* [PATCH v1 00/17] Add NFSv4.2 POSIX ACL support
@ 2025-12-31 2:21 rick.macklem
2025-12-31 2:21 ` [PATCH v1 01/17] Add definitions for the POSIX draft ACL attributes rick.macklem
` (17 more replies)
0 siblings, 18 replies; 21+ messages in thread
From: rick.macklem @ 2025-12-31 2:21 UTC (permalink / raw)
To: linux-nfs; +Cc: Rick Macklem
From: Rick Macklem <rmacklem@uoguelph.ca>
The Internet draft "POSIX Draft ACL support for
Network File System Version 4, Minor Version2"
https://datatracker.ietf.org/doc/draft-ietf-nfsv4-posix-acls/
describes an extension to NFSv4.2 so that POSIX
draft ACLs can get acquired and set directly,
without using the loosey NFSv4->POSIX draft mapping
algorith. It extends the protocol with four new
attributes.
This patch series implements the server side of
this extension for the knfsd. It is analogous
to the NFSACL protocol used as a sideband protocol
for NFSv3 and allows the ACLs to be acquired/set
be getfacl(1)/setfacl(1).
The current implementation does not support the
"per file" scope, where individual file objects
store/use either an NFSv4 ACL or POSIX draft ACL
and assumes POSIX draft ACLs are supported for an
entire file system, if support for POSIX draft ACLs
is indicated.
Rick Macklem (17):
Add definitions for the POSIX draft ACL attributes
Add a new function to acquire the POSIX draft ACLs
Add a function to set POSIX ACLs
Add support for encoding/decoding POSIX draft ACLs
Add a check for both POSIX and NFSv4 ACLs being set
Add na_dpaclerr and na_paclerr for file creation
Add support for POSIX draft ACLs for file creation
Add the arguments for decoding of POSIX ACLs
Fix a couple of bugs in POSIX ACL decoding
Improve correctness for the ACL_TRUEFORM attribute
Make sort_pacl_range() global
Call sort_pacl_range() for decoded POSIX draft ACLs
Fix handling of POSIX ACLs with zero ACEs
Fix handling of zero length ACLs for file creation
Do not allow (N)VERIFY to check POSIX ACL attributes
Set the POSIX ACL attributes supported
Change a bunch of function prefixes to nfsd42_
fs/nfsd/acl.h | 3 +
fs/nfsd/nfs4acl.c | 35 ++++-
fs/nfsd/nfs4proc.c | 126 +++++++++++++++--
fs/nfsd/nfs4xdr.c | 312 ++++++++++++++++++++++++++++++++++++++++++-
fs/nfsd/nfsd.h | 8 +-
fs/nfsd/vfs.c | 34 ++++-
fs/nfsd/vfs.h | 2 +
fs/nfsd/xdr4.h | 6 +
include/linux/nfs4.h | 37 +++++
9 files changed, 536 insertions(+), 27 deletions(-)
--
2.49.0
^ permalink raw reply [flat|nested] 21+ messages in thread
* [PATCH v1 01/17] Add definitions for the POSIX draft ACL attributes
2025-12-31 2:21 [PATCH v1 00/17] Add NFSv4.2 POSIX ACL support rick.macklem
@ 2025-12-31 2:21 ` rick.macklem
2025-12-31 2:21 ` [PATCH v1 02/17] Add a new function to acquire the POSIX draft ACLs rick.macklem
` (16 subsequent siblings)
17 siblings, 0 replies; 21+ messages in thread
From: rick.macklem @ 2025-12-31 2:21 UTC (permalink / raw)
To: linux-nfs; +Cc: Rick Macklem
From: Rick Macklem <rmacklem@uoguelph.ca>
The draft defines four new attributes as an extension to
NFSv4.2. This patch adds definitions of these four attributes
to the nfs4.h file.
Signed-off-by: Rick Macklem <rmacklem@uoguelph.ca>
---
include/linux/nfs4.h | 37 +++++++++++++++++++++++++++++++++++++
1 file changed, 37 insertions(+)
diff --git a/include/linux/nfs4.h b/include/linux/nfs4.h
index e947af6a3684..9d70a5e6a8d0 100644
--- a/include/linux/nfs4.h
+++ b/include/linux/nfs4.h
@@ -516,6 +516,39 @@ enum {
FATTR4_XATTR_SUPPORT = 82,
};
+/*
+ * Symbol names and values are from draft-rmacklem-nfsv4-posix-acls
+ * "POSIX Draft ACL support for Network File System Version 4, Minor version 2"
+ * Section 10.
+ */
+enum {
+ ACL_MODEL_NFS4 = 1,
+ ACL_MODEL_POSIX_DRAFT = 2,
+ ACL_MODEL_NONE = 3,
+};
+
+enum {
+ ACL_SCOPE_FILE_OBJECT = 1,
+ ACL_SCOPE_FILE_SYSTEM = 2,
+ ACL_SCOPE_SERVER = 3,
+};
+
+enum {
+ POSIXACE4_TAG_USER_OBJ = 1,
+ POSIXACE4_TAG_USER = 2,
+ POSIXACE4_TAG_GROUP_OBJ = 3,
+ POSIXACE4_TAG_GROUP = 4,
+ POSIXACE4_TAG_MASK = 5,
+ POSIXACE4_TAG_OTHER = 6,
+};
+
+enum {
+ FATTR4_ACL_TRUEFORM = 89,
+ FATTR4_ACL_TRUEFORM_SCOPE = 90,
+ FATTR4_POSIX_DEFAULT_ACL = 91,
+ FATTR4_POSIX_ACCESS_ACL = 92,
+};
+
/*
* The following internal definitions enable processing the above
* attribute bits within 32-bit word boundaries.
@@ -598,6 +631,10 @@ enum {
#define FATTR4_WORD2_TIME_DELEG_ACCESS BIT(FATTR4_TIME_DELEG_ACCESS - 64)
#define FATTR4_WORD2_TIME_DELEG_MODIFY BIT(FATTR4_TIME_DELEG_MODIFY - 64)
#define FATTR4_WORD2_OPEN_ARGUMENTS BIT(FATTR4_OPEN_ARGUMENTS - 64)
+#define FATTR4_WORD2_ACL_TRUEFORM BIT(FATTR4_ACL_TRUEFORM - 64)
+#define FATTR4_WORD2_ACL_TRUEFORM_SCOPE BIT(FATTR4_ACL_TRUEFORM_SCOPE - 64)
+#define FATTR4_WORD2_POSIX_DEFAULT_ACL BIT(FATTR4_POSIX_DEFAULT_ACL - 64)
+#define FATTR4_WORD2_POSIX_ACCESS_ACL BIT(FATTR4_POSIX_ACCESS_ACL - 64)
/* MDS threshold bitmap bits */
#define THRESHOLD_RD (1UL << 0)
--
2.49.0
^ permalink raw reply related [flat|nested] 21+ messages in thread
* [PATCH v1 02/17] Add a new function to acquire the POSIX draft ACLs
2025-12-31 2:21 [PATCH v1 00/17] Add NFSv4.2 POSIX ACL support rick.macklem
2025-12-31 2:21 ` [PATCH v1 01/17] Add definitions for the POSIX draft ACL attributes rick.macklem
@ 2025-12-31 2:21 ` rick.macklem
2025-12-31 2:21 ` [PATCH v1 03/17] Add a function to set POSIX ACLs rick.macklem
` (15 subsequent siblings)
17 siblings, 0 replies; 21+ messages in thread
From: rick.macklem @ 2025-12-31 2:21 UTC (permalink / raw)
To: linux-nfs; +Cc: Rick Macklem
From: Rick Macklem <rmacklem@uoguelph.ca>
This patch adds a function called nfsd4_get_posix_acl(),
which acquires the POSIX draft ACLs for a file. It
acquires a POSIX draft access ACL based on the file's
mode, if no POSIX draft ACL exists for the file.
Signed-off-by: Rick Macklem <rmacklem@uoguelph.ca>
---
fs/nfsd/acl.h | 2 ++
fs/nfsd/nfs4acl.c | 33 +++++++++++++++++++++++++++++++++
2 files changed, 35 insertions(+)
diff --git a/fs/nfsd/acl.h b/fs/nfsd/acl.h
index 4b7324458a94..213774cebeeb 100644
--- a/fs/nfsd/acl.h
+++ b/fs/nfsd/acl.h
@@ -47,6 +47,8 @@ __be32 nfs4_acl_write_who(struct xdr_stream *xdr, int who);
int nfsd4_get_nfs4_acl(struct svc_rqst *rqstp, struct dentry *dentry,
struct nfs4_acl **acl);
+int nfsd4_get_posix_acl(struct svc_rqst *rqstp, struct dentry *dentry,
+ struct posix_acl **pacl_ret, struct posix_acl **dpacl_ret);
__be32 nfsd4_acl_to_attr(enum nfs_ftype4 type, struct nfs4_acl *acl,
struct nfsd_attrs *attr);
diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c
index 936ea1ad9586..0a184b345f8c 100644
--- a/fs/nfsd/nfs4acl.c
+++ b/fs/nfsd/nfs4acl.c
@@ -176,6 +176,39 @@ nfsd4_get_nfs4_acl(struct svc_rqst *rqstp, struct dentry *dentry,
return error;
}
+int
+nfsd4_get_posix_acl(struct svc_rqst *rqstp, struct dentry *dentry,
+ struct posix_acl **pacl_ret, struct posix_acl **dpacl_ret)
+{
+ struct inode *inode = d_inode(dentry);
+ int error = 0;
+ struct posix_acl *pacl = NULL, *dpacl = NULL;
+
+ *pacl_ret = NULL;
+ *dpacl_ret = NULL;
+ pacl = get_inode_acl(inode, ACL_TYPE_ACCESS);
+ if (!pacl)
+ pacl = posix_acl_from_mode(inode->i_mode, GFP_KERNEL);
+
+ if (IS_ERR(pacl))
+ return PTR_ERR(pacl);
+
+ *pacl_ret = pacl;
+
+ if (S_ISDIR(inode->i_mode)) {
+ dpacl = get_inode_acl(inode, ACL_TYPE_DEFAULT);
+ if (IS_ERR(dpacl)) {
+ error = PTR_ERR(dpacl);
+ goto out;
+ }
+
+ *dpacl_ret = dpacl;
+ }
+
+out:
+ return error;
+}
+
struct posix_acl_summary {
unsigned short owner;
unsigned short users;
--
2.49.0
^ permalink raw reply related [flat|nested] 21+ messages in thread
* [PATCH v1 03/17] Add a function to set POSIX ACLs
2025-12-31 2:21 [PATCH v1 00/17] Add NFSv4.2 POSIX ACL support rick.macklem
2025-12-31 2:21 ` [PATCH v1 01/17] Add definitions for the POSIX draft ACL attributes rick.macklem
2025-12-31 2:21 ` [PATCH v1 02/17] Add a new function to acquire the POSIX draft ACLs rick.macklem
@ 2025-12-31 2:21 ` rick.macklem
2025-12-31 2:21 ` [PATCH v1 04/17] Add support for encoding/decoding POSIX draft ACLs rick.macklem
` (14 subsequent siblings)
17 siblings, 0 replies; 21+ messages in thread
From: rick.macklem @ 2025-12-31 2:21 UTC (permalink / raw)
To: linux-nfs; +Cc: Rick Macklem
From: Rick Macklem <rmacklem@uoguelph.ca>
This patch adds the function that sets a POSIX draft ACL
called nfsd4_proc_setacl() and calls it from nfsd4_setattr()
to set the POSIX draft ACLs when a SETATTR of the new
POSIX draft ACL attributes is done by a NFSv4.2 client.
