[RFC PATCH v2 07/11] NFSD: add NFS4ACL_DACL and NFS4ACL_SACL passthru support

Mike Snitzer
2026-02-24T19:24:49Z

This 4.1 DACL and SACL support is confined to NFSD's NFS reexport case
(e.g. when NFSD 4.1 reexports NFS 4.2).

Signed-off-by: Mike Snitzer <snitzer@hammerspace.com>
---
fs/nfsd/nfs4proc.c | 3 +++
fs/nfsd/nfs4xdr.c | 49 ++++++++++++++++++++++++++++++++++++++--------
fs/nfsd/nfsd.h | 5 +++--
3 files changed, 47 insertions(+), 10 deletions(-)

diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index d05ac00f934e..4a43e5052deb 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -91,6 +91,9 @@ check_attr_support(struct nfsd4_compound_state *cstate, u32 *bmval,
return nfserr_attrnotsupp;
if ((bmval[0] & FATTR4_WORD0_ACL) && !nfsd_supports_nfs4_acl(dentry))
return nfserr_attrnotsupp;
+ if ((bmval[1] & (FATTR4_WORD1_DACL | FATTR4_WORD1_SACL)) &&
+ !nfsd_supports_nfs4_acl(dentry))
+ return nfserr_attrnotsupp;
if ((bmval[2] & (FATTR4_WORD2_POSIX_DEFAULT_ACL |
FATTR4_WORD2_POSIX_ACCESS_ACL)) &&
!IS_POSIXACL(d_inode(dentry)))
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 80d2e7ea8cc9..99db768ad97e 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -315,7 +315,13 @@ __be32 nfsd4_decode_nfs4_acl_passthru(struct nfsd4_compoundargs *argp,
goto out;
}

- (*acl)->type = NFS4ACL_ACL;
+ if (bmval[0] & FATTR4_WORD0_ACL)
+ (*acl)->type = NFS4ACL_ACL;
+ else if (bmval[1] & FATTR4_WORD1_DACL)
+ (*acl)->type = NFS4ACL_DACL;
+ else if (bmval[1] & FATTR4_WORD1_SACL)
+ (*acl)->type = NFS4ACL_SACL;
+
(*acl)->len = acl_len;
(*acl)->pgbase = pgbase;

@@ -571,7 +577,8 @@ nfsd4_decode_fattr4(struct nfsd4_compoundargs *argp, u32 *bmval, u32 bmlen,
iattr->ia_size = size;
iattr->ia_valid |= ATTR_SIZE;
}
- if (bmval[0] & FATTR4_WORD0_ACL) {
+ if (bmval[0] & FATTR4_WORD0_ACL ||
+ (bmval[1] & (FATTR4_WORD1_DACL | FATTR4_WORD1_SACL))) {
status = nfsd4_decode_acl(argp, acl, attrlist4_count);
if (status)
return status;
@@ -3253,8 +3260,12 @@ static __be32 nfsd4_encode_fattr4_supported_attrs(struct xdr_stream *xdr,
u32 supp[3];

memcpy(supp, nfsd_suppattrs[minorversion], sizeof(supp));
- if (!nfsd_supports_nfs4_acl(args->dentry))
- supp[0] &= ~FATTR4_WORD0_ACL;
+ if (!nfsd_supports_nfs4_acl(args->dentry)) {
+ if (supp[0] & FATTR4_WORD0_ACL)
+ supp[0] &= ~FATTR4_WORD0_ACL;
+ else if ((supp[1] & (FATTR4_WORD1_DACL | FATTR4_WORD1_SACL)))
+ supp[1] &= ~(FATTR4_WORD1_DACL | FATTR4_WORD1_SACL);
+ }
if (!args->contextsupport)
supp[2] &= ~FATTR4_WORD2_SECURITY_LABEL;

@@ -3689,8 +3700,12 @@ static __be32 nfsd4_encode_fattr4_suppattr_exclcreat(struct xdr_stream *xdr,
u32 supp[3];

memcpy(supp, nfsd_suppattrs[resp->cstate.minorversion], sizeof(supp));
- if (!nfsd_supports_nfs4_acl(args->dentry))
- supp[0] &= ~FATTR4_WORD0_ACL;
+ if (!nfsd_supports_nfs4_acl(args->dentry)) {
+ if (supp[0] & FATTR4_WORD0_ACL)
+ supp[0] &= ~FATTR4_WORD0_ACL;
+ else if ((supp[1] & (FATTR4_WORD1_DACL | FATTR4_WORD1_SACL)))
+ supp[1] &= ~(FATTR4_WORD1_DACL | FATTR4_WORD1_SACL);
+ }
if (!args->contextsupport)
supp[2] &= ~FATTR4_WORD2_SECURITY_LABEL;

