From: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
To: sfrench@us.ibm.com, ffilz@us.ibm.com, agruen@suse.de,
adilger@sun.com, sandeen@redhat.com, tytso@mit.edu,
staubach@redhat.com, bfields@citi.umich.edu, jlayton@redhat.com
Cc: aneesh.kumar@linux.vnet.ibm.com, linux-fsdevel@vger.kernel.org,
nfsv4@linux-nfs.org, linux-ext4@vger.kernel.org
Subject: [RFC PATCH] New ACL format for better NFSv4 acl interoperability
Date: Mon, 1 Feb 2010 11:04:42 +0530 [thread overview]
Message-ID: <1265002505-8387-1-git-send-email-aneesh.kumar@linux.vnet.ibm.com> (raw)
Hi,
**** RFC patch. Not for inclusion ****
The following set of patches implements a new acl format
for linux. Rich-acl format is proposed so that we can have
better acl interoperability with CIFS and NFSv4 acl.
Posix acl should still be considered as the default acl on
any file system because of its simplicity. File systems
should provide a migration mechanism to rich-acl format if
they ever want to export these file systems via CIFS or NFSv4.
Some of the patches in the series are earlier published as
NFSv4 acl patches at http://www.suse.de/~agruen/nfs4acl/
and http://oss.sgi.com/projects/nfs/nfs4acl/. Linux kernel
already supports "system.nfs4_acl" via NFSv4 client. NFSv4
client provides byte sequence representation of the acl value
to the userspace. The userspace then use this array and build
the acl structure. Linux native NFSv4acl work done by
Andreas Gruenbacher on the other hand provided an acl struct
to the userspace. Since both the implementation used NFSv4
acl format it was decided to rename non upstream implementation as
rich-acl even though the acl model is NFSv4.
Rich-acl also adds some exception to the NFSv4 specified
access rules. The access rules are modified in a way that
make sense in posix environment. For example with patches applied
a) we always allow read attributes
b) we always allow read acl.
c) execute doesn't imply read.
That implies even if the file system object have acl values that
deny read attribute access, local file system still allows read
attributes access to make sure we don't break posix semantics. This
gives an opportunity for nfsd to use the attribute value and
deny read attribute access as per NFSv4 RFC
Patches are done in way that changes done by me are kept
as separate patches. This make sure I don't end up breaking
the access check algorithm done by Andreas Gruenbacher. This also
helps in collecting review feedback on some of the changes done
by me in the access check algorithm. Before merging this upstream
most of these patches have to folded back into relevant patches.
Userspace changes needed for acl tools can be found at
http://git.kernel.org/?p=fs/acl/kvaneesh/acl.git;a=summary
I have updated getfacl to print rich-acl format if rich-acl is
enabled. Only Ext4 is updated to support the new acl format. To
enable rich-acl format one should use tune2fs to enabled the
richacl file system feature. The relevant patches can be found
at http://www.kernel.org/pub/linux/kernel/people/kvaneesh/richaclv2/e2fsprogs/
NFSD is also updated to save and read richacl format if the local
file system supports the new acl format.
