Bug 1160463
| Summary: | nfs4_setfacl, nfs4_getfacl ignores DENY ace for DELETE, WRITE_OWNER, NAMED_ATTRS | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Olga Kornievskaia <aglo> | ||||
| Component: | nfs4-acl-tools | Assignee: | Steve Dickson <steved> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Yongcheng Yang <yoyang> | ||||
| Severity: | unspecified | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 7.2 | CC: | eguan, fs-qe, jiyin, lmiksik, yoyang | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | nfs4-acl-tools-0.3.3-14.el7 | Doc Type: | Bug Fix | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | |||||||
| : | 1249103 (view as bug list) | Environment: | |||||
| Last Closed: | 2015-11-19 14:47:18 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | 1161164 | ||||||
| Bug Blocks: | 1249103 | ||||||
| Attachments: |
|
||||||
[root@hp-dl380pg8-09 ~]# rpm -q nfs4-acl-tools nfs4-acl-tools-0.3.3-13.el7.x86_64 [root@hp-dl380pg8-09 ~]# [root@hp-dl380pg8-09 ~]# [root@hp-dl380pg8-09 ~]# cat /etc/exports /export *(rw) [root@hp-dl380pg8-09 ~]# service nfs restart Redirecting to /bin/systemctl restart nfs.service [root@hp-dl380pg8-09 ~]# mount localhost:/export/ /mnt/mnt_test/ [root@hp-dl380pg8-09 ~]# chmod 777 /export/ [root@hp-dl380pg8-09 ~]# touch /mnt/mnt_test/file1 [root@hp-dl380pg8-09 ~]# nfs4_setfacl -a D::EVERYONE@:donN /mnt/mnt_test/file1 [root@hp-dl380pg8-09 ~]# nfs4_getfacl /mnt/mnt_test/file1 A::OWNER@:rwatTcCy A::GROUP@:rtcy A::EVERYONE@:rtcy [root@hp-dl380pg8-09 ~]# Verified with nfs4-acl-tools-0.3.3-14.el7.x86_64 :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: do-Test-nfs4_setfacl-D::EVERYONE@:dnNo-with-netapp-pnfs-02.mgmt.lab.eng.nay.redhat.com:/export/qe-test-rhel6bz1161164-rhel7bz1160463 :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: [11:39:36 root@ ~~]# touch /mnt/nfsmp-nfs4_acl/nfs4_acl_testfile :: [ PASS ] :: Running 'touch /mnt/nfsmp-nfs4_acl/nfs4_acl_testfile' (Expected 0, got 0) -------------------------------------------------------------------------------- [11:39:36 root@ ~~]# nfs4_setfacl -a 'D::EVERYONE@:dnNo' /mnt/nfsmp-nfs4_acl/nfs4_acl_testfile :: [ PASS ] :: Running 'nfs4_setfacl -a 'D::EVERYONE@:dnNo' /mnt/nfsmp-nfs4_acl/nfs4_acl_testfile' (Expected 0, got 0) -------------------------------------------------------------------------------- [11:39:36 root@ ~~]# nfs4_getfacl /mnt/nfsmp-nfs4_acl/nfs4_acl_testfile | grep 'D::EVERYONE@:dnNo' :: [ FAIL ] :: Running 'nfs4_getfacl /mnt/nfsmp-nfs4_acl/nfs4_acl_testfile | grep 'D::EVERYONE@:dnNo'' (Expected 0, got 1) -------------------------------------------------------------------------------- [11:39:36 root@ ~~]# rm -f /mnt/nfsmp-nfs4_acl/nfs4_acl_testfile :: [ PASS ] :: Running 'rm -f /mnt/nfsmp-nfs4_acl/nfs4_acl_testfile' (Expected 0, got 0) -------------------------------------------------------------------------------- [root@ibm-x3550m4-02 common]# [root@ibm-x3550m4-02 common]# rpm -q nfs4-acl-tools nfs4-acl-tools-0.3.3-13.el7.x86_64 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ reproduced with previous version [root@ibm-x3550m4-02 common]# rpm -Uvh /root/nfs4-acl-tools-0.3.3-14.el7.x86_64.rpm Preparing... ################################# [100%] Updating / installing... 1:nfs4-acl-tools-0.3.3-14.el7 ################################# [ 50%] Cleaning up / removing... 