Bug 1243668

Summary: nfs-ganesha: extra ACE found while setting acl "inherit-only" flag
Product: [Red Hat Storage] Red Hat Gluster Storage Reporter: Saurabh <saujain>
Component: nfs-ganeshaAssignee: Jiffin <jthottan>
Status: CLOSED ERRATA QA Contact: Shashank Raj <sraj>
Severity: medium Docs Contact:
Priority: unspecified    
Version: rhgs-3.1CC: jthottan, mzywusko, nlevinki, rcyriac, rhinduja, sashinde, skoduri
Target Milestone: ---Keywords: ZStream
Target Release: RHGS 3.1.3   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: nfs-ganesha-2.3.1-1 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-06-23 05:35:47 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1299184    

Description Saurabh 2015-07-16 05:10:40 UTC 
Description of problem:
NFSv4 acls are suppose to provide the inherit only option with the flag "i"
if I use this option then there is an extra enrty that is added.

Version-Release number of selected component (if applicable):
glusterfs-3.7.1-9.el6rhs.x86_64
nfs-ganesha-2.2.0-5.el6rhs.x86_64

How reproducible:
always

Steps to Reproduce:
1. create a volume of type 6x2, start it
2. configure nfs-ganesha, mount the volume with vers=4
3. mkdir a dir.
4. set the acl with the below mentioned acl,
nfs4_setfacl -a "A:gdfi:acl_group.blr.redhat.com:rwx" /mountpoint/dirname

Actual results:
# nfs4_getfacl /export/mnt1/acl_user_dir2/
A::OWNER@:rwaDxtTcCy
A::GROUP@:rxtcy
A:g:acl_group.blr.redhat.com:rxtcy
A::EVERYONE@:rxtcy
A:fdi:OWNER@:tcy
A:fdi:GROUP@:tcy
A:fdig:acl_group.blr.redhat.com:rwaDxtcy
A:fdi:EVERYONE@:tcy


Expected results:
A:g:acl_group.blr.redhat.com:rxtcy , entry should not be there

Additional info:
Comment 2 Jiffin 2015-07-16 06:00:04 UTC 
When we set using 'i' flag that entry should be only the part of inherited acl entries not the effective acl. Here it is displaying it in effective acl entry list(with permission of EVERYONE@) is a valid bug. But it won't effect give any functionality issues , just only display an unnecessary acl entry in the list.
Comment 3 Jiffin 2015-09-09 08:32:15 UTC 
This is done as part of code clean patch for acl in ganesha https://review.gerrithub.io/#/c/236924/
Comment 8 Shashank Raj 2016-04-15 06:27:41 UTC 
Verified this bug with the latest build nfs-ganesha-2.3.1-3 and it works fine. Extra entry for the group is not seen under effective acl entries and is only a part of inherited acl list. Steps below:

[root@dhcp37-206 ~]# cd /mnt/nfs1/
[root@dhcp37-206 nfs1]# mkdir new
[root@dhcp37-206 nfs1]# ls
new
[root@dhcp37-206 nfs1]# nfs4_setfacl -a "A:gdfi:acl_group.blr.redhat.com:rwx" /mnt/nfs1/new
[root@dhcp37-206 nfs1]# nfs4_getfacl /mnt/nfs1/new/
A::OWNER@:rwaDxtTcCy
A::GROUP@:rxtcy
A::EVERYONE@:rxtcy
D:fdi:OWNER@:rwaDxTC
A:fdi:OWNER@:tcy
A:fdi:GROUP@:tcy
A:fdig:acl_group.blr.redhat.com:rwaDxtcy
A:fdi:EVERYONE@:tcy

Based on the above observation, marking this bug as Verified.
Comment 10 errata-xmlrpc 2016-06-23 05:35:47 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2016:1288