[PATCH v2 7/8] Set SB_POSIXACL if the server supports the extension

[PATCH v2 7/8] Set SB_POSIXACL if the server supports the extension

[rick.macklem]

From: Rick Macklem <rmacklem@uoguelph.ca>

Check to see if both the POSIX draft default ACL and
POSIX draft access ACL are supported by the server.
If so, set SB_POSIXACL.

Signed-off-by: Rick Macklem <rmacklem@uoguelph.ca>
---
 fs/nfs/super.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 57d372db03b9..04c40c9d783a 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1352,6 +1352,13 @@ int nfs_get_tree_common(struct fs_context *fc)
 		goto error_splat_super;
 	}
 
+#ifdef CONFIG_NFS_V4_2
+	/* Set SB_POSIXACL if the server supports the NFSv4.2 extension. */
+	if ((server->attr_bitmask[2] & FATTR4_WORD2_POSIX_DEFAULT_ACL) &&
+	    (server->attr_bitmask[2] & FATTR4_WORD2_POSIX_ACCESS_ACL))
+		s->s_flags |= SB_POSIXACL;
+#endif
+
 	s->s_flags |= SB_ACTIVE;
 	error = 0;
 
-- 
2.49.0

[PATCH v2 0/8] Add NFSv4.2 POSIX ACL support to the client

[rick.macklem]

From: Rick Macklem <rmacklem@uoguelph.ca>

The Internet draft "POSIX Draft ACL support for
Network File System Version 4, Minor Version2"
https://datatracker.ietf.org/doc/draft-ietf-nfsv4-posix-acls/
describes an extension to NFSv4.2 so that POSIX
draft ACLs can get acquired and set directly,
without using the loosey NFSv4->POSIX draft mapping
algorith.  It extends the protocol with four new
attributes.

This patch series implements the client side of
this extension for the nfs client.  It is analogous
to the NFSACL protocol used as a sideband protocol
for NFSv3 and allows the ACLs to be acquired/set
be getfacl(1)/setfacl(1).

The current implementation may not handle the
"per file" scope, where individual file objects
store/use either an NFSv4 ACL or a POSIX draft ACL.
The only known file system that implements this
is IBM's GPFS, and only if the "all" option is
set for ACLs on it.  Until a server implements
this case, it will be difficult to implement
correct client semantics for this case.

The last patch is rather large, but I would
get either build failures or build warnings
when I broke it up into smaller chunks.

The only changes from v1 is the addition of
the 0001 patch from the server series, to
make the kernel test robot happy and a small
change to the calculation of NFS4_ACL_MAXPAGES.

Rick Macklem (8):
  Add definitions for the POSIX draft ACL attributes
  Add entries to the predefined client operations enum
  Add new entries for handling POSIX draft ACLs
  Make posix_acl_from_nfsacl() global
  Make three functions global and move them to acl.c
  Make nfs4_server_supports_acls() global
  Set SB_POSIXACL if the server supports the extension
  Add support for the NFSv4.2 POSIX draft ACL attributes

 fs/nfs/Makefile         |   2 +-
 fs/nfs/nfs.h            |   3 +
 fs/nfs/nfs34acl.c       |  40 +++
 fs/nfs/nfs3acl.c        |  44 +--
 fs/nfs/nfs42proc.c      | 304 +++++++++++++++++++
 fs/nfs/nfs42xdr.c       | 642 ++++++++++++++++++++++++++++++++++++++++
 fs/nfs/nfs4_fs.h        |   9 +
 fs/nfs/nfs4proc.c       |  18 +-
 fs/nfs/nfs4xdr.c        |   2 +
 fs/nfs/super.c          |   5 +
 fs/nfs_common/nfsacl.c  |   3 +-
 include/linux/nfs4.h    |  39 +++
 include/linux/nfs_xdr.h |  59 ++++
 include/linux/nfsacl.h  |   2 +
 14 files changed, 1130 insertions(+), 42 deletions(-)
 create mode 100644 fs/nfs/nfs34acl.c

-- 
2.49.0

[PATCH v2 7/8] Set SB_POSIXACL if the server supports the extension

[rick.macklem]

From: Rick Macklem <rmacklem@uoguelph.ca>

Check to see if both the POSIX draft default ACL and
POSIX draft access ACL are supported by the server.
If so, set SB_POSIXACL.

Signed-off-by: Rick Macklem <rmacklem@uoguelph.ca>
---
 fs/nfs/super.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 57d372db03b9..aa0f53c3d01d 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1352,6 +1352,11 @@ int nfs_get_tree_common(struct fs_context *fc)
 		goto error_splat_super;
 	}
 
+	/* Set SB_POSIXACL if the server supports the NFSv4.2 extension. */
+	if ((server->attr_bitmask[2] & FATTR4_WORD2_POSIX_DEFAULT_ACL) &&
+	    (server->attr_bitmask[2] & FATTR4_WORD2_POSIX_ACCESS_ACL))
+		s->s_flags |= SB_POSIXACL;
+
 	s->s_flags |= SB_ACTIVE;
 	error = 0;
 
-- 
2.49.0

Re: [PATCH v2 7/8] Set SB_POSIXACL if the server supports the extension

[Anna Schumaker]