git repo for the kernel change is at
http://git.kernel.org/?p=linux/kernel/git/kvaneesh/linux-richacl.git;a=summary
git://git.kernel.org/pub/scm/linux/kernel/git/kvaneesh/linux-richacl.git for-upstream
-aneesh
next reply other threads:[~2010-02-01 5:34 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-02-01 5:34 Aneesh Kumar K.V [this message]
2010-02-01 5:34 ` [PATCH 01/23] vfs: VFS hooks for per-filesystem permission models Aneesh Kumar K.V
2010-02-01 5:34 ` [PATCH 02/23] vfs: Check for create permission during rename Aneesh Kumar K.V
2010-02-01 5:34 ` [PATCH 03/23] vfs: rich ACL in-memory representation and manipulation Aneesh Kumar K.V
2010-02-01 7:28 ` Brad Boyer
2010-02-01 18:02 ` Aneesh Kumar K. V
2010-02-01 23:06 ` J. Bruce Fields
2010-02-01 23:21 ` J. Bruce Fields
2010-02-01 5:34 ` [PATCH 04/23] richacl: Add write retention and retention hold access mask Aneesh Kumar K.V
2010-02-01 5:34 ` [PATCH 05/23] ext4: Implement rich acl for ext4 Aneesh Kumar K.V
2010-02-01 5:34 ` [PATCH 06/23] vfs: Implement those parts of Automatic Inheritance (AI) which are safe under POSIX Aneesh Kumar K.V
2010-02-01 5:34 ` [PATCH 07/23] vfs: Add Posix acl to rich acl mapping helpers Aneesh Kumar K.V
2010-02-01 23:18 ` J. Bruce Fields
2010-02-02 5:22 ` Aneesh Kumar K. V
2010-02-01 5:34 ` [PATCH 08/23] vfs: Add a flag to denote posix mapped richacl Aneesh Kumar K.V
2010-02-01 23:18 ` J. Bruce Fields
2010-02-02 5:33 ` Aneesh Kumar K. V
2010-02-02 15:18 ` J. Bruce Fields
2010-02-01 5:34 ` [PATCH 09/23] ext4: Add posix acl to rich acl mapping Aneesh Kumar K.V
2010-02-01 5:34 ` [PATCH 10/23] richacl: Add separate file and dir acl masks Aneesh Kumar K.V
2010-02-01 5:34 ` [PATCH 11/23] richacl: Move the xattr representation to little-endian format Aneesh Kumar K.V
2010-02-01 23:34 ` J. Bruce Fields
2010-02-02 5:35 ` Aneesh Kumar K. V
2010-02-01 5:34 ` [PATCH 12/23] richacl: Use directory specific mask values for operation on directories Aneesh Kumar K.V
2010-02-01 5:34 ` [PATCH 13/23] richacl: Follow nfs4 acl delete definition Aneesh Kumar K.V
2010-02-01 5:34 ` [PATCH 14/23] richacl: Disable automatic inheritance with posix mapped acls Aneesh Kumar K.V
2010-02-01 5:34 ` [PATCH 15/23] richacl: Delete posix acl if present on richacl set Aneesh Kumar K.V
2010-02-01 5:34 ` [PATCH 16/23] ext4: Update richacl incompat flag value Aneesh Kumar K.V
2010-02-01 23:41 ` J. Bruce Fields
2010-02-01 5:34 ` [PATCH 17/23] vfs: Add new MS_ACL and MS_RICHACL flag Aneesh Kumar K.V
2010-02-01 5:35 ` [PATCH 18/23] richacl: Add helper function for creating richacl from mode values Aneesh Kumar K.V
2010-02-01 5:35 ` [PATCH 19/23] fs: Use the correct MS_*ACL flags in file system code Aneesh Kumar K.V
2010-02-01 5:35 ` [PATCH 20/23] nfsd: Apply NFSv4acl to posix acl mapping only if MS_POSIXACL is set Aneesh Kumar K.V
2010-02-01 5:35 ` [PATCH 21/23] richacl: Add helpers for NFSv4 acl to richacl conversion Aneesh Kumar K.V
2010-02-01 5:35 ` [PATCH 22/23] nfsd: Add support for reading rich acl from file system Aneesh Kumar K.V
2010-02-01 5:35 ` [PATCH 23/23] nfsd: Add support for saving richacl Aneesh Kumar K.V
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1265002505-8387-1-git-send-email-aneesh.kumar@linux.vnet.ibm.com \
--to=aneesh.kumar@linux.vnet.ibm.com \
--cc=adilger@sun.com \
--cc=agruen@suse.de \
--cc=bfields@citi.umich.edu \
--cc=ffilz@us.ibm.com \
--cc=jlayton@redhat.com \
--cc=linux-ext4@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=nfsv4@linux-nfs.org \
--cc=sandeen@redhat.com \
--cc=sfrench@us.ibm.com \
--cc=staubach@redhat.com \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).