• J.Bruce Fields's avatar
    [PATCH] knfsd: nfsd4: acls: relax the nfsv4->posix mapping · 09229edb
    J.Bruce Fields authored
    Use a different nfsv4->(draft posix) acl mapping which is
    	1. completely backwards compatible,
    	2. accepts any nfsv4 acl, and
    	3. errs on the side of restricting permissions.
    
    In detail:
    
    	1. completely backwards compatible: The new mapping produces the
    	same result on any acl produced by the existing (draft
    	posix)->nfsv4 mapping; the one exception is that we no longer
    	attempt to guess the value of the mask by assuming certain denies
    	represent the mask.  Since the server still keeps track of the mask
    	locally, sequences of chmod's will still be handled fine; the only
    	thing this will change is sequences of chmod's with intervening
    	read-modify-writes of the acl.  That last case just isn't worth the
    	trouble and the possible misrepresentations of the user's intent
    	(if we guess that a certain deny indicates masking is in effect
    	when it really isn't).
    
    	2. accepts any nfsv4 acl: That's not quite true: we still reject
    	acls that use combinations of inheritance flags that we don't
    	support.  We also reject acls that attempt to explicitly deny
    	read_acl or read_attributes permissions, or that attempt to deny
    	write_acl or write_attributes permissions to the owner of the file.
    
    	3.  errs on the side of restricting permissions: one exception to
    	this last rule: we totally ignore some bits (write_owner,
    	synchronize, read_named_attributes, etc.) that are completely alien
    	to our filesystem semantics, in some cases even if that would mean
    	ignoring an explicit deny that we have no intention of enforcing.
    	Excepting that, the posix acl produced should be the most
    	permissive acl that is not more permissive than the given nfsv4
    	acl.
    
    And the new code's shorter, too.  Neato.
    Signed-off-by: default avatarJ. Bruce Fields <bfields@citi.umich.edu>
    Signed-off-by: default avatarNeil Brown <neilb@suse.de>
    Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
    09229edb
nfs4acl.c 21.5 KB