Re: [PATCH 7/8] fuse: propagate default and file acls on creation

Darrick J. Wong
2025-09-16T14:48:58Z

On Tue, Sep 16, 2025 at 02:41:30PM +0800, Chen Linxuan wrote:
> On Tue, Sep 16, 2025 at 8:26 AM Darrick J. Wong <djwong@kernel.org> wrote:
> >
> > From: Darrick J. Wong <djwong@kernel.org>
> >
> > For local filesystems, propagate the default and file access ACLs to new
> > children when creating them, just like the other in-kernel local
> > filesystems.
> >
> > Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
> > ---
> > fs/fuse/fuse_i.h | 4 ++
> > fs/fuse/acl.c | 65 ++++++++++++++++++++++++++++++++++++++
> > fs/fuse/dir.c | 92 +++++++++++++++++++++++++++++++++++++++++-------------
> > 3 files changed, 138 insertions(+), 23 deletions(-)
> >
> >
<snip>
> > diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
> > index a7f47e43692f1c..b116e42431ee12 100644
> > --- a/fs/fuse/dir.c
> > +++ b/fs/fuse/dir.c
> > @@ -877,10 +905,13 @@ static int fuse_mknod(struct mnt_idmap *idmap, struct inode *dir,
> > {
> > struct fuse_mknod_in inarg;
> > struct fuse_mount *fm = get_fuse_mount(dir);
> > + struct posix_acl *default_acl, *acl;
> > FUSE_ARGS(args);
> > + int err;
> >
> > - if (!fm->fc->dont_mask)
> > - mode &= ~current_umask();
> > + err = fuse_acl_create(dir, &mode, &default_acl, &acl);
>
> Please excuse me if this is a dumb question.
> In this function (including fuse_mkdir and fuse_symlink),
> why can't we pair fuse_acl_create and posix_acl_release together
> within the same function,
> just like in fuse_create_open?

It seemed cleaner to have create_new_{entry,nondir} consume the two acl
arguments rather than have to change every callsite:

fuse_acl_create(...., &default_acl, &acl);

...

ret = create_new_nondir(..., default_acl, acl);
posix_acl_release(default_acl);
posix_acl_release(acl);
return ret;

since create_new_entry is really the bottom half of mknod, mkdir,
symlink, and link.

--D

> Thanks,
> Chen Linxuan
>
> > + if (err)
> > + return err;
> >
> > memset(&inarg, 0, sizeof(inarg));
> > inarg.mode = mode;
> > @@ -892,7 +923,8 @@ static int fuse_mknod(struct mnt_idmap *idmap, struct inode *dir,
> > args.in_args[0].value = &inarg;
> > args.in_args[1].size = entry->d_name.len + 1;
> > args.in_args[1].value = entry->d_name.name;
> > - return create_new_nondir(idmap, fm, &args, dir, entry, mode);
> > + return create_new_nondir(idmap, fm, &args, dir, entry, mode,
> > + default_acl, acl);
> > }
> >
> > static int fuse_create(struct mnt_idmap *idmap, struct inode *dir,
> > @@ -924,13 +956,17 @@ static struct dentry *fuse_mkdir(struct mnt_idmap *idmap, struct inode *dir,
> > {
> > struct fuse_mkdir_in inarg;
> > struct fuse_mount *fm = get_fuse_mount(dir);
> > + struct posix_acl *default_acl, *acl;
> > FUSE_ARGS(args);
> > + int err;
> >
> > - if (!fm->fc->dont_mask)
> > - mode &= ~current_umask();
> > + mode |= S_IFDIR; /* vfs doesn't set S_IFDIR for us */
> > + err = fuse_acl_create(dir, &mode, &default_acl, &acl);
> > + if (err)
> > + return ERR_PTR(err);
> >
> > memset(&inarg, 0, sizeof(inarg));
> > - inarg.mode = mode;
> > + inarg.mode = mode & ~S_IFDIR;
> > inarg.umask = current_umask();
> > args.opcode = FUSE_MKDIR;
> > args.in_numargs = 2;
> > @@ -938,7 +974,8 @@ static struct dentry *fuse_mkdir(struct mnt_idmap *idmap, struct inode *dir,
> > args.in_args[0].value = &inarg;
> > args.in_args[1].size = entry->d_name.len + 1;
> > args.in_args[1].value = entry->d_name.name;
> > - return create_new_entry(idmap, fm, &args, dir, entry, S_IFDIR);
> > + return create_new_entry(idmap, fm, &args, dir, entry, S_IFDIR,
> > + default_acl, acl);
> > }
> >
> > static int fuse_symlink(struct mnt_idmap *idmap, struct inode *dir,
> > @@ -946,7 +983,14 @@ static int fuse_symlink(struct mnt_idmap *idmap, struct inode *dir,
> > {
> > struct fuse_mount *fm = get_fuse_mount(dir);
> > unsigned len = strlen(link) + 1;
> > + struct posix_acl *default_acl, *acl;
> > + umode_t mode = S_IFLNK | 0777;
> > FUSE_ARGS(args);
> > + int err;
> > +
> > + err = fuse_acl_create(dir, &mode, &default_acl, &acl);
> > + if (err)
> > + return err;
> >
> > args.opcode = FUSE_SYMLINK;
> > args.in_numargs = 3;
> > @@ -955,7 +999,8 @@ static int fuse_symlink(struct mnt_idmap *idmap, struct inode *dir,
> > args.in_args[1].value = entry->d_name.name;
> > args.in_args[2].size = len;
> > args.in_args[2].value = link;
> > - return create_new_nondir(idmap, fm, &args, dir, entry, S_IFLNK);
> > + return create_new_nondir(idmap, fm, &args, dir, entry, S_IFLNK,
> > + default_acl, acl);
> > }
> >
> > void fuse_flush_time_update(struct inode *inode)
> > @@ -1155,7 +1200,8 @@ static int fuse_link(struct dentry *entry, struct inode *newdir,
> > args.in_args[0].value = &inarg;
> > args.in_args[1].size = newent->d_name.len + 1;
> > args.in_args[1].value = newent->d_name.name;
> > - err = create_new_nondir(&invalid_mnt_idmap, fm, &args, newdir, newent, inode->i_mode);
> > + err = create_new_nondir(&invalid_mnt_idmap, fm, &args, newdir, newent,
> > + inode->i_mode, NULL, NULL);
> > if (!err)
> > fuse_update_ctime_in_cache(inode);
> > else if (err == -EINTR)
> >
> >
> >
>