Signed-off-by: Rick Macklem <rmacklem@uoguelph.ca>
---
fs/nfsd/nfs4proc.c | 32 ++++++++++++++++++++++++++++++++
fs/nfsd/xdr4.h | 2 ++
2 files changed, 34 insertions(+)
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 2b805fc51262..b92477c87db1 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1162,6 +1162,31 @@ vet_deleg_attrs(struct nfsd4_setattr *setattr, struct nfs4_delegation *dp)
}
}
+/*
+ * Set the Access and/or Default ACL of a file.
+ */
+static __be32
+nfsd4_proc_setacl(struct svc_rqst *rqstp, svc_fh *fh, struct inode *inode,
+ struct posix_acl *dpacl, struct posix_acl *pacl)
+{
+ int error = 0;
+
+ if (dpacl == NULL && pacl == NULL)
+ return nfs_ok;
+
+ inode_lock(inode);
+
+ if (dpacl != NULL)
+ error = set_posix_acl(&nop_mnt_idmap, fh->fh_dentry,
+ ACL_TYPE_DEFAULT, dpacl);
+ if (!error && pacl != NULL)
+ error = set_posix_acl(&nop_mnt_idmap, fh->fh_dentry,
+ ACL_TYPE_ACCESS, pacl);
+
+ inode_unlock(inode);
+ return nfserrno(error);
+}
+
static __be32
nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
union nfsd4_op_u *u)
@@ -1229,11 +1254,18 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
cstate->current_fh.fh_no_wcc = true;
status = nfsd_setattr(rqstp, &cstate->current_fh, &attrs, NULL);
cstate->current_fh.fh_no_wcc = save_no_wcc;
+ if (!status && (setattr->sa_dpacl != NULL || setattr->sa_pacl != NULL))
+ status = nfsd4_proc_setacl(rqstp, &cstate->current_fh, inode,
+ setattr->sa_dpacl, setattr->sa_pacl);
if (!status)
status = nfserrno(attrs.na_labelerr);
if (!status)
status = nfserrno(attrs.na_aclerr);
out:
+ if (setattr->sa_dpacl != NULL)
+ posix_acl_release(setattr->sa_dpacl);
+ if (setattr->sa_pacl != NULL)
+ posix_acl_release(setattr->sa_pacl);
nfsd_attrs_free(&attrs);
fh_drop_write(&cstate->current_fh);
return status;
diff --git a/fs/nfsd/xdr4.h b/fs/nfsd/xdr4.h
index ae75846b3cd7..eebbcc579c31 100644
--- a/fs/nfsd/xdr4.h
+++ b/fs/nfsd/xdr4.h
@@ -483,6 +483,8 @@ struct nfsd4_setattr {
struct iattr sa_iattr; /* request */
struct nfs4_acl *sa_acl;
struct xdr_netobj sa_label;
+ struct posix_acl *sa_dpacl;
+ struct posix_acl *sa_pacl;
};
struct nfsd4_setclientid {
--
2.49.0
^ permalink raw reply related [flat|nested] 21+ messages in thread
* [PATCH v1 04/17] Add support for encoding/decoding POSIX draft ACLs
2025-12-31 2:21 [PATCH v1 00/17] Add NFSv4.2 POSIX ACL support rick.macklem
` (2 preceding siblings ...)
2025-12-31 2:21 ` [PATCH v1 03/17] Add a function to set POSIX ACLs rick.macklem
@ 2025-12-31 2:21 ` rick.macklem
2025-12-31 2:21 ` [PATCH v1 05/17] Add a check for both POSIX and NFSv4 ACLs being set rick.macklem
` (13 subsequent siblings)
17 siblings, 0 replies; 21+ messages in thread
From: rick.macklem @ 2025-12-31 2:21 UTC (permalink / raw)
To: linux-nfs; +Cc: Rick Macklem
From: Rick Macklem <rmacklem@uoguelph.ca>
This patch adds encoding/decoding of the new attributes described
by the internet draft "POSIX Draft ACL support for Network
File System Version 4, Minor Version 2".
Signed-off-by: Rick Macklem <rmacklem@uoguelph.ca>
---
fs/nfsd/nfs4xdr.c | 292 +++++++++++++++++++++++++++++++++++++++++++++-
1 file changed, 287 insertions(+), 5 deletions(-)
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 5065727204b9..5f996b3a4ce4 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -43,6 +43,7 @@
#include <linux/sunrpc/addr.h>
#include <linux/xattr.h>
#include <linux/vmalloc.h>
+#include <linux/nfsacl.h>
#include <uapi/linux/xattr.h>
@@ -377,16 +378,123 @@ nfsd4_decode_security_label(struct nfsd4_compoundargs *argp,
return nfs_ok;
}
+static __be32
+nfsacl4_posix_xdrtotag(struct xdr_stream *xdr, u32 *tag)
+{
+ u32 type;
+
+ if (xdr_stream_decode_u32(xdr, &type) < 0)
+ return nfserr_bad_xdr;
+ switch(type) {
+ case POSIXACE4_TAG_USER_OBJ:
+ *tag = ACL_USER_OBJ;
+ break;
+ case POSIXACE4_TAG_GROUP_OBJ:
+ *tag = ACL_GROUP_OBJ;
+ break;
+ case POSIXACE4_TAG_USER:
+ *tag = ACL_USER;
+ break;
+ case POSIXACE4_TAG_GROUP:
+ *tag = ACL_GROUP;
+ break;
+ case POSIXACE4_TAG_MASK:
+ *tag = ACL_MASK;
+ break;
+ case POSIXACE4_TAG_OTHER:
+ *tag = ACL_OTHER;
+ break;
+ default:
+ return nfserr_bad_xdr;
+ }
+ return nfs_ok;
+}
+
+static __be32
+nfsd4_decode_posixace4(struct nfsd4_compoundargs *argp,
+ struct posix_acl_entry *ace)
+{
+ u32 val;
+ __be32 *p, status;
+
+ status = nfsacl4_posix_xdrtotag(argp->xdr, &val);
+ if (status != nfs_ok)
+ return status;
+ ace->e_tag = val;
+ if (xdr_stream_decode_u32(argp->xdr, &val) < 0)
+ return nfserr_bad_xdr;
+ if (val & ~S_IRWXO)
+ return nfserr_bad_xdr;
+ ace->e_perm = val;
+
+ if (xdr_stream_decode_u32(argp->xdr, &val) < 0)
+ return nfserr_bad_xdr;
+ p = xdr_inline_decode(argp->xdr, val);
+ if (!p)
+ return nfserr_bad_xdr;
+ switch(ace->e_tag) {
+ case ACL_USER:
+ status = nfsd_map_name_to_uid(argp->rqstp,
+ (char *)p, val, &ace->e_uid);
+ break;
+ case ACL_GROUP:
+ status = nfsd_map_name_to_gid(argp->rqstp,
+ (char *)p, val, &ace->e_gid);
+ }
+
+ return status;
+}
+
+static noinline __be32
+nfsd4_decode_posix_acl(struct nfsd4_compoundargs *argp, struct posix_acl **acl)
+{
+ struct posix_acl_entry *ace;
+ __be32 status;
+ u32 count;
+
+ if (xdr_stream_decode_u32(argp->xdr, &count) < 0)
+ return nfserr_bad_xdr;
+
+ if (count > xdr_stream_remaining(argp->xdr) / 16)
+ /*
+ * Even with 4-byte names there wouldn't be
+ * space for that many aces; something fishy is
+ * going on:
+ */
+ return nfserr_fbig;
+
+ *acl = posix_acl_alloc(count, GFP_NOFS);
+ if (*acl == NULL)
+ return nfserr_resource;
+
+ (*acl)->a_count = count;
+ for (ace = (*acl)->a_entries; ace < (*acl)->a_entries + count; ace++) {
+ status = nfsd4_decode_posixace4(argp, ace);
+ if (status) {
+ posix_acl_release(*acl);
+ *acl = NULL;
+ return status;
+ }
+ }
+
+ return nfs_ok;
+}
+
static __be32
nfsd4_decode_fattr4(struct nfsd4_compoundargs *argp, u32 *bmval, u32 bmlen,
struct iattr *iattr, struct nfs4_acl **acl,
- struct xdr_netobj *label, int *umask)
+ struct xdr_netobj *label, int *umask,
+ struct posix_acl **dpaclp, struct posix_acl **paclp)
{
unsigned int starting_pos;
u32 attrlist4_count;
__be32 *p, status;
iattr->ia_valid = 0;
+ if (dpaclp)
+ *dpaclp = NULL;
+ if (paclp)
+ *paclp = NULL;
status = nfsd4_decode_bitmap4(argp, bmval, bmlen);
if (status)
return nfserr_bad_xdr;
@@ -542,6 +650,28 @@ nfsd4_decode_fattr4(struct nfsd4_compoundargs *argp, u32 *bmval, u32 bmlen,
iattr->ia_valid |= ATTR_CTIME | ATTR_CTIME_SET |
ATTR_MTIME | ATTR_MTIME_SET | ATTR_DELEG;
}
+ if (bmval[2] & FATTR4_WORD2_POSIX_DEFAULT_ACL) {
+ struct posix_acl *dpacl;
+
+ status = nfsd4_decode_posix_acl(argp, &dpacl);
+ if (status)
+ return status;
+ if (dpaclp)
+ *dpaclp = dpacl;
+ else
+ posix_acl_release(dpacl);
+ }
+ if (bmval[2] & FATTR4_WORD2_POSIX_ACCESS_ACL) {
+ struct posix_acl *pacl;
+
+ status = nfsd4_decode_posix_acl(argp, &pacl);
+ if (status)
+ return status;
+ if (paclp)
+ *paclp = pacl;
+ else
+ posix_acl_release(pacl);
+ }
/* request sanity: did attrlist4 contain the expected number of words? */
if (attrlist4_count != xdr_stream_pos(argp->xdr) - starting_pos)
@@ -849,7 +979,8 @@ nfsd4_decode_create(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u)
status = nfsd4_decode_fattr4(argp, create->cr_bmval,
ARRAY_SIZE(create->cr_bmval),
&create->cr_iattr, &create->cr_acl,
- &create->cr_label, &create->cr_umask);
+ &create->cr_label, &create->cr_umask,
+ NULL, NULL);
if (status)
return status;
@@ -1000,7 +1131,8 @@ nfsd4_decode_createhow4(struct nfsd4_compoundargs *argp, struct nfsd4_open *open
status = nfsd4_decode_fattr4(argp, open->op_bmval,
ARRAY_SIZE(open->op_bmval),
&open->op_iattr, &open->op_acl,
- &open->op_label, &open->op_umask);
+ &open->op_label, &open->op_umask,
+ NULL, NULL);
if (status)
return status;
break;
@@ -1018,7 +1150,8 @@ nfsd4_decode_createhow4(struct nfsd4_compoundargs *argp, struct nfsd4_open *open
status = nfsd4_decode_fattr4(argp, open->op_bmval,
ARRAY_SIZE(open->op_bmval),
&open->op_iattr, &open->op_acl,
- &open->op_label, &open->op_umask);
+ &open->op_label, &open->op_umask,
+ NULL, NULL);
if (status)
return status;
break;
@@ -1345,7 +1478,8 @@ nfsd4_decode_setattr(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u)
return nfsd4_decode_fattr4(argp, setattr->sa_bmval,
ARRAY_SIZE(setattr->sa_bmval),
&setattr->sa_iattr, &setattr->sa_acl,
- &setattr->sa_label, NULL);
+ &setattr->sa_label, NULL, &setattr->sa_dpacl,
+ &setattr->sa_pacl);
}
static __be32
@@ -2930,6 +3064,8 @@ struct nfsd4_fattr_args {
