[PATCH v1 13/17] Fix handling of POSIX ACLs with zero ACEs

rick.macklem
2025-12-31T02:22:32Z

The NFSv4.2 code does a SETATTR with a POSIX draft default ACL
of zero ACEs to delete the default ACL. This patch fixes handling
of this case.

Note that the server code does not handle the case where
a file system is of ACL_SCOPE_FILE OBJECT (which means that
NFS4 and POSIX draft ACLs are mixed as the "true form" ACL
for different file objects in the file system).

Signed-off-by: Rick Macklem <rmacklem@uoguelph.ca>
---
fs/nfsd/nfs4proc.c | 30 ++++++++++++++++++++++++------
1 file changed, 24 insertions(+), 6 deletions(-)

diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index a172bd253086..1dab7d3aa11e 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1215,12 +1215,30 @@ nfsd4_proc_setacl(struct svc_rqst *rqstp, svc_fh *fh, struct inode *inode,

inode_lock(inode);

- if (dpacl != NULL)
- error = set_posix_acl(&nop_mnt_idmap, fh->fh_dentry,
- ACL_TYPE_DEFAULT, dpacl);
- if (!error && pacl != NULL)
- error = set_posix_acl(&nop_mnt_idmap, fh->fh_dentry,
- ACL_TYPE_ACCESS, pacl);
+ if (dpacl != NULL) {
+ /* a_count == 0 means delete the ACL. */
+ if (dpacl->a_count > 0)
+ error = set_posix_acl(&nop_mnt_idmap, fh->fh_dentry,
+ ACL_TYPE_DEFAULT, dpacl);
+ else
+ error = set_posix_acl(&nop_mnt_idmap, fh->fh_dentry,
+ ACL_TYPE_DEFAULT, NULL);
+ }
+ if (!error && pacl != NULL) {
+ /*
+ * For any file system that is not ACL_SCOPE_FILE_OBJECT,
+ * a_count == 0 MUST reply nfserr_inval.
+ * For a file system that is ACL_SCOPE_FILE_OBJECT,
+ * a_count == 0 means delete the ACL.
+ * XXX File systems that are ACL_SCOPE_FILE_OBJECT
+ * are not yet supported.
+ */
+ if (pacl->a_count > 0)
+ error = set_posix_acl(&nop_mnt_idmap, fh->fh_dentry,
+ ACL_TYPE_ACCESS, pacl);
+ else
+ error = -EINVAL;
+ }

inode_unlock(inode);
return nfserrno(error);
--
2.49.0