getfacl gives octal output for Hebrew user/group names

getfacl gives octal output for Hebrew user/group names

[Anoop Vijayan]

Hello!

Running RHEL5 U2 x86_64, with Samba & Winbind configure to work with Active-Directory env.
Users & Groups in the Active-Directory are in hebrew and locale settings are correct (Hebrew/UTF-8)
Posix Acls on file has special characters ('\' & hebrew chars) for the group/user names.
In circumstances like this, where the user/group accounts come from an AD
server, getfacl could be showing the "invalid" characters as octal.
Example:

[root]# getfacl a.a
# file: a.a
# owner: GTS\134\327\236\327\225\327\251\327\225\327\237
# group: root
user::rw-
group::r--
group:GTS\134\327\251\327\236\327\225\327\250:-w-
group:GTS\134\327\251\327\250\327\252:r-x
mask::rwx
other::r--

Now - we are also have GPFS fs and when we run the mmgetacl command the Posix
acls in Hebrew showed OK.

I am trying to work out a patch which fixes this and the issue seems to be here
const char *quote(const char *str)
{
     static char *quoted_str;
     static size_t quoted_str_len;
     const unsigned char *s;
     char *q;
     size_t nonpr;

     if (!str)
         return str;

     for (nonpr = 0, s = (unsigned char *)str; *s != '\0'; s++)
         if (!isprint(*s) || isspace(*s) || *s == '\\' || *s == '=') <========
             nonpr++;
     if (nonpr == 0)
         return str;

     if (high_water_alloc((void **)&quoted_str, &quoted_str_len,
                  (s - (unsigned char *)str) + nonpr * 3 + 1))
         return NULL;
     for (s = (unsigned char *)str, q = quoted_str; *s != '\0'; s++) {
         if (!isprint(*s) || isspace(*s) || *s == '\\' || *s == '=') { <========
             *q++ = '\\';
             *q++ = '0' + ((*s >> 6)    );
             *q++ = '0' + ((*s >> 3) & 7);
             *q++ = '0' + ((*s     ) & 7);
         } else
             *q++ = *s;
     }

Removing the checks isprint(*s) and *s == '\\' resolves the issue.
AD shares are associated with a doamin name and AD users/groups will be in the format Dom\user.
Can someone explain why these checks are required?

PS. Please include me in the reply as I have not subscribed to this list.

Cheers!
- Anoop

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs

Re: getfacl gives octal output for Hebrew user/group names

[Eric Sandeen]

Anoop Vijayan wrote:
> Hello!
> 
> Running RHEL5 U2 x86_64, with Samba & Winbind configure to work with Active-Directory env.
> Users & Groups in the Active-Directory are in hebrew and locale settings are correct (Hebrew/UTF-8)
> Posix Acls on file has special characters ('\' & hebrew chars) for the group/user names.
> In circumstances like this, where the user/group accounts come from an AD
> server, getfacl could be showing the "invalid" characters as octal.
> Example:

cc'ing back to the new acl list.

-Eric

> [root]# getfacl a.a
> # file: a.a
> # owner: GTS\134\327\236\327\225\327\251\327\225\327\237
> # group: root
> user::rw-
> group::r--
> group:GTS\134\327\251\327\236\327\225\327\250:-w-
> group:GTS\134\327\251\327\250\327\252:r-x
> mask::rwx
> other::r--
> 
> Now - we are also have GPFS fs and when we run the mmgetacl command the Posix
> acls in Hebrew showed OK.
> 
> I am trying to work out a patch which fixes this and the issue seems to be here
> const char *quote(const char *str)
> {
>      static char *quoted_str;
>      static size_t quoted_str_len;
>      const unsigned char *s;
>      char *q;
>      size_t nonpr;
> 
>      if (!str)
>          return str;
> 
>      for (nonpr = 0, s = (unsigned char *)str; *s != '\0'; s++)
>          if (!isprint(*s) || isspace(*s) || *s == '\\' || *s == '=') <========
>              nonpr++;
>      if (nonpr == 0)
>          return str;
> 
>      if (high_water_alloc((void **)&quoted_str, &quoted_str_len,
>                   (s - (unsigned char *)str) + nonpr * 3 + 1))
>          return NULL;
>      for (s = (unsigned char *)str, q = quoted_str; *s != '\0'; s++) {
>          if (!isprint(*s) || isspace(*s) || *s == '\\' || *s == '=') { <========
>              *q++ = '\\';
>              *q++ = '0' + ((*s >> 6)    );
>              *q++ = '0' + ((*s >> 3) & 7);
>              *q++ = '0' + ((*s     ) & 7);
>          } else
>              *q++ = *s;
>      }
> 
> Removing the checks isprint(*s) and *s == '\\' resolves the issue.
> AD shares are associated with a doamin name and AD users/groups will be in the format Dom\user.
> Can someone explain why these checks are required?
> 
> PS. Please include me in the reply as I have not subscribed to this list.
> 
> Cheers!
> - Anoop
> 
> _______________________________________________
> xfs mailing list
> xfs@oss.sgi.com
> http://oss.sgi.com/mailman/listinfo/xfs
> 

