From: "J. Bruce Fields" <bfields@fieldses.org>
To: Miklos Szeredi <miklos@szeredi.hu>
Cc: Patrick Plagwitz <Patrick_Plagwitz@web.de>,
"linux-unionfs@vger.kernel.org" <linux-unionfs@vger.kernel.org>,
Linux NFS list <linux-nfs@vger.kernel.org>,
linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
Andreas Gruenbacher <agruenba@redhat.com>
Subject: Re: [PATCH] overlayfs: ignore empty NFSv4 ACLs in ext4 upperdir
Date: Mon, 5 Dec 2016 11:25:59 -0500 [thread overview]
Message-ID: <20161205162559.GB17517@fieldses.org> (raw)
In-Reply-To: <CAJfpegtpkavseTFLspaC7svbvHRq-0-7jvyh63+DK5iWHTGnaQ@mail.gmail.com>
On Mon, Dec 05, 2016 at 04:36:03PM +0100, Miklos Szeredi wrote:
> On Mon, Dec 5, 2016 at 4:19 PM, J. Bruce Fields <bfields@fieldses.org> wrote:
> >> Can NFS people comment on this? Where does the nfs4_acl come from?
> >
> > This is the interface the NFS client provides for applications to modify
> > NFSv4 ACLs on servers that support them.
>
> Fine, but why are we seeing this xattr on exports where no xattrs are
> set on the exported fs?
I don't know. I took another look at the original patch and don't see
any details on the server setup: which server is it (knfsd, ganesha,
netapp, ...)? How is it configured?
> >> What can overlayfs do if it's a non-empty ACL?
> >
> > As little as possible. You can't copy it up, can you? So any attempt
> > to support it is going to be incomplete.
>
> Right.
>
> >
> >> Does knfsd translate posix ACL into NFS acl? If so, we can translate
> >> back. Should we do a generic POSIX<->NFS acl translator?
> >
> > knsd does translate between POSIX and NFSv4 ACLs. It's a complicated
>
> This does explain the nfs4_acl xattr on the client. Question: if it's
> empty, why have it at all?
I'm honestly not sure what's going on there. I'd be curious to see a
network trace if possible.
> > algorithm, and lossy (in the NFSv4->POSIX direction). The client
> > developers have been understandably reluctant to have anything to do
> > with it.
> >
> > So, I think listxattr should omit system.nfs4_acl, and attempts to
> > set/get the attribute should error out. The same should apply to any
> > "system." attribute not supported by both filesystems, I think?
>
> Basically that's what happens now. The problem is that nfsv4 mounts
> seem always have these xattrs, even when the exported fs doesn't have
> anything.
I said "both", that's a logical "and". Whether or not nfs claims
support would then be irrelevant in this case, since ext4 doesn't
support system.nfs4_acl.
> We could do the copy up even if the NFS4->POSIX translation was
> possible (which is the case with POSIX ACL translated by knfsd). We'd
> just get back the original ACL, so that's OK.
Note that knfsd is an exception, most NFSv4-acl-supporting servers
aren't translating from POSIX ACLs.
> NFS is only supported as lower (read-only) layer, so we don't care
> about changing the ACL on the server.
Out of curiosity, how do you check permissions after copy up?
The client doesn't do much permissions-checking normally, because it's
hard to get right--even in the absence of ACLs, it may not understand
the server's owners and groups completely.
I guess that's fine, you may be happy to let people write to the file
without permissions to the lower file, since the writes aren't going
there anyway.
So, I don't know what want here.
You're not going to want to use the ACL for actual permission-checking,
and you can't modify it, so it doesn't seem very useful.
--b.
next prev parent reply other threads:[~2016-12-05 16:26 UTC|newest]
Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <5a6862bd-924d-25e4-2a8e-ba4f51e66604@web.de>
2016-12-05 9:28 ` [PATCH] overlayfs: ignore empty NFSv4 ACLs in ext4 upperdir Miklos Szeredi
2016-12-05 15:19 ` J. Bruce Fields
2016-12-05 15:36 ` Miklos Szeredi
2016-12-05 16:25 ` J. Bruce Fields [this message]
2016-12-05 18:25 ` Patrick Plagwitz
2016-12-05 19:37 ` Andreas Grünbacher
2016-12-05 22:58 ` Patrick Plagwitz
2016-12-05 23:19 ` Andreas Grünbacher
2016-12-05 23:24 ` Andreas Grünbacher
2016-12-06 10:08 ` Miklos Szeredi
2016-12-06 13:18 ` Andreas Gruenbacher
2016-12-06 18:58 ` J. Bruce Fields
2019-05-02 2:02 ` NeilBrown
2019-05-02 2:54 ` Amir Goldstein
2019-05-02 3:57 ` NeilBrown
2019-05-02 14:04 ` Andreas Gruenbacher
2019-05-02 14:28 ` Miklos Szeredi
2019-05-02 15:08 ` Andreas Grünbacher
2019-05-02 17:16 ` J. Bruce Fields
2019-05-02 17:53 ` Andreas Gruenbacher
2019-05-02 23:04 ` NeilBrown
2019-05-02 23:24 ` NeilBrown
2019-05-03 6:54 ` Andreas Grünbacher
2019-05-02 17:26 ` Goetz, Patrick G
2019-05-02 17:44 ` Andreas Gruenbacher
2019-05-02 17:51 ` Goetz, Patrick G
2019-05-03 15:27 ` J. Bruce Fields
2019-05-03 17:39 ` Goetz, Patrick G
2019-05-02 4:35 ` [PATCH] OVL: add honoracl=off mount option NeilBrown
2019-05-02 5:08 ` Randy Dunlap
2019-05-02 11:46 ` Amir Goldstein
2019-05-02 23:19 ` NeilBrown
2019-05-02 13:47 ` J. R. Okajima
2019-05-03 15:35 ` [PATCH] overlayfs: ignore empty NFSv4 ACLs in ext4 upperdir J. Bruce Fields
2019-05-03 17:26 ` Amir Goldstein
2019-05-03 17:31 ` J. Bruce Fields
2019-05-03 17:41 ` Amir Goldstein
2019-05-03 17:51 ` Vivek Goyal
2019-05-07 0:24 ` NeilBrown
2019-05-10 20:09 ` J. Bruce Fields
2019-09-18 9:07 ` Miklos Szeredi
2019-09-18 19:49 ` J. Bruce Fields
2019-05-07 8:07 ` Miklos Szeredi
2019-05-07 23:51 ` J. Bruce Fields
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161205162559.GB17517@fieldses.org \
--to=bfields@fieldses.org \
--cc=Patrick_Plagwitz@web.de \
--cc=agruenba@redhat.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-nfs@vger.kernel.org \
--cc=linux-unionfs@vger.kernel.org \
--cc=miklos@szeredi.hu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).