Re: NFS ACL strangeness

Hello,

On Wednesday 17 November 2004 21:58, Sven Geggus wrote:
> Hi there,
>
> I'm running two Machines:
>
> A Server running 2.4.28 with NFS-ACL patches and a Client running 2.6.9
> with current NFS-ACL patches from acl.bestbits.at.
>
> setfacl and getfacl are working fine, but default ACLS are not honored via
> NFS (they are, if I login directly on the Server).
>
> sven@diesel:~> getfacl .
> # file: .
> # owner: sven
> # group: sven
> user::rwx
> group::--x
> other::--x
>
> sven@diesel:~> getfacl ./mp3
> # file: mp3
> # owner: sven
> # group: sven
> user::rwx
> group::r-x
> other::r-x
> default:user::rwx
> default:group::r-x
> default:other::r-x
>
> Correct behavior on the Server:
>
> sven@benzin:~> touch foo mp3/foo
> sven@benzin:~> ll foo mp3/foo
> -rw-------  1 sven sven 0 2004-11-17 21:55 foo
> -rw-r--r--  1 sven sven 0 2004-11-17 21:55 mp3/foo
> sven@benzin:~> rm foo mp3/foo
>
> Incorrect behavior on the Client (NFS mounted directory):
> sven@diesel:~> touch foo mp3/foo
> sven@diesel:~> ll foo mp3/foo
> -rw-------  1 sven sven 0 2004-11-17 21:56 foo
> -rw-------  1 sven sven 0 2004-11-17 21:56 mp3/foo
>
> Any hints?

NFSv3 does not have the concept of a umask, but the server would need to know 
the umask in order to apply or ignore it when needed. Therefore, the client 
always applies the umask to the file create mode it sends to the server; you 
end up with fewer permissions when creating files on NFS in some cases. The 
default ACL is not ignored; it is applied in addition.

This problem is difficult to solve: The client could try to retrieve the 
default ACL of the parent directory and only apply the umask if there is 
none, but this would result in a race (and require an additional round-trip 
as well). A default ACL could be created or removed on the parent directory 
after the client queried the default ACL, but before it could create the 
file. The result could be too permissive permissions.

Regards,
-- 
Andreas Gruenbacher <[email protected]>
SUSE Labs, SUSE LINUX AG
_______________________________________________
acl-devel mailing list
[email protected]
http://acl.bestbits.at/mailman/listinfo/acl-devel