#ifdef CONFIG_NFSD_V4_SECURITY_LABEL
struct lsm_context context;
#endif
+ struct posix_acl *dpacl;
+ struct posix_acl *pacl;
u32 rdattr_err;
bool contextsupport;
bool ignore_crossmnt;
@@ -3470,6 +3606,128 @@ static __be32 nfsd4_encode_fattr4_open_arguments(struct xdr_stream *xdr,
return nfs_ok;
}
+static __be32 nfsd4_encode_fattr4_acl_trueform(struct xdr_stream *xdr,
+ const struct nfsd4_fattr_args *args)
+{
+
+ return nfsd4_encode_uint32_t(xdr, ACL_MODEL_POSIX_DRAFT);
+}
+
+static __be32 nfsd4_encode_fattr4_acl_trueform_scope(struct xdr_stream *xdr,
+ const struct nfsd4_fattr_args *args)
+{
+
+ return nfsd4_encode_uint32_t(xdr, ACL_SCOPE_FILE_SYSTEM);
+}
+
+static int nfsacl4_posix_tagtotype(u32 tag)
+{
+ int type;
+
+ switch(tag) {
+ case ACL_USER_OBJ:
+ type = POSIXACE4_TAG_USER_OBJ;
+ break;
+ case ACL_GROUP_OBJ:
+ type = POSIXACE4_TAG_GROUP_OBJ;
+ break;
+ case ACL_USER:
+ type = POSIXACE4_TAG_USER;
+ break;
+ case ACL_GROUP:
+ type = POSIXACE4_TAG_GROUP;
+ break;
+ case ACL_MASK:
+ type = POSIXACE4_TAG_MASK;
+ break;
+ case ACL_OTHER:
+ type = POSIXACE4_TAG_OTHER;
+ break;
+ default:
+ return -EINVAL;
+ }
+ return type;
+}
+
+static __be32 xdr_nfs4ace_stream_encode(struct xdr_stream *xdr,
+ struct svc_rqst *rqstp,
+ struct posix_acl_entry *acep)
+{
+ __be32 status;
+ int type;
+
+ type = nfsacl4_posix_tagtotype(acep->e_tag);
+ if (type < 0)
+ return nfserr_resource;
+ if (xdr_stream_encode_u32(xdr, type) != XDR_UNIT)
+ return nfserr_resource;
+ if (xdr_stream_encode_u32(xdr, acep->e_perm) != XDR_UNIT)
+ return nfserr_resource;
+ switch(acep->e_tag) {
+ case ACL_USER_OBJ:
+ case ACL_GROUP_OBJ:
+ case ACL_MASK:
+ case ACL_OTHER:
+ if (xdr_stream_encode_u32(xdr, 0) != XDR_UNIT)
+ return nfserr_resource;
+ break;
+ case ACL_USER:
+ status = nfsd4_encode_user(xdr, rqstp, acep->e_uid);
+ if (status != nfs_ok)
+ return status;
+ break;
+ case ACL_GROUP:
+ status = nfsd4_encode_group(xdr, rqstp, acep->e_gid);
+ if (status != nfs_ok)
+ return status;
+ break;
+ default:
+ return nfserr_resource;
+ }
+ return nfs_ok;
+}
+
+static __be32 encode_stream_posixacl(struct xdr_stream *xdr,
+ struct posix_acl *acl,
+ struct svc_rqst *rqstp)
+{
+ __be32 status;
+ int cnt;
+
+ if (acl == NULL) {
+ if (xdr_stream_encode_u32(xdr, 0) != XDR_UNIT)
+ return nfserr_resource;
+ return nfs_ok;
+ }
+ if (acl->a_count > NFS_ACL_MAX_ENTRIES)
+ return nfserr_resource;
+ if (xdr_stream_encode_u32(xdr, acl->a_count) != XDR_UNIT)
+ return nfserr_resource;
+
+ for (cnt = 0; cnt < acl->a_count; cnt++) {
+ status = xdr_nfs4ace_stream_encode(xdr, rqstp,
+ &acl->a_entries[cnt]);
+ if (status != nfs_ok)
+ return status;
+ }
+
+ return nfs_ok;
+}
+
+static __be32 nfsd4_encode_fattr4_posix_default_acl(struct xdr_stream *xdr,
+ const struct nfsd4_fattr_args *args)
+{
+
+ return encode_stream_posixacl(xdr, args->dpacl, args->rqstp);
+}
+
+static __be32 nfsd4_encode_fattr4_posix_access_acl(struct xdr_stream *xdr,
+ const struct nfsd4_fattr_args *args)
+{
+
+ return encode_stream_posixacl(xdr, args->pacl, args->rqstp);
+}
+
static const nfsd4_enc_attr nfsd4_enc_fattr4_encode_ops[] = {
[FATTR4_SUPPORTED_ATTRS] = nfsd4_encode_fattr4_supported_attrs,
[FATTR4_TYPE] = nfsd4_encode_fattr4_type,
@@ -3573,6 +3831,10 @@ static const nfsd4_enc_attr nfsd4_enc_fattr4_encode_ops[] = {
[FATTR4_TIME_DELEG_ACCESS] = nfsd4_encode_fattr4__inval,
[FATTR4_TIME_DELEG_MODIFY] = nfsd4_encode_fattr4__inval,
[FATTR4_OPEN_ARGUMENTS] = nfsd4_encode_fattr4_open_arguments,
+ [FATTR4_ACL_TRUEFORM] = nfsd4_encode_fattr4_acl_trueform,
+ [FATTR4_ACL_TRUEFORM_SCOPE] = nfsd4_encode_fattr4_acl_trueform_scope,
+ [FATTR4_POSIX_DEFAULT_ACL] = nfsd4_encode_fattr4_posix_default_acl,
+ [FATTR4_POSIX_ACCESS_ACL] = nfsd4_encode_fattr4_posix_access_acl,
};
/*
@@ -3610,6 +3872,8 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr,
args.dentry = dentry;
args.ignore_crossmnt = (ignore_crossmnt != 0);
args.acl = NULL;
+ args.pacl = NULL;
+ args.dpacl = NULL;
#ifdef CONFIG_NFSD_V4_SECURITY_LABEL
args.context.context = NULL;
#endif
@@ -3699,6 +3963,20 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr,
goto out_nfserr;
}
+ if (attrmask[2] & (FATTR4_WORD2_POSIX_DEFAULT_ACL |
+ FATTR4_WORD2_POSIX_ACCESS_ACL)) {
+ err = nfsd4_get_posix_acl(rqstp, dentry, &args.pacl,
+ &args.dpacl);
+ if (err == -EOPNOTSUPP)
+ attrmask[2] &= ~(FATTR4_WORD2_POSIX_DEFAULT_ACL |
+ FATTR4_WORD2_POSIX_ACCESS_ACL);
+ else if (err == -EINVAL) {
+ status = nfserr_attrnotsupp;
+ goto out;
+ } else if (err != 0)
+ goto out_nfserr;
+ }
+
args.contextsupport = false;
#ifdef CONFIG_NFSD_V4_SECURITY_LABEL
@@ -3747,6 +4025,10 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr,
security_release_secctx(&args.context);
#endif /* CONFIG_NFSD_V4_SECURITY_LABEL */
kfree(args.acl);
+ if (args.pacl)
+ posix_acl_release(args.pacl);
+ if (args.dpacl)
+ posix_acl_release(args.dpacl);
if (tempfh) {
fh_put(tempfh);
kfree(tempfh);
--
2.49.0
^ permalink raw reply related [flat|nested] 21+ messages in thread
* [PATCH v1 05/17] Add a check for both POSIX and NFSv4 ACLs being set
2025-12-31 2:21 [PATCH v1 00/17] Add NFSv4.2 POSIX ACL support rick.macklem
` (3 preceding siblings ...)
2025-12-31 2:21 ` [PATCH v1 04/17] Add support for encoding/decoding POSIX draft ACLs rick.macklem
@ 2025-12-31 2:21 ` rick.macklem
2025-12-31 2:21 ` [PATCH v1 06/17] Add na_dpaclerr and na_paclerr for file creation rick.macklem
` (12 subsequent siblings)
17 siblings, 0 replies; 21+ messages in thread
From: rick.macklem @ 2025-12-31 2:21 UTC (permalink / raw)
To: linux-nfs; +Cc: Rick Macklem
From: Rick Macklem <rmacklem@uoguelph.ca>
Check that both POSIX and NFSv4 ACLs are not being set by
the same SETATTR.
While here, fix posix_acl_release() for a couple of error cases
by adding a new out_err label, so the POSIX ACLs are released
before returning status. Note that posix_acl_release() checks
for a NULL argument and just returns for that case.
Signed-off-by: Rick Macklem <rmacklem@uoguelph.ca>
---
fs/nfsd/nfs4proc.c | 22 ++++++++++++++--------
1 file changed, 14 insertions(+), 8 deletions(-)
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index b92477c87db1..71e9749375c1 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1215,7 +1215,7 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
&cstate->current_fh, &setattr->sa_stateid,
flags, NULL, &st);
if (status)
- return status;
+ goto out_err;
}
if (deleg_attrs) {
@@ -1233,17 +1233,24 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
if (st)
nfs4_put_stid(st);
if (status)
- return status;
+ goto out_err;
err = fh_want_write(&cstate->current_fh);
- if (err)
- return nfserrno(err);
+ if (err) {
+ status = nfserrno(err);
+ goto out_err;
+ }
status = nfs_ok;
status = check_attr_support(cstate, setattr->sa_bmval, nfsd_attrmask);
if (status)
goto out;
+ if (setattr->sa_acl && (setattr->sa_dpacl || setattr->sa_pacl)) {
+ status = nfserr_inval;
+ goto out;
+ }
+
inode = cstate->current_fh.fh_dentry->d_inode;
status = nfsd4_acl_to_attr(S_ISDIR(inode->i_mode) ? NF4DIR : NF4REG,
setattr->sa_acl, &attrs);
@@ -1262,12 +1269,11 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
if (!status)
status = nfserrno(attrs.na_aclerr);
out:
- if (setattr->sa_dpacl != NULL)
- posix_acl_release(setattr->sa_dpacl);
- if (setattr->sa_pacl != NULL)
- posix_acl_release(setattr->sa_pacl);
nfsd_attrs_free(&attrs);
fh_drop_write(&cstate->current_fh);
+out_err:
+ posix_acl_release(setattr->sa_dpacl);
+ posix_acl_release(setattr->sa_pacl);
return status;
}
--
2.49.0
^ permalink raw reply related [flat|nested] 21+ messages in thread
* [PATCH v1 06/17] Add na_dpaclerr and na_paclerr for file creation
2025-12-31 2:21 [PATCH v1 00/17] Add NFSv4.2 POSIX ACL support rick.macklem
` (4 preceding siblings ...)
2025-12-31 2:21 ` [PATCH v1 05/17] Add a check for both POSIX and NFSv4 ACLs being set rick.macklem
@ 2025-12-31 2:21 ` rick.macklem
2025-12-31 2:21 ` [PATCH v1 07/17] Add support for POSIX draft ACLs " rick.macklem
` (11 subsequent siblings)
17 siblings, 0 replies; 21+ messages in thread
From: rick.macklem @ 2025-12-31 2:21 UTC (permalink / raw)
To: linux-nfs; +Cc: Rick Macklem
From: Rick Macklem <rmacklem@uoguelph.ca>
When new file objects are created, a client might choose to specify
POSIX draft ACLs for it. If the set_posix_acl() fails, note the
failure in these fields. The file object has already been created,
so the creation cannot now fail, but the attribute bits can be cleared
in the reply.
