nfs: opening a file with O_WRONLY|O_CREAT flags can result in permission denied error

nfs: opening a file with O_WRONLY|O_CREAT flags can result in permission denied error

[Tian Lan]

Hello,

We recently noticed there is a behavior change w.r.t opening a file 
with the O_WRONLY|O_CREAT flags over the NFSv3 protocol after upgrading
the kernel from 6.1 LTS to 6.12 LTS. From the packets capturing, it seems
like the kernel would now issue an additional CREATE rpc call to the
remote NFS server regardless if the target file pre-exists or not.
The CREATE rpc request could return an EACCES error if the client only has 
the write permission to the pre-existing file but no write permission on 
the directory containing the pre-existing file. This causes the openat 
syscall to fail with permission denied error which is not expected.

After doing some code tracing, it seems like the new behavior was
introduced as part of 7c6c5249f061 ("NFS: add atomic_open for NFSv3 to
handle O_TRUNC correctly."). We would like to confirm if the current 
behavior that we are observing with the 6.12 kernel is expected given 
that the new behavior breaks existing user's application code. We 
currently have a workaround by explicitly remove the O_CREAT flag when 
opening a pre-existing file for write, but would still prefer not have
to apply this workaround when upgrading to the newer kernel.


Best,
Tian

Re: nfs: opening a file with O_WRONLY|O_CREAT flags can result in permission denied error

[Trond Myklebust]

On Mon, 2026-07-06 at 17:34 -0400, Tian Lan wrote:
> Hello,
> 
> We recently noticed there is a behavior change w.r.t opening a file 
> with the O_WRONLY|O_CREAT flags over the NFSv3 protocol after
> upgrading
> the kernel from 6.1 LTS to 6.12 LTS. From the packets capturing, it
> seems
> like the kernel would now issue an additional CREATE rpc call to the
> remote NFS server regardless if the target file pre-exists or not.
> The CREATE rpc request could return an EACCES error if the client
> only has 
> the write permission to the pre-existing file but no write permission
> on 
> the directory containing the pre-existing file. This causes the
> openat 
> syscall to fail with permission denied error which is not expected.
> 
> After doing some code tracing, it seems like the new behavior was
> introduced as part of 7c6c5249f061 ("NFS: add atomic_open for NFSv3
> to
> handle O_TRUNC correctly."). We would like to confirm if the current 
> behavior that we are observing with the 6.12 kernel is expected given
> that the new behavior breaks existing user's application code. We 
> currently have a workaround by explicitly remove the O_CREAT flag
> when 
> opening a pre-existing file for write, but would still prefer not
> have
> to apply this workaround when upgrading to the newer kernel.

NFSv3 CREATE is supposed to ignore the directory permissions if the
file already exists. That is required in order to support basic POSIX
open(O_CREAT) behaviour. Even with the old code, which did a lookup
before deciding to send the CREATE, there was a potential for races
that could have caused the client to send it against an existing file.

What server are you using?

-- 
Trond Myklebust
Linux NFS client maintainer, Hammerspace
trondmy@kernel.org, trond.myklebust@hammerspace.com