Bug 764547 (GLUSTER-2815)

Summary: Server-enforced ACLs
Product: [Community] GlusterFS Reporter: Jeff Darcy <jdarcy>
Component: unclassifiedAssignee: Vijay Bellur <vbellur>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: low Docs Contact:
Priority: medium    
Version: mainlineCC: amarts, gluster-bugs
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
URL: https://github.com/gluster/glusterfs/pull/1
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-02-18 11:03:33 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Jeff Darcy 2011-04-19 13:34:25 UTC 
Some time ago, a user asked about whether GlusterFS could support ACLs enforced on the server side instead of the client side.  It turned out that most of the code was already there, and - with some help from Avati - I was able to verify that it worked.  However, we agreed that it was unsuitable for this to be default behavior, so some work remained to make it run-time configurable.  I have now done that work, with the result in the github pull request at this bug's reference URL.  I'll repeat the commit/pull-request comment here for posterity.

---

By default, the behavior is the same as currently - ACLs are interpreted and
enforced on the client. To use server-side ACLs:

(1) Make sure that your server-side filesystems support the "acl" option and
are mounted with it.

(2) Add "option use-set-fsid true" to all of your server-side storage/posix
translators.

(3) Mount with "-o default-permissions=false" on the client side.

Note that the GlusterFS native protocol has no way to transmit supplementary
group IDs, so accesses relying on those might fail even if the ACL is set
correctly. This might be the subject of a future patch.
Comment 1 Anand Avati 2011-07-01 19:58:08 UTC 
PATCH: http://patches.gluster.com/patch/7721 in release-3.2 (byte-order: htole*/letoh* and htobe*/betoh* for forced endian conversions)
Comment 2 Anand Avati 2011-07-01 19:58:14 UTC 
PATCH: http://patches.gluster.com/patch/7722 in release-3.2 (dht: set linkto xattr with linkfile create (mknod))
Comment 3 Anand Avati 2011-07-01 19:58:20 UTC 
PATCH: http://patches.gluster.com/patch/7723 in release-3.2 (fuse: fill frame->root->groups with aux gids of the process)
Comment 4 Anand Avati 2011-07-01 19:58:26 UTC 
PATCH: http://patches.gluster.com/patch/7724 in release-3.2 (fuse: introduce "noacl" option to disable ACL checks)
Comment 5 Anand Avati 2011-07-01 19:58:31 UTC 
PATCH: http://patches.gluster.com/patch/7725 in release-3.2 (storage/posix: set ACL keys during new entry/inode creations)
Comment 6 Anand Avati 2011-07-01 19:58:37 UTC 
PATCH: http://patches.gluster.com/patch/7726 in release-3.2 (posix-acl: implementation of POSIX ACL as a translator)
Comment 7 Anand Avati 2011-07-01 19:58:43 UTC 
PATCH: http://patches.gluster.com/patch/7727 in release-3.2 (access-control: superseded by posix-acl translator)
Comment 8 Anand Avati 2011-07-01 19:58:48 UTC 
PATCH: http://patches.gluster.com/patch/7728 in release-3.2 (glusterfs: add --acl command line option to load ACLs on the client side)
Comment 9 Anand Avati 2011-07-01 19:58:54 UTC 
PATCH: http://patches.gluster.com/patch/7729 in release-3.2 (mount.glusterfs: support -o acl parameter)
Comment 10 Anand Avati 2011-07-08 06:25:47 UTC 
PATCH: http://patches.gluster.com/patch/7730 in master (byte-order: htole*/letoh* and htobe*/betoh* for forced endian conversions)
Comment 11 Anand Avati 2011-07-08 06:25:53 UTC 
PATCH: http://patches.gluster.com/patch/7731 in master (dht: set linkto xattr with linkfile create (mknod))
Comment 12 Anand Avati 2011-07-08 06:25:58 UTC 
PATCH: http://patches.gluster.com/patch/7732 in master (fuse: fill frame->root->groups with aux gids of the process)
Comment 13 Anand Avati 2011-07-08 06:26:04 UTC 
PATCH: http://patches.gluster.com/patch/7798 in master (fuse: introduce "noacl" option to disable ACL checks)
Comment 14 Anand Avati 2011-07-08 06:26:10 UTC 
PATCH: http://patches.gluster.com/patch/7734 in master (storage/posix: set ACL keys during new entry/inode creations)
Comment 15 Anand Avati 2011-07-08 06:26:15 UTC 
PATCH: http://patches.gluster.com/patch/7735 in master (posix-acl: implementation of POSIX ACL as a translator)
Comment 16 Anand Avati 2011-07-08 06:26:21 UTC 
PATCH: http://patches.gluster.com/patch/7736 in master (access-control: superseded by posix-acl translator)
Comment 17 Anand Avati 2011-07-08 06:26:27 UTC 
PATCH: http://patches.gluster.com/patch/7737 in master (glusterfs: add --acl command line option to load ACLs on the client side)
Comment 18 Anand Avati 2011-07-08 06:26:33 UTC 
PATCH: http://patches.gluster.com/patch/7738 in master (mount.glusterfs: support -o acl parameter)
Comment 19 Anand Avati 2011-07-08 14:24:25 UTC 
PATCH: http://patches.gluster.com/patch/7810 in release-3.2 (posix-acl: perform access checks on read/write/truncate for NFS calls)
Comment 20 Anand Avati 2011-07-13 07:00:56 UTC 
PATCH: http://patches.gluster.com/patch/7883 in master (posix-acl: perform access checks on read/write/truncate for NFS calls)
Comment 21 Anand Avati 2011-09-08 11:08:15 UTC 
CHANGE: http://review.gluster.com/332 (In configurations with a uid mapper, super user ID could be mapped) merged in master by Anand Avati (avati)
Comment 22 Amar Tumballi 2012-02-18 11:03:33 UTC 
already in 3.2.x branch, and also in upstream