Signed-off-by: Rick Macklem <rmacklem@uoguelph.ca>
---
fs/nfsd/vfs.c | 6 +++---
fs/nfsd/vfs.h | 2 ++
2 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 168d3ccc8155..146483bf8a65 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -597,12 +597,12 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp,
attr->na_labelerr = security_inode_setsecctx(dentry,
attr->na_seclabel->data, attr->na_seclabel->len);
if (IS_ENABLED(CONFIG_FS_POSIX_ACL) && attr->na_pacl)
- attr->na_aclerr = set_posix_acl(&nop_mnt_idmap,
+ attr->na_paclerr = set_posix_acl(&nop_mnt_idmap,
dentry, ACL_TYPE_ACCESS,
attr->na_pacl);
if (IS_ENABLED(CONFIG_FS_POSIX_ACL) &&
- !attr->na_aclerr && attr->na_dpacl && S_ISDIR(inode->i_mode))
- attr->na_aclerr = set_posix_acl(&nop_mnt_idmap,
+ attr->na_dpacl && S_ISDIR(inode->i_mode))
+ attr->na_dpaclerr = set_posix_acl(&nop_mnt_idmap,
dentry, ACL_TYPE_DEFAULT,
attr->na_dpacl);
out_fill_attrs:
diff --git a/fs/nfsd/vfs.h b/fs/nfsd/vfs.h
index e192dca4a679..26c4b396558a 100644
--- a/fs/nfsd/vfs.h
+++ b/fs/nfsd/vfs.h
@@ -54,6 +54,8 @@ struct nfsd_attrs {
int na_labelerr; /* output */
int na_aclerr; /* output */
+ int na_dpaclerr; /* output */
+ int na_paclerr; /* output */
};
static inline void nfsd_attrs_free(struct nfsd_attrs *attrs)
--
2.49.0
^ permalink raw reply related [flat|nested] 21+ messages in thread
* [PATCH v1 07/17] Add support for POSIX draft ACLs for file creation
2025-12-31 2:21 [PATCH v1 00/17] Add NFSv4.2 POSIX ACL support rick.macklem
` (5 preceding siblings ...)
2025-12-31 2:21 ` [PATCH v1 06/17] Add na_dpaclerr and na_paclerr for file creation rick.macklem
@ 2025-12-31 2:21 ` rick.macklem
2025-12-31 2:21 ` [PATCH v1 08/17] Add the arguments for decoding of POSIX ACLs rick.macklem
` (10 subsequent siblings)
17 siblings, 0 replies; 21+ messages in thread
From: rick.macklem @ 2025-12-31 2:21 UTC (permalink / raw)
To: linux-nfs; +Cc: Rick Macklem
From: Rick Macklem <rmacklem@uoguelph.ca>
For NFSv4.2 file object creation, a client may specify POSIX
draft ACLs for the file object. This patch adds support to
handle these POSIX draft ACLs.
Signed-off-by: Rick Macklem <rmacklem@uoguelph.ca>
---
fs/nfsd/nfs4proc.c | 57 ++++++++++++++++++++++++++++++++++++++--------
fs/nfsd/xdr4.h | 4 ++++
2 files changed, 52 insertions(+), 9 deletions(-)
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 71e9749375c1..a172bd253086 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -91,6 +91,10 @@ check_attr_support(struct nfsd4_compound_state *cstate, u32 *bmval,
return nfserr_attrnotsupp;
if ((bmval[0] & FATTR4_WORD0_ACL) && !IS_POSIXACL(d_inode(dentry)))
return nfserr_attrnotsupp;
+ if ((bmval[2] & (FATTR4_WORD2_POSIX_DEFAULT_ACL |
+ FATTR4_WORD2_POSIX_ACCESS_ACL)) &&
+ !IS_POSIXACL(d_inode(dentry)))
+ return nfserr_attrnotsupp;
if ((bmval[2] & FATTR4_WORD2_SECURITY_LABEL) &&
!(exp->ex_flags & NFSEXP_SECURITY_LABEL))
return nfserr_attrnotsupp;
@@ -265,8 +269,18 @@ nfsd4_create_file(struct svc_rqst *rqstp, struct svc_fh *fhp,
if (host_err)
return nfserrno(host_err);
- if (is_create_with_attrs(open))
- nfsd4_acl_to_attr(NF4REG, open->op_acl, &attrs);
+ if (open->op_acl) {
+ if (open->op_dpacl || open->op_pacl)
+ return nfserr_inval;
+ if (is_create_with_attrs(open))
+ nfsd4_acl_to_attr(NF4REG, open->op_acl, &attrs);
+ } else if (is_create_with_attrs(open)) {
+ /* The dpacl and pacl will get released by nfsd_attrs_free(). */
+ attrs.na_dpacl = open->op_dpacl;
+ attrs.na_pacl = open->op_pacl;
+ open->op_dpacl = NULL;
+ open->op_pacl = NULL;
+ }
child = start_creating(&nop_mnt_idmap, parent,
&QSTR_LEN(open->op_fname, open->op_fnamelen));
@@ -379,6 +393,10 @@ nfsd4_create_file(struct svc_rqst *rqstp, struct svc_fh *fhp,
open->op_bmval[2] &= ~FATTR4_WORD2_SECURITY_LABEL;
if (attrs.na_aclerr)
open->op_bmval[0] &= ~FATTR4_WORD0_ACL;
+ if (attrs.na_dpaclerr)
+ open->op_bmval[2] &= ~FATTR4_WORD2_POSIX_DEFAULT_ACL;
+ if (attrs.na_paclerr)
+ open->op_bmval[2] &= ~FATTR4_WORD2_POSIX_ACCESS_ACL;
out:
end_creating(child);
nfsd_attrs_free(&attrs);
@@ -546,8 +564,10 @@ nfsd4_open(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
open->op_rqstp = rqstp;
/* This check required by spec. */
- if (open->op_create && open->op_claim_type != NFS4_OPEN_CLAIM_NULL)
- return nfserr_inval;
+ if (open->op_create && open->op_claim_type != NFS4_OPEN_CLAIM_NULL) {
+ status = nfserr_inval;
+ goto out_err;
+ }
open->op_created = false;
/*
@@ -556,8 +576,10 @@ nfsd4_open(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
*/
if (nfsd4_has_session(cstate) &&
!test_bit(NFSD4_CLIENT_RECLAIM_COMPLETE, &cstate->clp->cl_flags) &&
- open->op_claim_type != NFS4_OPEN_CLAIM_PREVIOUS)
- return nfserr_grace;
+ open->op_claim_type != NFS4_OPEN_CLAIM_PREVIOUS) {
+ status = nfserr_grace;
+ goto out_err;
+ }
if (nfsd4_has_session(cstate))
copy_clientid(&open->op_clientid, cstate->session);
@@ -644,6 +666,9 @@ nfsd4_open(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
}
nfsd4_cleanup_open_state(cstate, open);
nfsd4_bump_seqid(cstate, status);
+out_err:
+ posix_acl_release(open->op_dpacl);
+ posix_acl_release(open->op_pacl);
return status;
}
@@ -784,6 +809,8 @@ nfsd4_create(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
struct nfsd_attrs attrs = {
.na_iattr = &create->cr_iattr,
.na_seclabel = &create->cr_label,
+ .na_dpacl = create->cr_dpacl,
+ .na_pacl = create->cr_pacl,
};
struct svc_fh resfh;
__be32 status;
@@ -793,13 +820,20 @@ nfsd4_create(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
status = fh_verify(rqstp, &cstate->current_fh, S_IFDIR, NFSD_MAY_NOP);
if (status)
- return status;
+ goto out_aftermask;
status = check_attr_support(cstate, create->cr_bmval, nfsd_attrmask);
if (status)
- return status;
+ goto out_aftermask;
- status = nfsd4_acl_to_attr(create->cr_type, create->cr_acl, &attrs);
+ if (create->cr_acl) {
+ if (create->cr_dpacl || create->cr_pacl) {
+ status = nfserr_inval;
+ goto out_aftermask;
+ }
+ status = nfsd4_acl_to_attr(create->cr_type, create->cr_acl,
+ &attrs);
+ }
current->fs->umask = create->cr_umask;
switch (create->cr_type) {
case NF4LNK:
@@ -860,12 +894,17 @@ nfsd4_create(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
create->cr_bmval[2] &= ~FATTR4_WORD2_SECURITY_LABEL;
if (attrs.na_aclerr)
create->cr_bmval[0] &= ~FATTR4_WORD0_ACL;
+ if (attrs.na_dpaclerr)
+ create->cr_bmval[2] &= ~FATTR4_WORD2_POSIX_DEFAULT_ACL;
+ if (attrs.na_paclerr)
+ create->cr_bmval[2] &= ~FATTR4_WORD2_POSIX_ACCESS_ACL;
set_change_info(&create->cr_cinfo, &cstate->current_fh);
fh_dup2(&cstate->current_fh, &resfh);
out:
fh_put(&resfh);
out_umask:
current->fs->umask = 0;
+out_aftermask:
nfsd_attrs_free(&attrs);
return status;
}
diff --git a/fs/nfsd/xdr4.h b/fs/nfsd/xdr4.h
index eebbcc579c31..1ec6365c977d 100644
--- a/fs/nfsd/xdr4.h
+++ b/fs/nfsd/xdr4.h
@@ -245,6 +245,8 @@ struct nfsd4_create {
int cr_umask; /* request */
struct nfsd4_change_info cr_cinfo; /* response */
struct nfs4_acl *cr_acl;
+ struct posix_acl *cr_dpacl;
+ struct posix_acl *cr_pacl;
struct xdr_netobj cr_label;
};
#define cr_datalen u.link.datalen
@@ -397,6 +399,8 @@ struct nfsd4_open {
struct nfs4_ol_stateid *op_stp; /* used during processing */
struct nfs4_clnt_odstate *op_odstate; /* used during processing */
struct nfs4_acl *op_acl;
+ struct posix_acl *op_dpacl;
+ struct posix_acl *op_pacl;
struct xdr_netobj op_label;
struct svc_rqst *op_rqstp;
};
--
2.49.0
^ permalink raw reply related [flat|nested] 21+ messages in thread
* [PATCH v1 08/17] Add the arguments for decoding of POSIX ACLs
2025-12-31 2:21 [PATCH v1 00/17] Add NFSv4.2 POSIX ACL support rick.macklem
` (6 preceding siblings ...)
2025-12-31 2:21 ` [PATCH v1 07/17] Add support for POSIX draft ACLs " rick.macklem
@ 2025-12-31 2:21 ` rick.macklem
2025-12-31 2:21 ` [PATCH v1 09/17] Fix a couple of bugs in POSIX ACL decoding rick.macklem
` (9 subsequent siblings)
17 siblings, 0 replies; 21+ messages in thread
From: rick.macklem @ 2025-12-31 2:21 UTC (permalink / raw)
To: linux-nfs; +Cc: Rick Macklem
From: Rick Macklem <rmacklem@uoguelph.ca>
The NULL arguments are replaced by the correct posix
ACL arguments.