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs

Re: getfacl gives octal output for Hebrew user/group names

[Andreas Gruenbacher]

Anoop,

On Wednesday 17 June 2009 15:31:56 Anoop Vijayan wrote:
> Hello!
>
> Running RHEL5 U2 x86_64, with Samba & Winbind configure to work with
> Active-Directory env. Users & Groups in the Active-Directory are in hebrew
> and locale settings are correct (Hebrew/UTF-8) Posix Acls on file has
> special characters ('\' & hebrew chars) for the group/user names. In
> circumstances like this, where the user/group accounts come from an AD
> server, getfacl could be showing the "invalid" characters as octal.
> Example:
>
> [root]# getfacl a.a
> # file: a.a
> # owner: GTS\134\327\236\327\225\327\251\327\225\327\237
> # group: root
> user::rw-
> group::r--
> group:GTS\134\327\251\327\236\327\225\327\250:-w-
> group:GTS\134\327\251\327\250\327\252:r-x
> mask::rwx
> other::r--
>
> Now - we are also have GPFS fs and when we run the mmgetacl command the
> Posix acls in Hebrew showed OK.
>
> I am trying to work out a patch which fixes this and the issue seems to be
> here
> const char *quote(const char *str)
> [...]
>
> Removing the checks isprint(*s) and *s == '\\' resolves the issue.
> AD shares are associated with a doamin name and AD users/groups will be in
> the format Dom\user. Can someone explain why these checks are required?

The '\\' check is required so that backslashes will go through 
unquote(quote(string)) will come out correctly.

The isprint() check is a misguided attempt to do something reasonable with 
unprintable characters, but it leads to lots of problems with different 
encodings, so it should probably be removed. I'll fix that.

There also is a check for '=' in quote(). This is from the attr package which 
separates names and values with '=', but unnecessary in acl. quote() should 
probably be passed in a string of additional characters that need to be quoted 
so that it does the right thing in both packages.

Thanks,
Andreas

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs

Re: getfacl gives octal output for Hebrew user/group names

[Anoop Vijayan]

[-- Attachment #1: Type: text/plain, Size: 1348 bytes --]

Andreas,
>> Removing the checks isprint(*s) and *s == '\\' resolves the issue.
>> AD shares are associated with a doamin name and AD users/groups will be in
>> the format Dom\user. Can someone explain why these checks are required?
> 
> The '\\' check is required so that backslashes will go through 
> unquote(quote(string)) will come out correctly.
> 
> The isprint() check is a misguided attempt to do something reasonable with 
> unprintable characters, but it leads to lots of problems with different 
> encodings, so it should probably be removed. I'll fix that.
> 
> There also is a check for '=' in quote(). This is from the attr package which 
> separates names and values with '=', but unnecessary in acl. quote() should 
> probably be passed in a string of additional characters that need to be quoted 
> so that it does the right thing in both packages.

The do_print() in getfacl/getfacl.c calls

printf("# owner: %s\n", xquote(user_name(st->st_uid, opt_numeric)));
printf("# group: %s\n", xquote(group_name(st->st_gid, opt_numeric)));

and xquote simply calls quote().

Also, acl_entry_to_any_str() in libacl/__acl_to_any_text.c calls quote.
I could not find the corresponding unquote calls for these.

If I wrap the above quote() calls with unquote(), the problem seems to be resolved.
Attaching a patch for the same.

Cheers!
Anoop

[-- Attachment #2: getfacl-2.2.47.patch.2 --]
[-- Type: application/x-troff-man, Size: 1142 bytes --]

[-- Attachment #3: Type: text/plain, Size: 121 bytes --]

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs

Re: [Acl-devel] Re: getfacl gives octal output for Hebrew user/group names

[Andreas Gruenbacher]

On Monday 22 June 2009 09:30:12 Anoop Vijayan wrote:
> Also, acl_entry_to_any_str() in libacl/__acl_to_any_text.c calls quote.
> I could not find the corresponding unquote calls for these.

See acl_from_text() and several functions in setfacl/parse.c.

> If I wrap the above quote() calls with unquote(), the problem seems to be
> resolved. Attaching a patch for the same.

Yes, but this only proves that the quote and unquote functions work as 
intended, it doesn't help fix the underlying problem at all that special 
characters in file, user, or group names can mess up the output.

I have updated the quoting code in the acl and attr packages now so that it 
will only quote a few special characters line newline, carriage return, and a 
few delimiter characters. So this should work for Hebrew or other special 
characters now.

Note that there is no way to not quote backslash as backslash is the escape 
character used, so Samba names of the form "domain\user" will still be quoted. 
It's possible to teach winbindd to use a different character; otherwise, 
you'll have to live with the quoting.)

Thanks,
Andreas

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs