[NFS-Ganesha-Devel] Re: [EXTERNAL] ganesha is not honoring the nfsv4 acl

13 Oct 2021

      Also - PROXY is not working for me with setfacl at the current time, but I haven't done exhaustive testing yet.

-Jeff

On 10/13/21, 10:50 AM, "Frank Filz" <ffilzlnx@mindspring.com> wrote:

    Unfortunately there really isn't much documentation on PROXY beyond any dribs and drabs in the wiki on github.

    Frank

    > -----Original Message-----
    > From: Andrea Cucciarre' via Devel [mailto:devel@lists.nfs-ganesha.org]
    > Sent: Wednesday, October 13, 2021 10:44 AM
    > To: Frank Filz <ffilzlnx@mindspring.com>; 'Becker, Jeffrey C. (ARC-TN)[InuTeq,
    > LLC]' <jeffrey.c.becker@nasa.gov>
    > Cc: 'Ganesha-devel' <devel@lists.nfs-ganesha.org>
    > Subject: [NFS-Ganesha-Devel] Re: [EXTERNAL] ganesha is not honoring the nfsv4
    > acl
    > 
    > Thanks.
    > Is there any documentation link that can help on how to use FSAL_PROXY_V4?
    > 
    > Regards
    > Andrea Cucciarre'
    > 
    > 
    > 
    > On 10/13/2021 7:27 PM, Frank Filz wrote:
    > > Oops, I didn't respond to the list...
    > >
    > > Ganesha currently has limited ACL support.
    > >
    > > FSAL_GPFS supports NFSv4 ACLs on the backend
    > >
    > > FSAL_CEPH and FSAL_GLUSTER support conversion between NFSv4 ACLs and
    > > POSIX ACLs to be stored as POSIX ACLs on the backend
    > >
    > > FSAL_LIZARDFS has ACL support but I know almost nothing about Lizardfs to
    > evaluate how it's stored.
    > >
    > > FSAL_PROXY_V4 looks like it has ACL support, I don't know if it actually works.
    > >
    > > Beyond that, Ganesha doesn't support ACLs. It does not support the sideband
    > protocol to do POSIX ACLs for NFSv3 mounts.
    > >
    > > There was a discussion on IRC about FSAL_VFS supporting ACLs for filesystems
    > that support using NFSv4 ACLs via nfs4_get/setfacl. In theory, we could bend
    > things to support NFSv4 re-export and then hook into the ACLs (and that could
    > then work for any other filesystem that also decided to implement ACLs using
    > the same interface) but there are no immediate plans to do so and re-export
    > would be tricky and is honestly better done by FSAL_PROXY_V4 limiting our
    > incentive to support FSAL_VFS NFS re-export with ACLs.
    > >
    > > Frank
    > >
    > >> -----Original Message-----
    > >> From: Becker, Jeffrey C. (ARC-TN)[InuTeq, LLC] via Devel
    > >> [mailto:devel@lists.nfs-ganesha.org]
    > >> Sent: Wednesday, October 13, 2021 8:51 AM
    > >> To: Andrea Cucciarre <acucciarre@cloudian.com>;
    > >> devel@lists.nfs-ganesha.org
    > >> Subject: [NFS-Ganesha-Devel] Re: [EXTERNAL] ganesha is not honoring
    > >> the nfsv4 acl
    > >>
    > >> I am seeing a similar situation with  Ganesha and an NFSv4 mount of a
    > >> directory on which I've run setfacl, and the user in the setfacl gets permission
    > denied.
    > >>
    > >> -Jeff
    > >>
    > >> On 10/13/21, 7:06 AM, "Andrea Cucciarre via Devel" <devel@lists.nfs-
    > >> ganesha.org> wrote:
    > >>
    > >>      I'm trying to figure out why ganesha is not honoring the nfsv4
    > >> acl
    > >>
    > >>      On the backend filesystem the NFSv4 seems to be properly configured:
    > >>
    > >>      # nfs4_getfacl /hyperfile/volumes/1/6_1/dir_1
    > >>      A::andrea:rwaxtTnNcCy
    > >>
    > >>      However, on the NFS client user "andrea" can't access the
    > >> directory
    > >>
    > >>      $ mount -v | grep nfs
    > >>      10.130.42.92:/vol1 on /mnt type nfs4
    > >> (rw,relatime,vers=4.2,rsize=1048576,wsize=1048576,namlen=255,hard,pro
    > >> t
    > >> o=tc
    > >> p,timeo=600,retrans=2,sec=sys,clientaddr=10.50.50.37,local_lock=none,
    > >> a
    > >> ddr=1
    > >> 0.130.42.92)
    > >>
    > >>      $ cd /mnt/dir_1