Signed-off-by: Rick Macklem <rmacklem@uoguelph.ca>
---
fs/nfsd/nfs4xdr.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 5f996b3a4ce4..1a6ed0836c40 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -980,7 +980,7 @@ nfsd4_decode_create(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u)
ARRAY_SIZE(create->cr_bmval),
&create->cr_iattr, &create->cr_acl,
&create->cr_label, &create->cr_umask,
- NULL, NULL);
+ &create->cr_dpacl, &create->cr_pacl);
if (status)
return status;
@@ -1132,7 +1132,7 @@ nfsd4_decode_createhow4(struct nfsd4_compoundargs *argp, struct nfsd4_open *open
ARRAY_SIZE(open->op_bmval),
&open->op_iattr, &open->op_acl,
&open->op_label, &open->op_umask,
- NULL, NULL);
+ &open->op_dpacl, &open->op_pacl);
if (status)
return status;
break;
@@ -1151,7 +1151,7 @@ nfsd4_decode_createhow4(struct nfsd4_compoundargs *argp, struct nfsd4_open *open
ARRAY_SIZE(open->op_bmval),
&open->op_iattr, &open->op_acl,
&open->op_label, &open->op_umask,
- NULL, NULL);
+ &open->op_dpacl, &open->op_pacl);
if (status)
return status;
break;
--
2.49.0
^ permalink raw reply related [flat|nested] 21+ messages in thread
* [PATCH v1 09/17] Fix a couple of bugs in POSIX ACL decoding
2025-12-31 2:21 [PATCH v1 00/17] Add NFSv4.2 POSIX ACL support rick.macklem
` (7 preceding siblings ...)
2025-12-31 2:21 ` [PATCH v1 08/17] Add the arguments for decoding of POSIX ACLs rick.macklem
@ 2025-12-31 2:21 ` rick.macklem
2025-12-31 2:21 ` [PATCH v1 10/17] Improve correctness for the ACL_TRUEFORM attribute rick.macklem
` (8 subsequent siblings)
17 siblings, 0 replies; 21+ messages in thread
From: rick.macklem @ 2025-12-31 2:21 UTC (permalink / raw)
To: linux-nfs; +Cc: Rick Macklem
From: Rick Macklem <rmacklem@uoguelph.ca>
1 - Handle the case where the who is of zero length for
ACL_USER or ACL_GROUP.
2 - Correctly calculate the minimum XDR size of the ACL.
Signed-off-by: Rick Macklem <rmacklem@uoguelph.ca>
---
fs/nfsd/nfs4xdr.c | 20 +++++++++++++-------
1 file changed, 13 insertions(+), 7 deletions(-)
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 1a6ed0836c40..60197963c854 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -434,12 +434,18 @@ nfsd4_decode_posixace4(struct nfsd4_compoundargs *argp,
return nfserr_bad_xdr;
switch(ace->e_tag) {
case ACL_USER:
- status = nfsd_map_name_to_uid(argp->rqstp,
- (char *)p, val, &ace->e_uid);
+ if (val > 0)
+ status = nfsd_map_name_to_uid(argp->rqstp,
+ (char *)p, val, &ace->e_uid);
+ else
+ status = nfserr_bad_xdr;
break;
case ACL_GROUP:
- status = nfsd_map_name_to_gid(argp->rqstp,
- (char *)p, val, &ace->e_gid);
+ if (val > 0)
+ status = nfsd_map_name_to_gid(argp->rqstp,
+ (char *)p, val, &ace->e_gid);
+ else
+ status = nfserr_bad_xdr;
}
return status;
@@ -455,13 +461,13 @@ nfsd4_decode_posix_acl(struct nfsd4_compoundargs *argp, struct posix_acl **acl)
if (xdr_stream_decode_u32(argp->xdr, &count) < 0)
return nfserr_bad_xdr;
- if (count > xdr_stream_remaining(argp->xdr) / 16)
+ if (count > xdr_stream_remaining(argp->xdr) / (3 * XDR_UNIT))
/*
- * Even with 4-byte names there wouldn't be
+ * Even with 0-byte who strings there wouldn't be
* space for that many aces; something fishy is
* going on:
*/
- return nfserr_fbig;
+ return nfserr_bad_xdr;
*acl = posix_acl_alloc(count, GFP_NOFS);
if (*acl == NULL)
--
2.49.0
^ permalink raw reply related [flat|nested] 21+ messages in thread
* [PATCH v1 10/17] Improve correctness for the ACL_TRUEFORM attribute
2025-12-31 2:21 [PATCH v1 00/17] Add NFSv4.2 POSIX ACL support rick.macklem
` (8 preceding siblings ...)
2025-12-31 2:21 ` [PATCH v1 09/17] Fix a couple of bugs in POSIX ACL decoding rick.macklem
@ 2025-12-31 2:21 ` rick.macklem
2025-12-31 2:21 ` [PATCH v1 11/17] Make sort_pacl_range() global rick.macklem
` (7 subsequent siblings)
17 siblings, 0 replies; 21+ messages in thread
From: rick.macklem @ 2025-12-31 2:21 UTC (permalink / raw)
To: linux-nfs; +Cc: Rick Macklem
From: Rick Macklem <rmacklem@uoguelph.ca>
Signed-off-by: Rick Macklem <rmacklem@uoguelph.ca>
---
fs/nfsd/nfs4xdr.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 60197963c854..d12e479c18d3 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -3615,8 +3615,12 @@ static __be32 nfsd4_encode_fattr4_open_arguments(struct xdr_stream *xdr,
static __be32 nfsd4_encode_fattr4_acl_trueform(struct xdr_stream *xdr,
const struct nfsd4_fattr_args *args)
{
+ u32 trueform;
- return nfsd4_encode_uint32_t(xdr, ACL_MODEL_POSIX_DRAFT);
+ trueform = ACL_MODEL_NONE;
+ if (IS_POSIXACL(d_inode(args->dentry)))
+ trueform = ACL_MODEL_POSIX_DRAFT;
+ return nfsd4_encode_uint32_t(xdr, trueform);
}
static __be32 nfsd4_encode_fattr4_acl_trueform_scope(struct xdr_stream *xdr,
--
2.49.0
^ permalink raw reply related [flat|nested] 21+ messages in thread
* [PATCH v1 11/17] Make sort_pacl_range() global
2025-12-31 2:21 [PATCH v1 00/17] Add NFSv4.2 POSIX ACL support rick.macklem
` (9 preceding siblings ...)
2025-12-31 2:21 ` [PATCH v1 10/17] Improve correctness for the ACL_TRUEFORM attribute rick.macklem
@ 2025-12-31 2:21 ` rick.macklem
2025-12-31 2:21 ` [PATCH v1 12/17] Call sort_pacl_range() for decoded POSIX draft ACLs rick.macklem
` (6 subsequent siblings)
17 siblings, 0 replies; 21+ messages in thread
From: rick.macklem @ 2025-12-31 2:21 UTC (permalink / raw)
To: linux-nfs; +Cc: Rick Macklem
From: Rick Macklem <rmacklem@uoguelph.ca>
nfsd4_decode_posix_acl() needs to call sort_pacl_range() to sort
the ACEs in a decoded POSIX draft ACL attribute.
Signed-off-by: Rick Macklem <rmacklem@uoguelph.ca>
---
fs/nfsd/acl.h | 1 +
fs/nfsd/nfs4acl.c | 2 +-
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/nfsd/acl.h b/fs/nfsd/acl.h
index 213774cebeeb..7e061fee2eea 100644
--- a/fs/nfsd/acl.h
+++ b/fs/nfsd/acl.h
@@ -51,5 +51,6 @@ int nfsd4_get_posix_acl(struct svc_rqst *rqstp, struct dentry *dentry,
struct posix_acl **pacl_ret, struct posix_acl **dpacl_ret);
__be32 nfsd4_acl_to_attr(enum nfs_ftype4 type, struct nfs4_acl *acl,
struct nfsd_attrs *attr);
+void sort_pacl_range(struct posix_acl *pacl, int start, int end);
#endif /* LINUX_NFS4_ACL_H */
diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c
index 0a184b345f8c..84bef41848ca 100644
--- a/fs/nfsd/nfs4acl.c
+++ b/fs/nfsd/nfs4acl.c
@@ -402,7 +402,7 @@ pace_gt(struct posix_acl_entry *pace1, struct posix_acl_entry *pace2)
return false;
}
-static void
+void
sort_pacl_range(struct posix_acl *pacl, int start, int end) {
int sorted = 0, i;
--
2.49.0
^ permalink raw reply related [flat|nested] 21+ messages in thread
* [PATCH v1 12/17] Call sort_pacl_range() for decoded POSIX draft ACLs
2025-12-31 2:21 [PATCH v1 00/17] Add NFSv4.2 POSIX ACL support rick.macklem
` (10 preceding siblings ...)
2025-12-31 2:21 ` [PATCH v1 11/17] Make sort_pacl_range() global rick.macklem
@ 2025-12-31 2:21 ` rick.macklem
2025-12-31 2:21 ` [PATCH v1 13/17] Fix handling of POSIX ACLs with zero ACEs rick.macklem
` (5 subsequent siblings)
17 siblings, 0 replies; 21+ messages in thread
From: rick.macklem @ 2025-12-31 2:21 UTC (permalink / raw)
To: linux-nfs; +Cc: Rick Macklem
From: Rick Macklem <rmacklem@uoguelph.ca>
posix_valid_check() expects the ACEs in a POSIX draft ACL
to be sorted, so sort them. Since sort_pacl_range() uses bubble
sort, it will only make a single pass through the ACEs if they
are already sorted, which will often be the case.
Signed-off-by: Rick Macklem <rmacklem@uoguelph.ca>
---
fs/nfsd/nfs4xdr.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index d12e479c18d3..72530203e985 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -483,6 +483,16 @@ nfsd4_decode_posix_acl(struct nfsd4_compoundargs *argp, struct posix_acl **acl)
}
}
+ /*
+ * posix_acl_valid() requires the ACEs to be sorted.
+ * If they are already sorted, sort_pacl_range() will return
+ * after one pass through the ACEs, since it implements bubble sort.
+ * Note that a count == 0 is used to delete a POSIX ACL and a count
+ * of 1 or 2 will always be found invalid by posix_acl_valid().
+ */
+ if (count >= 3)
+ sort_pacl_range(*acl, 0, count - 1);
+
return nfs_ok;
}
--
2.49.0
^ permalink raw reply related [flat|nested] 21+ messages in thread
* [PATCH v1 13/17] Fix handling of POSIX ACLs with zero ACEs
2025-12-31 2:21 [PATCH v1 00/17] Add NFSv4.2 POSIX ACL support rick.macklem
` (11 preceding siblings ...)
2025-12-31 2:21 ` [PATCH v1 12/17] Call sort_pacl_range() for decoded POSIX draft ACLs rick.macklem
@ 2025-12-31 2:21 ` rick.macklem
2025-12-31 2:21 ` [PATCH v1 14/17] Fix handling of zero length ACLs for file creation rick.macklem
` (4 subsequent siblings)
17 siblings, 0 replies; 21+ messages in thread
From: rick.macklem @ 2025-12-31 2:21 UTC (permalink / raw)
To: linux-nfs; +Cc: Rick Macklem
From: Rick Macklem <rmacklem@uoguelph.ca>
The NFSv4.2 code does a SETATTR with a POSIX draft default ACL
of zero ACEs to delete the default ACL. This patch fixes handling
of this case.
Note that the server code does not handle the case where
a file system is of ACL_SCOPE_FILE OBJECT (which means that
NFS4 and POSIX draft ACLs are mixed as the "true form" ACL
for different file objects in the file system).
