 0, so the new validation logic only
affects future POSIX ACL attribute handling.

Signed-off-by: Rick Macklem <rmacklem@uoguelph.ca>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>

authored by

Rick Macklem and committed by
Chuck Lever 345c4b77 9ac6fc0f

+34 -11
+5 -3
fs/nfsd/nfs4proc.c
··· 377 377 378 378 if (attrs.na_labelerr) 379 379 open->op_bmval[2] &= ~FATTR4_WORD2_SECURITY_LABEL; 380 - if (attrs.na_aclerr) 380 + if (attrs.na_paclerr || attrs.na_dpaclerr) 381 381 open->op_bmval[0] &= ~FATTR4_WORD0_ACL; 382 382 out: 383 383 end_creating(child); ··· 858 858 859 859 if (attrs.na_labelerr) 860 860 create->cr_bmval[2] &= ~FATTR4_WORD2_SECURITY_LABEL; 861 - if (attrs.na_aclerr) 861 + if (attrs.na_paclerr || attrs.na_dpaclerr) 862 862 create->cr_bmval[0] &= ~FATTR4_WORD0_ACL; 863 863 set_change_info(&create->cr_cinfo, &cstate->current_fh); 864 864 fh_dup2(&cstate->current_fh, &resfh); ··· 1232 1232 if (!status) 1233 1233 status = nfserrno(attrs.na_labelerr); 1234 1234 if (!status) 1235 - status = nfserrno(attrs.na_aclerr); 1235 + status = nfserrno(attrs.na_dpaclerr); 1236 + if (!status) 1237 + status = nfserrno(attrs.na_paclerr); 1236 1238 out: 1237 1239 nfsd_attrs_free(&attrs); 1238 1240 fh_drop_write(&cstate->current_fh);
+27 -7
fs/nfsd/vfs.c
··· 596 596 if (attr->na_seclabel && attr->na_seclabel->len) 597 597 attr->na_labelerr = security_inode_setsecctx(dentry, 598 598 attr->na_seclabel->data, attr->na_seclabel->len); 599 - if (IS_ENABLED(CONFIG_FS_POSIX_ACL) && attr->na_pacl) 600 - attr->na_aclerr = set_posix_acl(&nop_mnt_idmap, 601 - dentry, ACL_TYPE_ACCESS, 602 - attr->na_pacl); 603 - if (IS_ENABLED(CONFIG_FS_POSIX_ACL) && 604 - !attr->na_aclerr && attr->na_dpacl && S_ISDIR(inode->i_mode)) 605 - attr->na_aclerr = set_posix_acl(&nop_mnt_idmap, 599 + if (IS_ENABLED(CONFIG_FS_POSIX_ACL) && attr->na_dpacl) { 600 + if (!S_ISDIR(inode->i_mode)) 601 + attr->na_dpaclerr = -EINVAL; 602 + else if (attr->na_dpacl->a_count > 0) 603 + /* a_count == 0 means delete the ACL. */ 604 + attr->na_dpaclerr = set_posix_acl(&nop_mnt_idmap, 606 605 dentry, ACL_TYPE_DEFAULT, 607 606 attr->na_dpacl); 607 + else 608 + attr->na_dpaclerr = set_posix_acl(&nop_mnt_idmap, 609 + dentry, ACL_TYPE_DEFAULT, 610 + NULL); 611 + } 612 + if (IS_ENABLED(CONFIG_FS_POSIX_ACL) && attr->na_pacl) { 613 + /* 614 + * For any file system that is not ACL_SCOPE_FILE_OBJECT, 615 + * a_count == 0 MUST reply nfserr_inval. 616 + * For a file system that is ACL_SCOPE_FILE_OBJECT, 617 + * a_count == 0 deletes the ACL. 618 + * XXX File systems that are ACL_SCOPE_FILE_OBJECT 619 + * are not yet supported. 620 + */ 621 + if (attr->na_pacl->a_count > 0) 622 + attr->na_paclerr = set_posix_acl(&nop_mnt_idmap, 623 + dentry, ACL_TYPE_ACCESS, 624 + attr->na_pacl); 625 + else 626 + attr->na_paclerr = -EINVAL; 627 + } 608 628 out_fill_attrs: 609 629 /* 610 630 * RFC 1813 Section 3.3.2 does not mandate that an NFS server
+2 -1
fs/nfsd/vfs.h
··· 53 53 struct posix_acl *na_dpacl; /* input */ 54 54 55 55 int na_labelerr; /* output */ 56 - int na_aclerr; /* output */ 56 + int na_dpaclerr; /* output */ 57 + int na_paclerr; /* output */ 57 58 }; 58 59 59 60 static inline void nfsd_attrs_free(struct nfsd_attrs *attrs)