[PATCH v1 13/17] Fix handling of POSIX ACLs with zero ACEs

[rick.macklem@gmail.com]

From: Rick Macklem <rmacklem@uoguelph.ca>

The NFSv4.2 code does a SETATTR with a POSIX draft default ACL
of zero ACEs to delete the default ACL.  This patch fixes handling
of this case.

Note that the server code does not handle the case where
a file system is of ACL_SCOPE_FILE OBJECT (which means that
NFS4 and POSIX draft ACLs are mixed as the "true form" ACL
for different file objects in the file system).

Signed-off-by: Rick Macklem <rmacklem@uoguelph.ca>
---
 fs/nfsd/nfs4proc.c | 30 ++++++++++++++++++++++++------
 1 file changed, 24 insertions(+), 6 deletions(-)

diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index a172bd253086..1dab7d3aa11e 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1215,12 +1215,30 @@ nfsd4_proc_setacl(struct svc_rqst *rqstp, svc_fh *fh, struct inode *inode,
 
 	inode_lock(inode);
 
-	if (dpacl != NULL)
-		error = set_posix_acl(&nop_mnt_idmap, fh->fh_dentry,
-				      ACL_TYPE_DEFAULT, dpacl);
-	if (!error && pacl != NULL)
-		error = set_posix_acl(&nop_mnt_idmap, fh->fh_dentry,
-				      ACL_TYPE_ACCESS, pacl);
+	if (dpacl != NULL) {
+		/* a_count == 0 means delete the ACL. */
+		if (dpacl->a_count > 0)
+			error = set_posix_acl(&nop_mnt_idmap, fh->fh_dentry,
+					      ACL_TYPE_DEFAULT, dpacl);
+		else
+			error = set_posix_acl(&nop_mnt_idmap, fh->fh_dentry,
+					      ACL_TYPE_DEFAULT, NULL);
+	}
+	if (!error && pacl != NULL) {
+		/*
+		 * For any file system that is not ACL_SCOPE_FILE_OBJECT,
+		 * a_count == 0 MUST reply nfserr_inval.
+		 * For a file system that is ACL_SCOPE_FILE_OBJECT,
+		 * a_count == 0 means delete the ACL.
+		 * XXX File systems that are ACL_SCOPE_FILE_OBJECT
+		 * are not yet supported.
+		 */
+		if (pacl->a_count > 0)
+			error = set_posix_acl(&nop_mnt_idmap, fh->fh_dentry,
+					      ACL_TYPE_ACCESS, pacl);
+		else
+			error = -EINVAL;
+	}
 
 	inode_unlock(inode);
 	return nfserrno(error);
-- 
2.49.0