Bug 1101438
| Summary: | nfs: ls shows "Permission denied" with root-squash | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | [Red Hat Storage] Red Hat Gluster Storage | Reporter: | Saurabh <saujain> | ||||||||
| Component: | gluster-nfs | Assignee: | Meghana <mmadhusu> | ||||||||
| Status: | CLOSED ERRATA | QA Contact: | Saurabh <saujain> | ||||||||
| Severity: | medium | Docs Contact: | |||||||||
| Priority: | medium | ||||||||||
| Version: | rhgs-3.0 | CC: | amainkar, divya, mmadhusu, mzywusko, ndevos, nsathyan, sharne, vagarwal | ||||||||
| Target Milestone: | --- | Keywords: | Patch, ZStream | ||||||||
| Target Release: | RHGS 3.0.3 | Flags: | mmadhusu:
needinfo+
|
||||||||
| Hardware: | x86_64 | ||||||||||
| OS: | Linux | ||||||||||
| Whiteboard: | |||||||||||
| Fixed In Version: | glusterfs-3.6.0.33-1 | Doc Type: | Bug Fix | ||||||||
| Doc Text: |
Previously, when root-squash was enabled or even when no permissions were given to a file, NFS threw permission errors. With this fix, these permission errors are not displayed.
|
Story Points: | --- | ||||||||
| Clone Of: | |||||||||||
| : | 1161092 (view as bug list) | Environment: | |||||||||
| Last Closed: | 2015-01-15 13:37:14 UTC | Type: | Bug | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Embargoed: | |||||||||||
| Bug Depends On: | 1161092 | ||||||||||
| Bug Blocks: | 1162694 | ||||||||||
| Attachments: |
|
||||||||||
|
Description
Saurabh
2014-05-27 07:59:06 UTC
Created attachment 899401 [details]
nfs logs
The behaviour is seen on all the files that are created following the steps that are listed in the "Steps to reproduce" section. Packet trace shows expected ACCESS reply, allowing read and lookup permissions for the file. There are errors seen in server_getxattr_cbk.Yet to root cause the issue. Capturing what we discussed earlier today. Permission denied comes from xlators/system/posix-acl/src/posix-acl.c:acl_permits():
...
212 for (i = 0; i < acl->count; i++) {
213 switch (ace->tag) {
...
245 case POSIX_ACL_OTHER:
246 perm = (ctx->perm & S_IRWXO);
247 if (!found)
248 goto perm_check;
...
269 perm_check:
270 if ((perm & want) == want) {
271 goto green;
272 } else {
273 goto red;
274 }
...
acl_permits() lands in the switch statement at POSIX_ACL_OTHER. 'found' is false, so it goes to 'perm_check', where the if-statement results in the 'else' branch.
I do not remember what the 'want' was though... Please attach a tcpdump and output from rpcdebug captured on the NFS-client so that I can review it.
Thanks!
The value of want was 4 in this case. Created attachment 954119 [details]
root-squash logs
Created attachment 954361 [details]
nfs-client-logs
Attaching rpcdebug output on the NFS client.
The fix as discussed needs more investigation and testing. Populating xdata with posix acl xattrs didn't work as expected. Build used is this, glusterfs-3.6.0.33-1.el6rhs.x86_64 Executed the below mentioned step and didn't the see the issue this time and nfs logs didn't report the similar logs as mentioned in description section, [root@rhsauto012 nfs-test]# ls -R dir3/ dir3/: 3 [root@rhsauto012 nfs-test]# cd [root@nfs1 ~]# gluster volume set vol0 server.root-squash on volume set: success [root@nfs1 ~]# gluster volume info Volume Name: vol0 Type: Distributed-Replicate Volume ID: 2527d332-11aa-4f4b-8163-7d44fda5f16c Status: Started Snap Volume: no Number of Bricks: 6 x 2 = 12 Transport-type: tcp Bricks: Brick1: 10.70.37.74:/rhs/brick1/d1r1 Brick2: 10.70.37.89:/rhs/brick1/d1r2 Brick3: 10.70.37.91:/rhs/brick1/d2r1 Brick4: 10.70.37.133:/rhs/brick1/d2r2 Brick5: 10.70.37.74:/rhs/brick1/d3r1 Brick6: 10.70.37.89:/rhs/brick1/d3r2 Brick7: 10.70.37.91:/rhs/brick1/d4r1 Brick8: 10.70.37.133:/rhs/brick1/d4r2 Brick9: 10.70.37.74:/rhs/brick1/d5r1 Brick10: 10.70.37.89:/rhs/brick1/d5r2 Brick11: 10.70.37.91:/rhs/brick1/d6r1 Brick12: 10.70.37.133:/rhs/brick1/d6r2 Options Reconfigured: server.root-squash: on performance.readdir-ahead: on auto-delete: disable snap-max-soft-limit: 90 snap-max-hard-limit: 256 [root@rhsauto012 ~]# umount /mnt/nfs-test [root@rhsauto012 ~]# mount -t nfs -o vers=3 10.70.37.74:/vol0 /mnt/nfs-test [root@rhsauto012 ~]# ls -R /mnt/nfs-test/dir3/ /mnt/nfs-test/dir3/: 3 Meghana, Please review the edited doc text and sign-off. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-0038.html |