@@ -3879,8 +3894,8 @@ static const nfsd4_enc_attr nfsd4_enc_fattr4_encode_ops[] = {
[FATTR4_MOUNTED_ON_FILEID] = nfsd4_encode_fattr4_mounted_on_fileid,
[FATTR4_DIR_NOTIF_DELAY] = nfsd4_encode_fattr4__noop,
[FATTR4_DIRENT_NOTIF_DELAY] = nfsd4_encode_fattr4__noop,
- [FATTR4_DACL] = nfsd4_encode_fattr4__noop,
- [FATTR4_SACL] = nfsd4_encode_fattr4__noop,
+ [FATTR4_DACL] = nfsd4_encode_fattr4_acl,
+ [FATTR4_SACL] = nfsd4_encode_fattr4_acl,
[FATTR4_CHANGE_POLICY] = nfsd4_encode_fattr4__noop,
[FATTR4_FS_STATUS] = nfsd4_encode_fattr4__noop,

@@ -4067,6 +4082,24 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr,
goto out;
} else if (err != 0)
goto out_nfserr;
+ } else if (attrmask[1] & FATTR4_WORD1_DACL) {
+ err = nfsd4_get_nfs4_acl(rqstp, dentry, NFS4ACL_DACL, &args.acl);
+ if (err == -EOPNOTSUPP)
+ attrmask[1] &= ~FATTR4_WORD1_DACL;
+ else if (err == -EINVAL) {
+ status = nfserr_attrnotsupp;
+ goto out;
+ } else if (err != 0)
+ goto out_nfserr;
+ } else if (attrmask[1] & FATTR4_WORD1_SACL) {
+ err = nfsd4_get_nfs4_acl(rqstp, dentry, NFS4ACL_SACL, &args.acl);
+ if (err == -EOPNOTSUPP)
+ attrmask[1] &= ~FATTR4_WORD1_SACL;
+ else if (err == -EINVAL) {
+ status = nfserr_attrnotsupp;
+ goto out;
+ } else if (err != 0)
+ goto out_nfserr;
}

args.contextsupport = false;
diff --git a/fs/nfsd/nfsd.h b/fs/nfsd/nfsd.h
index 7c009f07c90b..0f2aaabf4f8c 100644
--- a/fs/nfsd/nfsd.h
+++ b/fs/nfsd/nfsd.h
@@ -447,7 +447,8 @@ enum {
NFSD4_SUPPORTED_ATTRS_WORD0

#define NFSD4_1_SUPPORTED_ATTRS_WORD1 \
- (NFSD4_SUPPORTED_ATTRS_WORD1 | PNFSD_SUPPORTED_ATTRS_WORD1)
+ (NFSD4_SUPPORTED_ATTRS_WORD1 | PNFSD_SUPPORTED_ATTRS_WORD1 | \
+ FATTR4_WORD1_DACL | FATTR4_WORD1_SACL)

#define NFSD4_1_SUPPORTED_ATTRS_WORD2 \
(NFSD4_SUPPORTED_ATTRS_WORD2 | PNFSD_SUPPORTED_ATTRS_WORD2 | \
@@ -540,7 +541,7 @@ static inline bool nfsd_attrs_supported(u32 minorversion, const u32 *bmval)
#define NFSD_WRITEABLE_ATTRS_WORD1 \
(FATTR4_WORD1_MODE | FATTR4_WORD1_OWNER | FATTR4_WORD1_OWNER_GROUP \
| FATTR4_WORD1_TIME_ACCESS_SET | FATTR4_WORD1_TIME_CREATE \
- | FATTR4_WORD1_TIME_MODIFY_SET)
+ | FATTR4_WORD1_TIME_MODIFY_SET | FATTR4_WORD1_DACL | FATTR4_WORD1_SACL)
#ifdef CONFIG_NFSD_V4_SECURITY_LABEL
#define MAYBE_FATTR4_WORD2_SECURITY_LABEL \
FATTR4_WORD2_SECURITY_LABEL
--
2.44.0