Signed-off-by: Rick Macklem <rmacklem@uoguelph.ca>
---
fs/nfsd/nfs4proc.c | 30 ++++++++++++++++++++++++------
1 file changed, 24 insertions(+), 6 deletions(-)
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index a172bd253086..1dab7d3aa11e 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1215,12 +1215,30 @@ nfsd4_proc_setacl(struct svc_rqst *rqstp, svc_fh *fh, struct inode *inode,
inode_lock(inode);
- if (dpacl != NULL)
- error = set_posix_acl(&nop_mnt_idmap, fh->fh_dentry,
- ACL_TYPE_DEFAULT, dpacl);
- if (!error && pacl != NULL)
- error = set_posix_acl(&nop_mnt_idmap, fh->fh_dentry,
- ACL_TYPE_ACCESS, pacl);
+ if (dpacl != NULL) {
+ /* a_count == 0 means delete the ACL. */
+ if (dpacl->a_count > 0)
+ error = set_posix_acl(&nop_mnt_idmap, fh->fh_dentry,
+ ACL_TYPE_DEFAULT, dpacl);
+ else
+ error = set_posix_acl(&nop_mnt_idmap, fh->fh_dentry,
+ ACL_TYPE_DEFAULT, NULL);
+ }
+ if (!error && pacl != NULL) {
+ /*
+ * For any file system that is not ACL_SCOPE_FILE_OBJECT,
+ * a_count == 0 MUST reply nfserr_inval.
+ * For a file system that is ACL_SCOPE_FILE_OBJECT,
+ * a_count == 0 means delete the ACL.
+ * XXX File systems that are ACL_SCOPE_FILE_OBJECT
+ * are not yet supported.
+ */
+ if (pacl->a_count > 0)
+ error = set_posix_acl(&nop_mnt_idmap, fh->fh_dentry,
+ ACL_TYPE_ACCESS, pacl);
+ else
+ error = -EINVAL;
+ }
inode_unlock(inode);
return nfserrno(error);
--
2.49.0
^ permalink raw reply related [flat|nested] 21+ messages in thread
* [PATCH v1 14/17] Fix handling of zero length ACLs for file creation
2025-12-31 2:21 [PATCH v1 00/17] Add NFSv4.2 POSIX ACL support rick.macklem
` (12 preceding siblings ...)
2025-12-31 2:21 ` [PATCH v1 13/17] Fix handling of POSIX ACLs with zero ACEs rick.macklem
@ 2025-12-31 2:21 ` rick.macklem
2025-12-31 2:21 ` [PATCH v1 15/17] Do not allow (N)VERIFY to check POSIX ACL attributes rick.macklem
` (3 subsequent siblings)
17 siblings, 0 replies; 21+ messages in thread
From: rick.macklem @ 2025-12-31 2:21 UTC (permalink / raw)
To: linux-nfs; +Cc: Rick Macklem
From: Rick Macklem <rmacklem@uoguelph.ca>
Although it seems unlikely that a NFSv4.2 client would
specify deletion of an ACL for file object creation,
this patch applies the changes needed to support that
for a POSIX draft default ACL.
Signed-off-by: Rick Macklem <rmacklem@uoguelph.ca>
---
fs/nfsd/vfs.c | 34 +++++++++++++++++++++++++++-------
1 file changed, 27 insertions(+), 7 deletions(-)
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 146483bf8a65..c884c3f34afb 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -596,15 +596,35 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp,
if (attr->na_seclabel && attr->na_seclabel->len)
attr->na_labelerr = security_inode_setsecctx(dentry,
attr->na_seclabel->data, attr->na_seclabel->len);
- if (IS_ENABLED(CONFIG_FS_POSIX_ACL) && attr->na_pacl)
- attr->na_paclerr = set_posix_acl(&nop_mnt_idmap,
- dentry, ACL_TYPE_ACCESS,
- attr->na_pacl);
- if (IS_ENABLED(CONFIG_FS_POSIX_ACL) &&
- attr->na_dpacl && S_ISDIR(inode->i_mode))
- attr->na_dpaclerr = set_posix_acl(&nop_mnt_idmap,
+ if (IS_ENABLED(CONFIG_FS_POSIX_ACL) && attr->na_dpacl) {
+ if (!S_ISDIR(inode->i_mode))
+ attr->na_dpaclerr = -EINVAL;
+ else if (attr->na_dpacl->a_count > 0)
+ /* a_count == 0 means delete the ACL. */
+ attr->na_dpaclerr = set_posix_acl(&nop_mnt_idmap,
dentry, ACL_TYPE_DEFAULT,
attr->na_dpacl);
+ else
+ attr->na_dpaclerr = set_posix_acl(&nop_mnt_idmap,
+ dentry, ACL_TYPE_DEFAULT,
+ NULL);
+ }
+ if (IS_ENABLED(CONFIG_FS_POSIX_ACL) && attr->na_pacl) {
+ /*
+ * For any file system that is not ACL_SCOPE_FILE_OBJECT,
+ * a_count == 0 MUST reply nfserr_inval.
+ * For a file system that is ACL_SCOPE_FILE_OBJECT,
+ * a_count == 0 deletes the ACL.
+ * XXX File systems that are ACL_SCOPE_FILE_OBJECT
+ * are not yet supported.
+ */
+ if (attr->na_pacl->a_count > 0)
+ attr->na_paclerr = set_posix_acl(&nop_mnt_idmap,
+ dentry, ACL_TYPE_ACCESS,
+ attr->na_pacl);
+ else
+ attr->na_paclerr = -EINVAL;
+ }
out_fill_attrs:
/*
* RFC 1813 Section 3.3.2 does not mandate that an NFS server
--
2.49.0
^ permalink raw reply related [flat|nested] 21+ messages in thread
* [PATCH v1 15/17] Do not allow (N)VERIFY to check POSIX ACL attributes
2025-12-31 2:21 [PATCH v1 00/17] Add NFSv4.2 POSIX ACL support rick.macklem
` (13 preceding siblings ...)
2025-12-31 2:21 ` [PATCH v1 14/17] Fix handling of zero length ACLs for file creation rick.macklem
@ 2025-12-31 2:21 ` rick.macklem
2025-12-31 2:21 ` [PATCH v1 16/17] Set the POSIX ACL attributes supported rick.macklem
` (2 subsequent siblings)
17 siblings, 0 replies; 21+ messages in thread
From: rick.macklem @ 2025-12-31 2:21 UTC (permalink / raw)
To: linux-nfs; +Cc: Rick Macklem
From: Rick Macklem <rmacklem@uoguelph.ca>
Comparison of POSIX draft ACLs via (N)VERIFY is not
permitted by the IETF working group draft.
It is also not practical for the (N)VERIFY code in the
knfsd, since ordering of ACEs is not required.
Signed-off-by: Rick Macklem <rmacklem@uoguelph.ca>
---
fs/nfsd/nfs4proc.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 1dab7d3aa11e..ae5c1f5b714d 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -2373,6 +2373,11 @@ _nfsd4_verify(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
if (verify->ve_attrlen & 3)
return nfserr_inval;
+ /* The POSIX draft ACLs cannot be tested via (N)VERIFY. */
+ if (verify->ve_bmval[2] & (FATTR4_WORD2_POSIX_DEFAULT_ACL |
+ FATTR4_WORD2_POSIX_ACCESS_ACL))
+ return nfserr_inval;
+
/* count in words:
* bitmap_len(1) + bitmap(2) + attr_len(1) = 4
*/
--
2.49.0
^ permalink raw reply related [flat|nested] 21+ messages in thread
* [PATCH v1 16/17] Set the POSIX ACL attributes supported
2025-12-31 2:21 [PATCH v1 00/17] Add NFSv4.2 POSIX ACL support rick.macklem
` (14 preceding siblings ...)
2025-12-31 2:21 ` [PATCH v1 15/17] Do not allow (N)VERIFY to check POSIX ACL attributes rick.macklem
@ 2025-12-31 2:21 ` rick.macklem
2025-12-31 2:21 ` [PATCH v1 17/17] Change a bunch of function prefixes to nfsd42_ rick.macklem
2025-12-31 2:47 ` [PATCH v1 00/17] Add NFSv4.2 POSIX ACL support Chuck Lever
17 siblings, 0 replies; 21+ messages in thread
From: rick.macklem @ 2025-12-31 2:21 UTC (permalink / raw)
To: linux-nfs; +Cc: Rick Macklem
From: Rick Macklem <rmacklem@uoguelph.ca>
Signed-off-by: Rick Macklem <rmacklem@uoguelph.ca>
---
fs/nfsd/nfsd.h | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/fs/nfsd/nfsd.h b/fs/nfsd/nfsd.h
index b0283213a8f5..b07a04ae7d6a 100644
--- a/fs/nfsd/nfsd.h
+++ b/fs/nfsd/nfsd.h
@@ -462,7 +462,11 @@ enum {
FATTR4_WORD2_XATTR_SUPPORT | \
FATTR4_WORD2_TIME_DELEG_ACCESS | \
FATTR4_WORD2_TIME_DELEG_MODIFY | \
- FATTR4_WORD2_OPEN_ARGUMENTS)
+ FATTR4_WORD2_OPEN_ARGUMENTS | \
+ FATTR4_WORD2_ACL_TRUEFORM | \
+ FATTR4_WORD2_ACL_TRUEFORM_SCOPE | \
+ FATTR4_WORD2_POSIX_DEFAULT_ACL | \
+ FATTR4_WORD2_POSIX_ACCESS_ACL)
extern const u32 nfsd_suppattrs[3][3];
@@ -535,6 +539,8 @@ static inline bool nfsd_attrs_supported(u32 minorversion, const u32 *bmval)
| MAYBE_FATTR4_WORD2_SECURITY_LABEL \
| FATTR4_WORD2_TIME_DELEG_ACCESS \
| FATTR4_WORD2_TIME_DELEG_MODIFY \
+ | FATTR4_WORD2_POSIX_DEFAULT_ACL \
+ | FATTR4_WORD2_POSIX_ACCESS_ACL \
)
#define NFSD_SUPPATTR_EXCLCREAT_WORD0 \
--
2.49.0
^ permalink raw reply related [flat|nested] 21+ messages in thread
* [PATCH v1 17/17] Change a bunch of function prefixes to nfsd42_
2025-12-31 2:21 [PATCH v1 00/17] Add NFSv4.2 POSIX ACL support rick.macklem
` (15 preceding siblings ...)
2025-12-31 2:21 ` [PATCH v1 16/17] Set the POSIX ACL attributes supported rick.macklem
@ 2025-12-31 2:21 ` rick.macklem
2025-12-31 2:47 ` [PATCH v1 00/17] Add NFSv4.2 POSIX ACL support Chuck Lever
17 siblings, 0 replies; 21+ messages in thread
From: rick.macklem @ 2025-12-31 2:21 UTC (permalink / raw)
To: linux-nfs; +Cc: Rick Macklem
From: Rick Macklem <rmacklem@uoguelph.ca>
No semantics change.