    > >>      -bash: cd: /mnt/dir_1: Permission denied
    > >>
    > >>      The UID for andrea is the same on NFS client and NFS ganesha server.
    > >>
    > >>      I have enabled debug logs in Ganesha, but it doesn't say much to
    > >> me (I have grepped for ACL)
    > >>
    > >>      3/10/2021 13:53:15 : epoch 6166dd9b : hf-frontend-1-1-699f6cb8cf-gmlqp
    > :
    > >> nfs-ganesha-124687[svc_56] nfs_access_op :NFS3 :DEBUG :access_mask =
    > >> mode(rwx)
    > >> ACL(list_dir,add_file,execute,add_subdirectory,delete_child)
    > >>
    > >>      13/10/2021 13:53:15 : epoch 6166dd9b : hf-frontend-1-1-699f6cb8cf-
    > gmlqp :
    > >> nfs-ganesha-124687[svc_56] fsal_check_access_no_acl :NFS4 ACL :F_DBG
    > >> :file Mode=0777, file uid=0, file gid= 0, user uid=10001, user gid=
    > >> 10002,
    > >> access_type=0X7000000
    > >>
    > >>      13/10/2021 13:53:15 : epoch 6166dd9b : hf-frontend-1-1-699f6cb8cf-
    > gmlqp :
    > >> nfs-ganesha-124687[svc_56] fsal_check_access_no_acl :NFS4 ACL :F_DBG
    > >> :Mask=0X7000000, Access Type=0X7000000 Allowed=0X7000000 Denied=0X0
    > >> ALLOWED
    > >>
    > >>      13/10/2021 13:53:15 : epoch 6166dd9b : hf-frontend-1-1-699f6cb8cf-
    > gmlqp :
    > >> nfs-ganesha-124687[svc_56] file_To_Fattr :NFS4 ACL :DEBUG :No
    > >> permission check for ACL for obj 0x563029ad02f8
    > >>
    > >>      13/10/2021 13:53:15 : epoch 6166dd9b : hf-frontend-1-1-699f6cb8cf-
    > gmlqp :
    > >> nfs-ganesha-124687[svc_53] fsal_check_access_no_acl :NFS4 ACL :F_DBG
    > >> :file Mode=0777, file uid=0, file gid= 0, user uid=10001, user gid=
    > >> 10002,
    > >> access_type=0X1000000
    > >>
    > >>      13/10/2021 13:53:15 : epoch 6166dd9b : hf-frontend-1-1-699f6cb8cf-
    > gmlqp :
    > >> nfs-ganesha-124687[svc_53] fsal_check_access_no_acl :NFS4 ACL :F_DBG
    > >> :Mask=0X7000000, Access Type=0X1000000 Allowed=0X1000000 Denied=0X0
    > >> ALLOWED
    > >>
    > >>      13/10/2021 13:53:15 : epoch 6166dd9b : hf-frontend-1-1-699f6cb8cf-
    > gmlqp :
    > >> nfs-ganesha-124687[svc_53] file_To_Fattr :NFS4 ACL :DEBUG :No
    > >> permission check for ACL for obj 0x7f7ca4003748
    > >>
    > >>      13/10/2021 13:53:15 : epoch 6166dd9b : hf-frontend-1-1-699f6cb8cf-
    > gmlqp :
    > >> nfs-ganesha-124687[svc_57] nfs_access_op :NFS3 :DEBUG :access_mask =
    > >> mode(rwx)
    > >> ACL(list_dir,add_file,execute,add_subdirectory,delete_child)
    > >>
    > >>      13/10/2021 13:53:15 : epoch 6166dd9b : hf-frontend-1-1-699f6cb8cf-
    > gmlqp :
    > >> nfs-ganesha-124687[svc_57] fsal_check_access_no_acl :NFS4 ACL :F_DBG
    > >> :file Mode=0, file uid=0, file gid= 0, user uid=10001, user gid=
    > >> 10002,
    > >> access_type=0X7000000
    > >>
    > >>      13/10/2021 13:53:15 : epoch 6166dd9b : hf-frontend-1-1-699f6cb8cf-
    > gmlqp :
    > >> nfs-ganesha-124687[svc_57] fsal_check_access_no_acl :NFS4 ACL :F_DBG
    > >> :Mask=0X0, Access Type=0X7000000 Allowed=0X0 Denied=0X7000000
    > DENIED
    > >>
    > >>      13/10/2021 13:53:15 : epoch 6166dd9b : hf-frontend-1-1-699f6cb8cf-
    > gmlqp :
    > >> nfs-ganesha-124687[svc_57] file_To_Fattr :NFS4 ACL :DEBUG :No
    > >> permission check for ACL for obj 0x7f7ca4003748
    > >>      _______________________________________________
    > >>      Devel mailing list -- devel@lists.nfs-ganesha.org
    > >>      To unsubscribe send an email to
    > >> devel-leave@lists.nfs-ganesha.org
    > >>
    > >> _______________________________________________
    > >> Devel mailing list -- devel@lists.nfs-ganesha.org To unsubscribe send
    > >> an email to devel-leave@lists.nfs-ganesha.org
    > _______________________________________________
    > Devel mailing list -- devel@lists.nfs-ganesha.org To unsubscribe send an email to
    > devel-leave@lists.nfs-ganesha.org