Hi Rick,

On 1/3/26 6:40 PM, rick.macklem@gmail.com wrote:
> From: Rick Macklem <rmacklem@uoguelph.ca>
> 
> Check to see if both the POSIX draft default ACL and
> POSIX draft access ACL are supported by the server.
> If so, set SB_POSIXACL.
> 
> Signed-off-by: Rick Macklem <rmacklem@uoguelph.ca>
> ---
>  fs/nfs/super.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/fs/nfs/super.c b/fs/nfs/super.c
> index 57d372db03b9..aa0f53c3d01d 100644
> --- a/fs/nfs/super.c
> +++ b/fs/nfs/super.c
> @@ -1352,6 +1352,11 @@ int nfs_get_tree_common(struct fs_context *fc)
>  		goto error_splat_super;
>  	}
>  
> +	/* Set SB_POSIXACL if the server supports the NFSv4.2 extension. */
> +	if ((server->attr_bitmask[2] & FATTR4_WORD2_POSIX_DEFAULT_ACL) &&
> +	    (server->attr_bitmask[2] & FATTR4_WORD2_POSIX_ACCESS_ACL))
> +		s->s_flags |= SB_POSIXACL;

Just a heads up that server->attr_bitmask only exists if the kernel is configured
with CONFIG_NFS_V4=y, so the compiler will complain about this:

fs/nfs/super.c:1348:15: error: no member named 'attr_bitmask' in 'struct nfs_server'
 1348 |         if ((server->attr_bitmask[2] & FATTR4_WORD2_POSIX_DEFAULT_ACL) &&
      |              ~~~~~~  ^
fs/nfs/super.c:1349:15: error: no member named 'attr_bitmask' in 'struct nfs_server'
 1349 |             (server->attr_bitmask[2] & FATTR4_WORD2_POSIX_ACCESS_ACL))
      |              ~~~~~~  ^
2 errors generated.

You'll probably need to either move it into NFS v4 specific code or hide it behind
and #ifdef.

Thanks,
Anna

> +
>  	s->s_flags |= SB_ACTIVE;
>  	error = 0;
>  

Re: [PATCH v2 7/8] Set SB_POSIXACL if the server supports the extension

[Rick Macklem]

On Mon, Jan 5, 2026 at 2:02 PM Anna Schumaker <anna.schumaker@oracle.com> wrote:
>
> Hi Rick,
>
> On 1/3/26 6:40 PM, rick.macklem@gmail.com wrote:
> > From: Rick Macklem <rmacklem@uoguelph.ca>
> >
> > Check to see if both the POSIX draft default ACL and
> > POSIX draft access ACL are supported by the server.
> > If so, set SB_POSIXACL.
> >
> > Signed-off-by: Rick Macklem <rmacklem@uoguelph.ca>
> > ---
> >  fs/nfs/super.c | 5 +++++
> >  1 file changed, 5 insertions(+)
> >
> > diff --git a/fs/nfs/super.c b/fs/nfs/super.c
> > index 57d372db03b9..aa0f53c3d01d 100644
> > --- a/fs/nfs/super.c
> > +++ b/fs/nfs/super.c
> > @@ -1352,6 +1352,11 @@ int nfs_get_tree_common(struct fs_context *fc)
> >               goto error_splat_super;
> >       }
> >
> > +     /* Set SB_POSIXACL if the server supports the NFSv4.2 extension. */
> > +     if ((server->attr_bitmask[2] & FATTR4_WORD2_POSIX_DEFAULT_ACL) &&
> > +         (server->attr_bitmask[2] & FATTR4_WORD2_POSIX_ACCESS_ACL))
> > +             s->s_flags |= SB_POSIXACL;
>
> Just a heads up that server->attr_bitmask only exists if the kernel is configured
> with CONFIG_NFS_V4=y, so the compiler will complain about this:
>
> fs/nfs/super.c:1348:15: error: no member named 'attr_bitmask' in 'struct nfs_server'
>  1348 |         if ((server->attr_bitmask[2] & FATTR4_WORD2_POSIX_DEFAULT_ACL) &&
>       |              ~~~~~~  ^
> fs/nfs/super.c:1349:15: error: no member named 'attr_bitmask' in 'struct nfs_server'
>  1349 |             (server->attr_bitmask[2] & FATTR4_WORD2_POSIX_ACCESS_ACL))
>       |              ~~~~~~  ^
> 2 errors generated.
>
> You'll probably need to either move it into NFS v4 specific code or hide it behind
> and #ifdef.
I think hiding it behind an #ifdef is the obvious solution.
(Why would anyone not want NFSv4;-)

(I cannot see how the NFSv4 specific code gets called when the superblock
gets set up. I know that the generic superblock code cannot call anything in
the NFSv4 code. Already made that mistake and ended up with a cycle in
the module dependencies.)

I can repost the patch in a couple of weeks.
(I have limited access to the Linux system I run at home until end of March.)

If you happen to be inspired to do so, you are welcome to fix it.

Thanks for letting me know, rick

>
> Thanks,
> Anna
>
> > +
> >       s->s_flags |= SB_ACTIVE;
> >       error = 0;
> >
>