Signed-off-by: Rick Macklem <rmacklem@uoguelph.ca>
---
fs/nfsd/acl.h | 2 +-
fs/nfsd/nfs4acl.c | 2 +-
fs/nfsd/nfs4proc.c | 4 ++--
fs/nfsd/nfs4xdr.c | 36 ++++++++++++++++++------------------
4 files changed, 22 insertions(+), 22 deletions(-)
diff --git a/fs/nfsd/acl.h b/fs/nfsd/acl.h
index 7e061fee2eea..85a90ee37405 100644
--- a/fs/nfsd/acl.h
+++ b/fs/nfsd/acl.h
@@ -47,7 +47,7 @@ __be32 nfs4_acl_write_who(struct xdr_stream *xdr, int who);
int nfsd4_get_nfs4_acl(struct svc_rqst *rqstp, struct dentry *dentry,
struct nfs4_acl **acl);
-int nfsd4_get_posix_acl(struct svc_rqst *rqstp, struct dentry *dentry,
+int nfsd42_get_posix_acl(struct svc_rqst *rqstp, struct dentry *dentry,
struct posix_acl **pacl_ret, struct posix_acl **dpacl_ret);
__be32 nfsd4_acl_to_attr(enum nfs_ftype4 type, struct nfs4_acl *acl,
struct nfsd_attrs *attr);
diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c
index 84bef41848ca..e4bcb2874a4d 100644
--- a/fs/nfsd/nfs4acl.c
+++ b/fs/nfsd/nfs4acl.c
@@ -177,7 +177,7 @@ nfsd4_get_nfs4_acl(struct svc_rqst *rqstp, struct dentry *dentry,
}
int
-nfsd4_get_posix_acl(struct svc_rqst *rqstp, struct dentry *dentry,
+nfsd42_get_posix_acl(struct svc_rqst *rqstp, struct dentry *dentry,
struct posix_acl **pacl_ret, struct posix_acl **dpacl_ret)
{
struct inode *inode = d_inode(dentry);
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index ae5c1f5b714d..073e9707f41d 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1205,7 +1205,7 @@ vet_deleg_attrs(struct nfsd4_setattr *setattr, struct nfs4_delegation *dp)
* Set the Access and/or Default ACL of a file.
*/
static __be32
-nfsd4_proc_setacl(struct svc_rqst *rqstp, svc_fh *fh, struct inode *inode,
+nfsd42_proc_setacl(struct svc_rqst *rqstp, svc_fh *fh, struct inode *inode,
struct posix_acl *dpacl, struct posix_acl *pacl)
{
int error = 0;
@@ -1319,7 +1319,7 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
status = nfsd_setattr(rqstp, &cstate->current_fh, &attrs, NULL);
cstate->current_fh.fh_no_wcc = save_no_wcc;
if (!status && (setattr->sa_dpacl != NULL || setattr->sa_pacl != NULL))
- status = nfsd4_proc_setacl(rqstp, &cstate->current_fh, inode,
+ status = nfsd42_proc_setacl(rqstp, &cstate->current_fh, inode,
setattr->sa_dpacl, setattr->sa_pacl);
if (!status)
status = nfserrno(attrs.na_labelerr);
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 72530203e985..453c0317c171 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -379,7 +379,7 @@ nfsd4_decode_security_label(struct nfsd4_compoundargs *argp,
}
static __be32
-nfsacl4_posix_xdrtotag(struct xdr_stream *xdr, u32 *tag)
+nfsacl42_posix_xdrtotag(struct xdr_stream *xdr, u32 *tag)
{
u32 type;
@@ -411,13 +411,13 @@ nfsacl4_posix_xdrtotag(struct xdr_stream *xdr, u32 *tag)
}
static __be32
-nfsd4_decode_posixace4(struct nfsd4_compoundargs *argp,
+nfsd42_decode_posixace4(struct nfsd4_compoundargs *argp,
struct posix_acl_entry *ace)
{
u32 val;
__be32 *p, status;
- status = nfsacl4_posix_xdrtotag(argp->xdr, &val);
+ status = nfsacl42_posix_xdrtotag(argp->xdr, &val);
if (status != nfs_ok)
return status;
ace->e_tag = val;
@@ -452,7 +452,7 @@ nfsd4_decode_posixace4(struct nfsd4_compoundargs *argp,
}
static noinline __be32
-nfsd4_decode_posix_acl(struct nfsd4_compoundargs *argp, struct posix_acl **acl)
+nfsd42_decode_posix_acl(struct nfsd4_compoundargs *argp, struct posix_acl **acl)
{
struct posix_acl_entry *ace;
__be32 status;
@@ -475,7 +475,7 @@ nfsd4_decode_posix_acl(struct nfsd4_compoundargs *argp, struct posix_acl **acl)
(*acl)->a_count = count;
for (ace = (*acl)->a_entries; ace < (*acl)->a_entries + count; ace++) {
- status = nfsd4_decode_posixace4(argp, ace);
+ status = nfsd42_decode_posixace4(argp, ace);
if (status) {
posix_acl_release(*acl);
*acl = NULL;
@@ -669,7 +669,7 @@ nfsd4_decode_fattr4(struct nfsd4_compoundargs *argp, u32 *bmval, u32 bmlen,
if (bmval[2] & FATTR4_WORD2_POSIX_DEFAULT_ACL) {
struct posix_acl *dpacl;
- status = nfsd4_decode_posix_acl(argp, &dpacl);
+ status = nfsd42_decode_posix_acl(argp, &dpacl);
if (status)
return status;
if (dpaclp)
@@ -680,7 +680,7 @@ nfsd4_decode_fattr4(struct nfsd4_compoundargs *argp, u32 *bmval, u32 bmlen,
if (bmval[2] & FATTR4_WORD2_POSIX_ACCESS_ACL) {
struct posix_acl *pacl;
- status = nfsd4_decode_posix_acl(argp, &pacl);
+ status = nfsd42_decode_posix_acl(argp, &pacl);
if (status)
return status;
if (paclp)
@@ -3622,7 +3622,7 @@ static __be32 nfsd4_encode_fattr4_open_arguments(struct xdr_stream *xdr,
return nfs_ok;
}
-static __be32 nfsd4_encode_fattr4_acl_trueform(struct xdr_stream *xdr,
+static __be32 nfsd42_encode_fattr4_acl_trueform(struct xdr_stream *xdr,
const struct nfsd4_fattr_args *args)
{
u32 trueform;
@@ -3633,14 +3633,14 @@ static __be32 nfsd4_encode_fattr4_acl_trueform(struct xdr_stream *xdr,
return nfsd4_encode_uint32_t(xdr, trueform);
}
-static __be32 nfsd4_encode_fattr4_acl_trueform_scope(struct xdr_stream *xdr,
+static __be32 nfsd42_encode_fattr4_acl_trueform_scope(struct xdr_stream *xdr,
const struct nfsd4_fattr_args *args)
{
return nfsd4_encode_uint32_t(xdr, ACL_SCOPE_FILE_SYSTEM);
}
-static int nfsacl4_posix_tagtotype(u32 tag)
+static int nfsacl42_posix_tagtotype(u32 tag)
{
int type;
@@ -3676,7 +3676,7 @@ static __be32 xdr_nfs4ace_stream_encode(struct xdr_stream *xdr,
__be32 status;
int type;
- type = nfsacl4_posix_tagtotype(acep->e_tag);
+ type = nfsacl42_posix_tagtotype(acep->e_tag);
if (type < 0)
return nfserr_resource;
if (xdr_stream_encode_u32(xdr, type) != XDR_UNIT)
@@ -3734,14 +3734,14 @@ static __be32 encode_stream_posixacl(struct xdr_stream *xdr,
return nfs_ok;
}
-static __be32 nfsd4_encode_fattr4_posix_default_acl(struct xdr_stream *xdr,
+static __be32 nfsd42_encode_fattr4_posix_default_acl(struct xdr_stream *xdr,
const struct nfsd4_fattr_args *args)
{
return encode_stream_posixacl(xdr, args->dpacl, args->rqstp);
}
-static __be32 nfsd4_encode_fattr4_posix_access_acl(struct xdr_stream *xdr,
+static __be32 nfsd42_encode_fattr4_posix_access_acl(struct xdr_stream *xdr,
const struct nfsd4_fattr_args *args)
{
@@ -3851,10 +3851,10 @@ static const nfsd4_enc_attr nfsd4_enc_fattr4_encode_ops[] = {
[FATTR4_TIME_DELEG_ACCESS] = nfsd4_encode_fattr4__inval,
[FATTR4_TIME_DELEG_MODIFY] = nfsd4_encode_fattr4__inval,
[FATTR4_OPEN_ARGUMENTS] = nfsd4_encode_fattr4_open_arguments,
- [FATTR4_ACL_TRUEFORM] = nfsd4_encode_fattr4_acl_trueform,
- [FATTR4_ACL_TRUEFORM_SCOPE] = nfsd4_encode_fattr4_acl_trueform_scope,
- [FATTR4_POSIX_DEFAULT_ACL] = nfsd4_encode_fattr4_posix_default_acl,
- [FATTR4_POSIX_ACCESS_ACL] = nfsd4_encode_fattr4_posix_access_acl,
+ [FATTR4_ACL_TRUEFORM] = nfsd42_encode_fattr4_acl_trueform,
+ [FATTR4_ACL_TRUEFORM_SCOPE] = nfsd42_encode_fattr4_acl_trueform_scope,
+ [FATTR4_POSIX_DEFAULT_ACL] = nfsd42_encode_fattr4_posix_default_acl,
+ [FATTR4_POSIX_ACCESS_ACL] = nfsd42_encode_fattr4_posix_access_acl,
};
/*
@@ -3985,7 +3985,7 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr,
if (attrmask[2] & (FATTR4_WORD2_POSIX_DEFAULT_ACL |
FATTR4_WORD2_POSIX_ACCESS_ACL)) {
- err = nfsd4_get_posix_acl(rqstp, dentry, &args.pacl,
+ err = nfsd42_get_posix_acl(rqstp, dentry, &args.pacl,
&args.dpacl);
if (err == -EOPNOTSUPP)
attrmask[2] &= ~(FATTR4_WORD2_POSIX_DEFAULT_ACL |
--
2.49.0
^ permalink raw reply related [flat|nested] 21+ messages in thread
* Re: [PATCH v1 00/17] Add NFSv4.2 POSIX ACL support
2025-12-31 2:21 [PATCH v1 00/17] Add NFSv4.2 POSIX ACL support rick.macklem
` (16 preceding siblings ...)
2025-12-31 2:21 ` [PATCH v1 17/17] Change a bunch of function prefixes to nfsd42_ rick.macklem
@ 2025-12-31 2:47 ` Chuck Lever
2025-12-31 2:49 ` Rick Macklem
2025-12-31 2:57 ` Rick Macklem
17 siblings, 2 replies; 21+ messages in thread
From: Chuck Lever @ 2025-12-31 2:47 UTC (permalink / raw)
To: Rick Macklem, linux-nfs; +Cc: Rick Macklem
On Tue, Dec 30, 2025, at 9:21 PM, rick.macklem@gmail.com wrote:
> From: Rick Macklem <rmacklem@uoguelph.ca>
>
> The Internet draft "POSIX Draft ACL support for
> Network File System Version 4, Minor Version2"
> https://datatracker.ietf.org/doc/draft-ietf-nfsv4-posix-acls/
> describes an extension to NFSv4.2 so that POSIX
> draft ACLs can get acquired and set directly,
> without using the loosey NFSv4->POSIX draft mapping
> algorith. It extends the protocol with four new
> attributes.
>
> This patch series implements the server side of
> this extension for the knfsd. It is analogous
> to the NFSACL protocol used as a sideband protocol
> for NFSv3 and allows the ACLs to be acquired/set
> be getfacl(1)/setfacl(1).
>
> The current implementation does not support the
> "per file" scope, where individual file objects
> store/use either an NFSv4 ACL or POSIX draft ACL
> and assumes POSIX draft ACLs are supported for an
> entire file system, if support for POSIX draft ACLs
> is indicated.
