linux-kernel - Re: [PATCH] nfsd: inherit required unset default acls from effective set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <32b660c62f2abb17695816b83c41ae15b065b70e.camel@kernel.org>
Date:   Wed, 19 Jul 2023 15:12:13 -0400
From:   Jeff Layton <jlayton@...nel.org>
To:     Chuck Lever III <chuck.lever@...cle.com>
Cc:     Neil Brown <neilb@...e.de>, Olga Kornievskaia <kolga@...app.com>,
        Dai Ngo <dai.ngo@...cle.com>, Tom Talpey <tom@...pey.com>,
        Linux NFS Mailing List <linux-nfs@...r.kernel.org>,
        linux-fsdevel <linux-fsdevel@...r.kernel.org>,
        open list <linux-kernel@...r.kernel.org>,
        Ondrej Valousek <ondrej.valousek@...semi.com>,
        Andreas Gruenbacher <agruen@...hat.com>
Subject: Re: [PATCH] nfsd: inherit required unset default acls from
 effective set

On Wed, 2023-07-19 at 19:02 +0000, Chuck Lever III wrote:
> 
> > On Jul 19, 2023, at 1:49 PM, Jeff Layton <jlayton@...nel.org> wrote:
> > 
> > A well-formed NFSv4 ACL will always contain OWNER@...OUP@...ERYONE@
> > ACEs, but there is no requirement for inheritable entries for those
> > entities. POSIX ACLs must always have owner/group/other entries, even for a
> > default ACL.
> > 
> > nfsd builds the default ACL from inheritable ACEs, but the current code
> > just leaves any unspecified ACEs zeroed out. The result is that adding a
> > default user or group ACE to an inode can leave it with unwanted deny
> > entries.
> > 
> > For instance, a newly created directory with no acl will look something
> > like this:
> > 
> > # NFSv4 translation by server
> > A::OWNER@:rwaDxtTcCy
> > A::GROUP@:rxtcy
> > A::EVERYONE@:rxtcy
> > 
> > # POSIX ACL of underlying file
> > user::rwx
> > group::r-x
> > other::r-x
> > 
> > ...if I then add new v4 ACE:
> > 
> > nfs4_setfacl -a A:fd:1000:rwx /mnt/local/test
> > 
> > ...I end up with a result like this today:
> > 
> > user::rwx
> > user:1000:rwx
> > group::r-x
> > mask::rwx
> > other::r-x
> > default:user::---
> > default:user:1000:rwx
> > default:group::---
> > default:mask::rwx
> > default:other::---
> > 
> > A::OWNER@:rwaDxtTcCy
> > A::1000:rwaDxtcy
> > A::GROUP@:rxtcy
> > A::EVERYONE@:rxtcy
> > D:fdi:OWNER@:rwaDx
> > A:fdi:OWNER@:tTcCy
> > A:fdi:1000:rwaDxtcy
> > A:fdi:GROUP@:tcy
> > A:fdi:EVERYONE@:tcy
> > 
> > ...which is not at all expected. Adding a single inheritable allow ACE
> > should not result in everyone else losing access.
> > 
> > The setfacl command solves a silimar issue by copying owner/group/other
> > entries from the effective ACL when none of them are set:
> > 
> >    "If a Default ACL entry is created, and the  Default  ACL  contains  no
> >     owner,  owning group,  or  others  entry,  a  copy of the ACL owner,
> >     owning group, or others entry is added to the Default ACL.
> > 
> > Having nfsd do the same provides a more sane result (with no deny ACEs
> > in the resulting set):
> > 
> > user::rwx
> > user:1000:rwx
> > group::r-x
> > mask::rwx
> > other::r-x
> > default:user::rwx
> > default:user:1000:rwx
> > default:group::r-x
> > default:mask::rwx
> > default:other::r-x
> > 
> > A::OWNER@:rwaDxtTcCy
> > A::1000:rwaDxtcy
> > A::GROUP@:rxtcy
> > A::EVERYONE@:rxtcy
> > A:fdi:OWNER@:rwaDxtTcCy
> > A:fdi:1000:rwaDxtcy
> > A:fdi:GROUP@:rxtcy
> > A:fdi:EVERYONE@:rxtcy
> > 
> > Link: https://bugzilla.redhat.com/show_bug.cgi?id=2136452
> > Reported-by: Ondrej Valousek <ondrej.valousek@...semi.com>
> > Suggested-by: Andreas Gruenbacher <agruen@...hat.com>
> > Signed-off-by: Jeff Layton <jlayton@...nel.org>
> 
> As you pointed out in the bug report, there is not much testing
> infrastructure for NFSv4 ACLs. It will be hard to tell in
> advance if this change results in a behavior regression.
> 
> On the other hand, I'm not sure we have a large cohort of
> NFSv4 ACL users on Linux.
> 
> I can certainly apply this to nfsd-next at least for a few
> weeks to see if anyone yelps.
> 

Thanks, that's probably the best we can do, given the state of v4 ACL
test coverage.
-- 
Jeff Layton <jlayton@...nel.org>