2:nfs4-acl-tools-0.3.3-13.el7 ################################# [100%] [root@ibm-x3550m4-02 common]# rpm -q nfs4-acl-tools nfs4-acl-tools-0.3.3-14.el7.x86_64 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ update to the latest version [root@ibm-x3550m4-02 common]# ... :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: do-Test-nfs4_setfacl-D::EVERYONE@:dnNo-with-netapp-pnfs-02.mgmt.lab.eng.nay.redhat.com:/export/qe-test-rhel6bz1161164-rhel7bz1160463 :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: [11:42:21 root@ ~~]# touch /mnt/nfsmp-nfs4_acl/nfs4_acl_testfile :: [ PASS ] :: Running 'touch /mnt/nfsmp-nfs4_acl/nfs4_acl_testfile' (Expected 0, got 0) -------------------------------------------------------------------------------- [11:42:22 root@ ~~]# nfs4_setfacl -a 'D::EVERYONE@:dnNo' /mnt/nfsmp-nfs4_acl/nfs4_acl_testfile :: [ PASS ] :: Running 'nfs4_setfacl -a 'D::EVERYONE@:dnNo' /mnt/nfsmp-nfs4_acl/nfs4_acl_testfile' (Expected 0, got 0) -------------------------------------------------------------------------------- [11:42:22 root@ ~~]# nfs4_getfacl /mnt/nfsmp-nfs4_acl/nfs4_acl_testfile | grep 'D::EVERYONE@:dnNo' D::EVERYONE@:dnNo :: [ PASS ] :: Running 'nfs4_getfacl /mnt/nfsmp-nfs4_acl/nfs4_acl_testfile | grep 'D::EVERYONE@:dnNo'' (Expected 0, got 0) -------------------------------------------------------------------------------- [11:42:22 root@ ~~]# rm -f /mnt/nfsmp-nfs4_acl/nfs4_acl_testfile :: [ PASS ] :: Running 'rm -f /mnt/nfsmp-nfs4_acl/nfs4_acl_testfile' (Expected 0, got 0) Move to VERIFIED Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-2450.html |
Created attachment 953835 [details] patch file Description of problem: nfs4_setfacl ignores setting of DENY ace for DELETE, WRITE_OWNER, READ/WRITE_NAMED_ATTRS. nfs4_getfacl does not display presence of those aces. Version-Release number of selected component (if applicable): all versions but for as example nfs4-acl-tools-0.3.3-13.el7.x86_64 How reproducible and actual results: 1. mount your server /mnt 2. touch /mnt/file1 3. nfs4_setfacl -a D::EVERYONE@:donN /mnt/file1 4. nfs4_getfacl /mnt/file1 D::EVERYONE@: A::OWNER@:rwatTnNcCy A:g:GROUP@:rwatTnNcy A::EVERYONE@:rtncy Expected results: D::EVERYONE@:dnNo A::OWNER@:rwatTnNcCy A:g:GROUP@:rwatTnNcy A::EVERYONE@:rtncy Additional info: The following patch has been submitted to the maintainer as a fix: [PATCH 1/1] [nfs4-acl-tools] handle DENY ace for DELETE, WRITE_OWNER, and NAMED_ATTRS Don't ignore setting or viewing DENY ace for DELETE, WRITE_OWNER, and NAMED_ATTRS. Signed-off-by: Olga Kornievskaia <kolga> --- include/libacl_nfs4.h | 8 ++------ libnfs4acl/nfs4_new_ace.c | 3 --- 2 files changed, 2 insertions(+), 9 deletions(-) diff --git a/include/libacl_nfs4.h b/include/libacl_nfs4.h index 2f7cc28..7b19c6f 100644 --- a/include/libacl_nfs4.h +++ b/include/libacl_nfs4.h @@ -95,15 +95,11 @@ #define NFS4_INHERITANCE_FLAGS (NFS4_ACE_FILE_INHERIT_ACE \ | NFS4_ACE_DIRECTORY_INHERIT_ACE | NFS4_ACE_INHERIT_ONLY_ACE) -#define NFS4_ACE_MASK_IGNORE (NFS4_ACE_DELETE | NFS4_ACE_WRITE_OWNER \ - | NFS4_ACE_READ_NAMED_ATTRS | NFS4_ACE_WRITE_NAMED_ATTRS) /* XXX not sure about the following. Note that e.g. DELETE_CHILD is wrong in * general (should only be ignored on files). */ #define MASK_EQUAL(mask1, mask2) \ - (((mask1) & NFS4_ACE_MASK_ALL & ~NFS4_ACE_MASK_IGNORE & \ - ~NFS4_ACE_DELETE_CHILD) \ - == ((mask2) & NFS4_ACE_MASK_ALL & ~NFS4_ACE_MASK_IGNORE & \ - ~NFS4_ACE_DELETE_CHILD)) + (((mask1) & NFS4_ACE_MASK_ALL & ~NFS4_ACE_DELETE_CHILD) \ + == ((mask2) & NFS4_ACE_MASK_ALL & ~NFS4_ACE_DELETE_CHILD)) /* * NFS4_MAX_ACESIZE -- the number of bytes in the string representation we diff --git a/libnfs4acl/nfs4_new_ace.c b/libnfs4acl/nfs4_new_ace.c index a93f74a..0c875b1 100644 --- a/libnfs4acl/nfs4_new_ace.c +++ b/libnfs4acl/nfs4_new_ace.c @@ -51,9 +51,6 @@ struct nfs4_ace * nfs4_new_ace(int is_directory, u32 type, u32 flag, u32 access_ ace->type = type; ace->flag = flag; - if( type == NFS4_ACE_ACCESS_DENIED_ACE_TYPE ) - access_mask = access_mask & ~(NFS4_ACE_MASK_IGNORE); - /* Castrate delete_child if we aren't a directory */ if (!is_directory) access_mask &= ~NFS4_ACE_DELETE_CHILD; -- 1.9.3