From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.4 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_PASS,USER_AGENT_MUTT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0898BC004C9 for ; Tue, 7 May 2019 23:51:18 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id BCEA320C01 for ; Tue, 7 May 2019 23:51:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726378AbfEGXvQ (ORCPT ); Tue, 7 May 2019 19:51:16 -0400 Received: from fieldses.org ([173.255.197.46]:59706 "EHLO fieldses.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726091AbfEGXvQ (ORCPT ); Tue, 7 May 2019 19:51:16 -0400 Received: by fieldses.org (Postfix, from userid 2815) id 583C51DCB; Tue, 7 May 2019 19:51:15 -0400 (EDT) Date: Tue, 7 May 2019 19:51:15 -0400 From: "J. Bruce Fields" To: Miklos Szeredi Cc: NeilBrown , Andreas Gruenbacher , Andreas =?utf-8?Q?Gr=C3=BCnbacher?= , Patrick Plagwitz , "linux-unionfs@vger.kernel.org" , Linux NFS list , Linux FS-devel Mailing List , Linux Kernel Mailing List Subject: Re: [PATCH] overlayfs: ignore empty NFSv4 ACLs in ext4 upperdir Message-ID: <20190507235115.GB16853@fieldses.org> References: <266c571f-e4e2-7c61-5ee2-8ece0c2d06e9@web.de> <20161206185806.GC31197@fieldses.org> <87bm0l4nra.fsf@notabene.neil.brown.name> <20190503153531.GJ12608@fieldses.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-nfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org On Tue, May 07, 2019 at 04:07:21AM -0400, Miklos Szeredi wrote: > On Fri, May 3, 2019 at 11:35 AM J. Bruce Fields wrote: > > > > On Thu, May 02, 2019 at 12:02:33PM +1000, NeilBrown wrote: > > > > Silently not copying the ACLs is probably not a good idea as it might > > > result in inappropriate permissions being given away. So if the > > > sysadmin wants this (and some clearly do), they need a way to > > > explicitly say "I accept the risk". > > > > So, I feel like silently copying ACLs up *also* carries a risk, if that > > means switching from server-enforcement to client-enforcement of those > > permissions. > > That's not correct: permissions are checked on the overlay layer, > regardless of where the actual file resides. For filesystems using a > server enforced permission model that means possibly different > permissions for accesses through overlayfs than for accesses without > overlayfs. Apparently this is missing from the documentation and > definitely needs to be added. Well, we did have a thread on this pretty recently, I think, and I'm just not remembering the conclusion. Yes, it'd be nice to have this documented. In the case of NFSv4 ACLs, we not only lack storage for them, we don't even have code to evaluate them. --b. > So I think it's perfectly fine to allow copying up ACLs, as long as > the ACL is representable on the upper fs. If that cannot be ensured, > then the only sane thing to do is to disable ACL checking across the > overlay ("noacl" option).