Bug 1533046 - ACLs - permission denied
Summary: ACLs - permission denied
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: GlusterFS
Classification: Community
Component: access-control
Version: mainline
Hardware: x86_64
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: bugs@gluster.org
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-01-10 10:55 UTC by Chris Webb
Modified: 2018-11-21 05:47 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2018-11-21 05:47:35 UTC
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Embargoed:


Attachments (Terms of Use)

Description Chris Webb 2018-01-10 10:55:34 UTC
Description of problem:

I have a gluster partition mounted locally for testing:

[root@testfs ~]# mount -t glusterfs -o acl testfs:/group /mnt/testlocal/

[xpimxwm@testfs testlocal]$ df -h .
Filesystem      Size  Used Avail Use% Mounted on
testfs:/group    20T  466G   20T   3% /mnt/testlocal
[xpimxwm@testfs testlocal]$ mount | grep /mnt/testlocal
testfs:/group on /mnt/testlocal type fuse.glusterfs (rw,relatime,user_id=0,group_id=0,allow_other,max_read=131072)
[xpimxwm@testfs testlocal]$

The get/setfacl tools work, I have added two groups my account belongs to (cnsadm/mriqa):

[xpimxmw@testfs testlocal]$ getfacl /mnt/testlocal/x-test
getfacl: Removing leading '/' from absolute path names
# file: mnt/testlocal/x-test
# owner: 10001
# group: root
user::rwx
group::rwx
group:cnsadm:rwx
group:mriqa:rwx
mask::rwx
other::---
default:user::rwx
default:group::rwx
default:group:mriqa:rwx
default:mask::rwx
default:other::---

[xpimxmw@testfs testlocal]$ groups
cnsadm paradigm nsgc rhode .magicb physics mriqa zzzzz
[xpimxmw@testfs testlocal]$ o

I am neither user 10001 nor in the root group, however the ACL should allow me access:
[xpimxmw@testfs testlocal]$ ls -ld /mnt/testlocal/x-test/
drwxrwx---+ 3 10001 root 4096 Jan  9 16:23 /mnt/testlocal/x-test/
[xpimxmw@testfs testlocal]$ ls /mnt/testlocal/x-test/
ls: cannot open directory /mnt/testlocal/x-test/: Permission denied
[xpimxmw@testfs testlocal]$

I'm somewhat surprised cd works:

[xpimxmw@testfs testlocal]$ cd /mnt/testlocal/x-test/
[xpimxmw@testfs x-test]$ ls
ls: cannot open directory .: Permission denied
[xpimxmw@testfs x-test]$ cd -
[xpimxmw@testfs testlocal]$


I can however access the raw bricks directly:
[xpimxmw@testfs testlocal]$ ls /data/glusterfs/
brick01/ brick02/
[xpimxmw@testfs testlocal]$ ls /data/glusterfs/brick01/
acltest*    physics/     speed/      x-test/
[xpimxmw@testfs testlocal]$ ls /data/glusterfs/brick01/x-test/
fred
[xpimxmw@testfs testlocal]$ getfacl /data/glusterfs/brick01/x-test
getfacl: Removing leading '/' from absolute path names
# file: data/glusterfs/brick01/x-test
etfacl: Removing leading '/' from absolute path names
# file: data/glusterfs/brick01/x-test
# owner: 10001
# group: root
user::rwx
group::rwx
group:cnsadm:rwx
group:mriqa:rwx
mask::rwx
other::---
default:user::rwx
default:group::rwx
default:group:mriqa:rwx
default:mask::rwx
default:other::---

[xpimxmw@testfs testlocal]$

Version-Release number of selected component (if applicable):

[xpimxmw@testfs testlocal]$ rpm -qa | grep gluster
centos-release-gluster312-1.0-1.el7.centos.noarch
glusterfs-3.12.3-1.el7.x86_64
glusterfs-client-xlators-3.12.3-1.el7.x86_64
nfs-ganesha-gluster-2.5.3-1.el6.x86_64
glusterfs-cli-3.12.3-1.el7.x86_64
glusterfs-api-3.12.3-1.el7.x86_64
glusterfs-libs-3.12.3-1.el7.x86_64
glusterfs-fuse-3.12.3-1.el7.x86_64
glusterfs-server-3.12.3-1.el7.x86_64
glusterfs-rdma-3.12.3-1.el7.x86_64
[xpimxmw@testfs testlocal]$

[xpimxmw@testfs testlocal]$ uname -a
Linux testfs 3.10.0-693.11.6.el7.x86_64 #1 SMP Thu Jan 4 01:06:37 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
[xpimxmw@testfs testlocal]$ cat /etc/redhat-release
CentOS Linux release 7.4.1708 (Core)
[xpimxmw@testfs testlocal]$

How reproducible:

Always

Steps to Reproduce:

As above.

Actual results:

ACLs not honored

Expected results:

ACLs should allow access

Additional info:

Comment 1 Chris Webb 2018-01-30 08:52:41 UTC
This appears to be an interaction with the underlying filesystem. We were using ZFS (primarily for compression), the problem goes away if we switch to xfs.

Comment 2 Shyamsundar 2018-10-23 14:55:24 UTC
Release 3.12 has been EOLd and this bug was still found to be in the NEW state, hence moving the version to mainline, to triage the same and take appropriate actions.

Comment 3 Jiffin 2018-11-21 05:47:35 UTC
As per c#1, the issue seems to related to ZFS. Hence closing the bug as not a bug


Note You need to log in before you can comment on or make changes to this bug.