Hide Forgot
In order to support full RPC authentication, we need to be able to transmit an array of gid_ts using the call frame so that posix call call setgroups with those gids. This is needed in order to support RPC authentication schemes where the RPC layer on the client sends us a list of at most 16 group ids for the user on whose behalf the RPC was issued. This needs support from client and server protocols along with the GlusterFS message encoding and decoding routines so that the array of group ids get supported natively in GlusterFS.
Once the transmission of gids is possible, the next thing that needs to be done is to bring in support in posix such that we depend on our in-house access and permission checking code rather than having to depend on setfs[ug]id and or setgroups system calls. Neither setfs[ug]id will work for us because it only allows setting one uid or gid whereas the operation needs to be performed using a gid sent to us through the auxiliary group list in RPC. setgroups does not work for setting the aux groups of the current process to a given array of gids because this function sets the gids for the whole process and not just the thread. This model is not acceptable for our purposes. Hence the need to have an in-house access checking mechanism
PATCH: http://patches.gluster.com/patch/2518 in master (core, client, server: Support auxiliary group ids)
err...not fixed. Auxiliary gid support has two parts. One in the protocol/client and server, which is the previous patch and a second part in storage/posix. That change is in my NFS tree and will be brought in later with NFS xlator.
PATCH: http://patches.gluster.com/patch/2864 in master (core: Provide helper macro to set [ug]id in frame)
Access control translator is being introduced for a fix to this bug. See bz 597 to know why.
PATCH: http://patches.gluster.com/patch/3068 in master (core: Add iatt protection bit testing macros)
PATCH: http://patches.gluster.com/patch/3069 in master (core: Expose default callbacks)
PATCH: http://patches.gluster.com/patch/3070 in master (access-control: Introduce new translator)