Bug 1533046

Summary: ACLs - permission denied
Product: [Community] GlusterFS Reporter: Chris Webb <christopher.webb>
Component: access-controlAssignee: bugs <bugs>
Status: CLOSED NOTABUG QA Contact:
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: mainlineCC: bugs, dwojslaw, pasik
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-11-21 05:47:35 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Chris Webb 2018-01-10 10:55:34 UTC
Description of problem:

I have a gluster partition mounted locally for testing:

[root@testfs ~]# mount -t glusterfs -o acl testfs:/group /mnt/testlocal/

[xpimxwm@testfs testlocal]$ df -h .
Filesystem      Size  Used Avail Use% Mounted on
testfs:/group    20T  466G   20T   3% /mnt/testlocal
[xpimxwm@testfs testlocal]$ mount | grep /mnt/testlocal
testfs:/group on /mnt/testlocal type fuse.glusterfs (rw,relatime,user_id=0,group_id=0,allow_other,max_read=131072)
[xpimxwm@testfs testlocal]$

The get/setfacl tools work, I have added two groups my account belongs to (cnsadm/mriqa):

[xpimxmw@testfs testlocal]$ getfacl /mnt/testlocal/x-test
getfacl: Removing leading '/' from absolute path names
# file: mnt/testlocal/x-test
# owner: 10001
# group: root
user::rwx
group::rwx
group:cnsadm:rwx
group:mriqa:rwx
mask::rwx
other::---
default:user::rwx
default:group::rwx
default:group:mriqa:rwx
default:mask::rwx
default:other::---

[xpimxmw@testfs testlocal]$ groups
cnsadm paradigm nsgc rhode .magicb physics mriqa zzzzz
[xpimxmw@testfs testlocal]$ o

I am neither user 10001 nor in the root group, however the ACL should allow me access:
[xpimxmw@testfs testlocal]$ ls -ld /mnt/testlocal/x-test/
drwxrwx---+ 3 10001 root 4096 Jan  9 16:23 /mnt/testlocal/x-test/
[xpimxmw@testfs testlocal]$ ls /mnt/testlocal/x-test/
ls: cannot open directory /mnt/testlocal/x-test/: Permission denied
[xpimxmw@testfs testlocal]$

I'm somewhat surprised cd works:

[xpimxmw@testfs testlocal]$ cd /mnt/testlocal/x-test/
[xpimxmw@testfs x-test]$ ls
ls: cannot open directory .: Permission denied
[xpimxmw@testfs x-test]$ cd -
[xpimxmw@testfs testlocal]$


I can however access the raw bricks directly:
[xpimxmw@testfs testlocal]$ ls /data/glusterfs/
brick01/ brick02/
[xpimxmw@testfs testlocal]$ ls /data/glusterfs/brick01/
acltest*    physics/     speed/      x-test/
[xpimxmw@testfs testlocal]$ ls /data/glusterfs/brick01/x-test/
fred
[xpimxmw@testfs testlocal]$ getfacl /data/glusterfs/brick01/x-test
getfacl: Removing leading '/' from absolute path names
# file: data/glusterfs/brick01/x-test
etfacl: Removing leading '/' from absolute path names
# file: data/glusterfs/brick01/x-test
# owner: 10001
# group: root
user::rwx
group::rwx
group:cnsadm:rwx
group:mriqa:rwx
mask::rwx
other::---
default:user::rwx
default:group::rwx
default:group:mriqa:rwx
default:mask::rwx
default:other::---

[xpimxmw@testfs testlocal]$

Version-Release number of selected component (if applicable):

[xpimxmw@testfs testlocal]$ rpm -qa | grep gluster
centos-release-gluster312-1.0-1.el7.centos.noarch
glusterfs-3.12.3-1.el7.x86_64
glusterfs-client-xlators-3.12.3-1.el7.x86_64
nfs-ganesha-gluster-2.5.3-1.el6.x86_64
glusterfs-cli-3.12.3-1.el7.x86_64
glusterfs-api-3.12.3-1.el7.x86_64
glusterfs-libs-3.12.3-1.el7.x86_64
glusterfs-fuse-3.12.3-1.el7.x86_64
glusterfs-server-3.12.3-1.el7.x86_64
glusterfs-rdma-3.12.3-1.el7.x86_64
[xpimxmw@testfs testlocal]$

[xpimxmw@testfs testlocal]$ uname -a
Linux testfs 3.10.0-693.11.6.el7.x86_64 #1 SMP Thu Jan 4 01:06:37 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
[xpimxmw@testfs testlocal]$ cat /etc/redhat-release
CentOS Linux release 7.4.1708 (Core)
[xpimxmw@testfs testlocal]$

How reproducible:

Always

Steps to Reproduce:

As above.

Actual results:

ACLs not honored

Expected results:

ACLs should allow access

Additional info:

Comment 1 Chris Webb 2018-01-30 08:52:41 UTC
This appears to be an interaction with the underlying filesystem. We were using ZFS (primarily for compression), the problem goes away if we switch to xfs.

Comment 2 Shyamsundar 2018-10-23 14:55:24 UTC
Release 3.12 has been EOLd and this bug was still found to be in the NEW state, hence moving the version to mainline, to triage the same and take appropriate actions.

Comment 3 Jiffin 2018-11-21 05:47:35 UTC
As per c#1, the issue seems to related to ZFS. Hence closing the bug as not a bug