>
> Rick Macklem (17):
> Add definitions for the POSIX draft ACL attributes
> Add a new function to acquire the POSIX draft ACLs
> Add a function to set POSIX ACLs
> Add support for encoding/decoding POSIX draft ACLs
> Add a check for both POSIX and NFSv4 ACLs being set
> Add na_dpaclerr and na_paclerr for file creation
> Add support for POSIX draft ACLs for file creation
> Add the arguments for decoding of POSIX ACLs
> Fix a couple of bugs in POSIX ACL decoding
> Improve correctness for the ACL_TRUEFORM attribute
> Make sort_pacl_range() global
> Call sort_pacl_range() for decoded POSIX draft ACLs
> Fix handling of POSIX ACLs with zero ACEs
> Fix handling of zero length ACLs for file creation
> Do not allow (N)VERIFY to check POSIX ACL attributes
> Set the POSIX ACL attributes supported
> Change a bunch of function prefixes to nfsd42_
>
> fs/nfsd/acl.h | 3 +
> fs/nfsd/nfs4acl.c | 35 ++++-
> fs/nfsd/nfs4proc.c | 126 +++++++++++++++--
> fs/nfsd/nfs4xdr.c | 312 ++++++++++++++++++++++++++++++++++++++++++-
> fs/nfsd/nfsd.h | 8 +-
> fs/nfsd/vfs.c | 34 ++++-
> fs/nfsd/vfs.h | 2 +
> fs/nfsd/xdr4.h | 6 +
> include/linux/nfs4.h | 37 +++++
> 9 files changed, 536 insertions(+), 27 deletions(-)
>
> --
> 2.49.0
Thanks for posting, Rick! What branch/tree/commit did you base this series on?
--
Chuck Lever
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [PATCH v1 00/17] Add NFSv4.2 POSIX ACL support
2025-12-31 2:47 ` [PATCH v1 00/17] Add NFSv4.2 POSIX ACL support Chuck Lever
@ 2025-12-31 2:49 ` Rick Macklem
2025-12-31 2:57 ` Rick Macklem
1 sibling, 0 replies; 21+ messages in thread
From: Rick Macklem @ 2025-12-31 2:49 UTC (permalink / raw)
To: Chuck Lever; +Cc: linux-nfs, Rick Macklem
On Tue, Dec 30, 2025 at 6:48 PM Chuck Lever <cel@kernel.org> wrote:
>
>
>
> On Tue, Dec 30, 2025, at 9:21 PM, rick.macklem@gmail.com wrote:
> > From: Rick Macklem <rmacklem@uoguelph.ca>
> >
> > The Internet draft "POSIX Draft ACL support for
> > Network File System Version 4, Minor Version2"
> > https://datatracker.ietf.org/doc/draft-ietf-nfsv4-posix-acls/
> > describes an extension to NFSv4.2 so that POSIX
> > draft ACLs can get acquired and set directly,
> > without using the loosey NFSv4->POSIX draft mapping
> > algorith. It extends the protocol with four new
> > attributes.
> >
> > This patch series implements the server side of
> > this extension for the knfsd. It is analogous
> > to the NFSACL protocol used as a sideband protocol
> > for NFSv3 and allows the ACLs to be acquired/set
> > be getfacl(1)/setfacl(1).
> >
> > The current implementation does not support the
> > "per file" scope, where individual file objects
> > store/use either an NFSv4 ACL or POSIX draft ACL
> > and assumes POSIX draft ACLs are supported for an
> > entire file system, if support for POSIX draft ACLs
> > is indicated.
> >
> > Rick Macklem (17):
> > Add definitions for the POSIX draft ACL attributes
> > Add a new function to acquire the POSIX draft ACLs
> > Add a function to set POSIX ACLs
> > Add support for encoding/decoding POSIX draft ACLs
> > Add a check for both POSIX and NFSv4 ACLs being set
> > Add na_dpaclerr and na_paclerr for file creation
> > Add support for POSIX draft ACLs for file creation
> > Add the arguments for decoding of POSIX ACLs
> > Fix a couple of bugs in POSIX ACL decoding
> > Improve correctness for the ACL_TRUEFORM attribute
> > Make sort_pacl_range() global
> > Call sort_pacl_range() for decoded POSIX draft ACLs
> > Fix handling of POSIX ACLs with zero ACEs
> > Fix handling of zero length ACLs for file creation
> > Do not allow (N)VERIFY to check POSIX ACL attributes
> > Set the POSIX ACL attributes supported
> > Change a bunch of function prefixes to nfsd42_
> >
> > fs/nfsd/acl.h | 3 +
> > fs/nfsd/nfs4acl.c | 35 ++++-
> > fs/nfsd/nfs4proc.c | 126 +++++++++++++++--
> > fs/nfsd/nfs4xdr.c | 312 ++++++++++++++++++++++++++++++++++++++++++-
> > fs/nfsd/nfsd.h | 8 +-
> > fs/nfsd/vfs.c | 34 ++++-
> > fs/nfsd/vfs.h | 2 +
> > fs/nfsd/xdr4.h | 6 +
> > include/linux/nfs4.h | 37 +++++
> > 9 files changed, 536 insertions(+), 27 deletions(-)
> >
> > --
> > 2.49.0
>
> Thanks for posting, Rick! What branch/tree/commit did you base this series on?
It's against your nfsd-testing branch of a few days ago.
rick
>
>
> --
> Chuck Lever
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [PATCH v1 00/17] Add NFSv4.2 POSIX ACL support
2025-12-31 2:47 ` [PATCH v1 00/17] Add NFSv4.2 POSIX ACL support Chuck Lever
2025-12-31 2:49 ` Rick Macklem
@ 2025-12-31 2:57 ` Rick Macklem
1 sibling, 0 replies; 21+ messages in thread
From: Rick Macklem @ 2025-12-31 2:57 UTC (permalink / raw)
To: Chuck Lever; +Cc: linux-nfs, Rick Macklem
On Tue, Dec 30, 2025 at 6:48 PM Chuck Lever <cel@kernel.org> wrote:
>
>
>
> On Tue, Dec 30, 2025, at 9:21 PM, rick.macklem@gmail.com wrote:
> > From: Rick Macklem <rmacklem@uoguelph.ca>
> >
> > The Internet draft "POSIX Draft ACL support for
> > Network File System Version 4, Minor Version2"
> > https://datatracker.ietf.org/doc/draft-ietf-nfsv4-posix-acls/
> > describes an extension to NFSv4.2 so that POSIX
> > draft ACLs can get acquired and set directly,
> > without using the loosey NFSv4->POSIX draft mapping
> > algorith. It extends the protocol with four new
> > attributes.
> >
> > This patch series implements the server side of
> > this extension for the knfsd. It is analogous
> > to the NFSACL protocol used as a sideband protocol
> > for NFSv3 and allows the ACLs to be acquired/set
> > be getfacl(1)/setfacl(1).
> >
> > The current implementation does not support the
> > "per file" scope, where individual file objects
> > store/use either an NFSv4 ACL or POSIX draft ACL
> > and assumes POSIX draft ACLs are supported for an
> > entire file system, if support for POSIX draft ACLs
> > is indicated.
> >
> > Rick Macklem (17):
> > Add definitions for the POSIX draft ACL attributes
> > Add a new function to acquire the POSIX draft ACLs
> > Add a function to set POSIX ACLs
> > Add support for encoding/decoding POSIX draft ACLs
> > Add a check for both POSIX and NFSv4 ACLs being set
> > Add na_dpaclerr and na_paclerr for file creation
> > Add support for POSIX draft ACLs for file creation
> > Add the arguments for decoding of POSIX ACLs
> > Fix a couple of bugs in POSIX ACL decoding
> > Improve correctness for the ACL_TRUEFORM attribute
> > Make sort_pacl_range() global
> > Call sort_pacl_range() for decoded POSIX draft ACLs
> > Fix handling of POSIX ACLs with zero ACEs
> > Fix handling of zero length ACLs for file creation
> > Do not allow (N)VERIFY to check POSIX ACL attributes
> > Set the POSIX ACL attributes supported
> > Change a bunch of function prefixes to nfsd42_
> >
> > fs/nfsd/acl.h | 3 +
> > fs/nfsd/nfs4acl.c | 35 ++++-
> > fs/nfsd/nfs4proc.c | 126 +++++++++++++++--
> > fs/nfsd/nfs4xdr.c | 312 ++++++++++++++++++++++++++++++++++++++++++-
> > fs/nfsd/nfsd.h | 8 +-
> > fs/nfsd/vfs.c | 34 ++++-
> > fs/nfsd/vfs.h | 2 +
> > fs/nfsd/xdr4.h | 6 +
> > include/linux/nfs4.h | 37 +++++
> > 9 files changed, 536 insertions(+), 27 deletions(-)
> >
> > --
> > 2.49.0
>
> Thanks for posting, Rick! What branch/tree/commit did you base this series on?
Oh, and the piece that is missing is the tracing stuff. I need to figure
how that's done and was hoping to leave that for a separate patch series?
rick
>
>
> --
> Chuck Lever
^ permalink raw reply [flat|nested] 21+ messages in thread
end of thread, other threads:[~2025-12-31 2:57 UTC | newest]
Thread overview: 21+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-12-31 2:21 [PATCH v1 00/17] Add NFSv4.2 POSIX ACL support rick.macklem
2025-12-31 2:21 ` [PATCH v1 01/17] Add definitions for the POSIX draft ACL attributes rick.macklem
2025-12-31 2:21 ` [PATCH v1 02/17] Add a new function to acquire the POSIX draft ACLs rick.macklem
2025-12-31 2:21 ` [PATCH v1 03/17] Add a function to set POSIX ACLs rick.macklem
2025-12-31 2:21 ` [PATCH v1 04/17] Add support for encoding/decoding POSIX draft ACLs rick.macklem
2025-12-31 2:21 ` [PATCH v1 05/17] Add a check for both POSIX and NFSv4 ACLs being set rick.macklem
2025-12-31 2:21 ` [PATCH v1 06/17] Add na_dpaclerr and na_paclerr for file creation rick.macklem
2025-12-31 2:21 ` [PATCH v1 07/17] Add support for POSIX draft ACLs " rick.macklem
2025-12-31 2:21 ` [PATCH v1 08/17] Add the arguments for decoding of POSIX ACLs rick.macklem
2025-12-31 2:21 ` [PATCH v1 09/17] Fix a couple of bugs in POSIX ACL decoding rick.macklem
2025-12-31 2:21 ` [PATCH v1 10/17] Improve correctness for the ACL_TRUEFORM attribute rick.macklem
2025-12-31 2:21 ` [PATCH v1 11/17] Make sort_pacl_range() global rick.macklem
2025-12-31 2:21 ` [PATCH v1 12/17] Call sort_pacl_range() for decoded POSIX draft ACLs rick.macklem
2025-12-31 2:21 ` [PATCH v1 13/17] Fix handling of POSIX ACLs with zero ACEs rick.macklem
2025-12-31 2:21 ` [PATCH v1 14/17] Fix handling of zero length ACLs for file creation rick.macklem
2025-12-31 2:21 ` [PATCH v1 15/17] Do not allow (N)VERIFY to check POSIX ACL attributes rick.macklem
2025-12-31 2:21 ` [PATCH v1 16/17] Set the POSIX ACL attributes supported rick.macklem
2025-12-31 2:21 ` [PATCH v1 17/17] Change a bunch of function prefixes to nfsd42_ rick.macklem
2025-12-31 2:47 ` [PATCH v1 00/17] Add NFSv4.2 POSIX ACL support Chuck Lever
2025-12-31 2:49 ` Rick Macklem
2025-12-31 2:57 ` Rick Macklem
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox