linux-kernel - Re: A pass-through support for NFSv4 style ACL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 16 May 2023 17:22:30 -0400
From:   Jeff Layton <jlayton@...nel.org>
To:     Ondrej Valousek <ondrej.valousek.xm@...esas.com>,
        Christian Brauner <brauner@...nel.org>
Cc:     "trondmy@...merspace.com" <trondmy@...merspace.com>,
        "linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: A pass-through support for NFSv4 style ACL

On Tue, 2023-05-16 at 20:50 +0000, Ondrej Valousek wrote:
> 
> Hi Christian,
> 
> Would it be possible to patch kernel the way it accepts native (i.e no
> conversion to Posix ACL) NFSv4 style ACLs for filesystems that can
> support them?
> I.E. OpenZFS, NTFS, could be also interesting for Microsofts WSL2  or
> Samba right?
> 
> I mean, I am not trying to push richacl again knowing they have been
> rejected, but just NFS4 style Acls as they are so similar to Windows
> ACLs.
> 

Erm, except you kind of are if you want to do this. I don't see how this
idea works unless you resurrect RichACLs or something like them.

> The idea here would be that we could
> - mount NTFS/ZFS filesystem and inspect ACLs using existing tools
> (nfs4_getacl)
> - share with NFSv4 in a pass through mode
> - in Windows WSL2 we could inspect local filesystem ACLs using the
> same tools
> 
> Does it make any sense or it would require lot of changes to VFS
> subsystem or its a nonsense altogether?
> 

Eventually you have to actually enforce the ACL. Do NTFS/ZFS already
have code to do this? If not then someone would need to write it.

Also windows and nfs acls do have some differences, so you'll need a
translation layer too.
-- 
Jeff Layton <jlayton@...nel.org>