This list has been deprecated. Please subscribe to the new devel list at
lists.nfs-ganesha.org.
Frank/Daniel,
Creds are correct, ACL implementation in our FSAL is new, basic RWX
permission is enforced in our FSAL on this path.
Currently ACL's are not enforced in our Filesystem. We are relying on
ganesha to enforce ACL.
can our FSAL make call to
*fsal_test_access instead (wherever we need to enforce) ?*
*P.S:- Our filesystem is accessed either through nfs Ganesha or our own nfs
server (anyone will be active at given time). *
*Thanks,*
*Sagar.*
On Fri, May 25, 2018 at 10:14 PM, Frank Filz <ffilz...@mindspring.com>
wrote:
> This list has been deprecated. Please subscribe to the new devel list at
> lists.nfs-ganesha.org.
> > This list has been deprecated. Please subscribe to the new devel list at
> lists.nfs-
> > ganesha.org.
> > So, the access check is, of course, advisory to the client. It doesn't
> have to
> > make one at all, but can just issue the rename, and expect it to succeed
> or fail
> > based on permissions. I'm not sure why the client does an access and
> then still
> > does a rename, but it ultimately doesn't matter, I think.
> >
> > We don't do an extra access check in the rename path, because it could
> race
> > with a permissions change anyway. Instead, we rely on the FSAL's
> > rename() call to properly enforce permissions. This is the way many
> calls work in
> > the FSAL API, to avoid those races.
> >
> > Does your rename() call not enforce permissions? Or did it somehow
> succeed in
> > spite of that? Were the wrong creds passed in?
>
> Yea, while Ganesha does some permission checking itself, it MUST depend on
> the FSAL and its underlying filesystem to permission check any directory
> operations. This is due to the issues of making a permission check atomic
> with the operation.
>
> What kind of ACLs does your FSAL and filesystem implement? Does the
> filesystem have mechanisms to enforce the ACL?
>
> Do you set/pass the user credentials for the operations? See what FSAL_VFS
> and FSAL_GLUSTER do for examples.
>
> Frank
>
> > > By looking at nfs-Ganesha code, permission check (ACL) happens
> > > access_check.c. Our FSAL (not in tree FSAL), storing and serving the
> > > ACLs to Ganesha.
> > >
> > > I see an issue with rename:
> > > Even though i set deny ACE for "delete child" on folder1 for user1.
> > > user1 is able to rename file belongs to user2.
> > >
> > > I see below RPC:-
> > > ACCESS request folder1
> > > ACCESS denied (as expected.) (denied for DELETE_CHILD permission)
> > > Rename request Rename succeed
> > >
> > > I'm not sure why client is sending rename even after receiving ACCESS
> > > Denied.
> > >
> > > Native nfs denies rename though.
> > >
> > > Any help is appreciated here.
> > >
> > > Thanks,
> > > Sagar.
> > >
> > >
> > >
> > >
> > > ----------------------------------------------------------------------
> > > -------- Check out the vibrant tech community on one of the world's
> > > most engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> > >
> > >
> > >
> > > _______________________________________________
> > > Nfs-ganesha-devel mailing list
> > > Nfs-ganesha-devel@lists.sourceforge.net
> > > https://lists.sourceforge.net/lists/listinfo/nfs-ganesha-devel
> > >
> >
> >
> > ------------------------------------------------------------
> ------------------
> > Check out the vibrant tech community on one of the world's most engaging
> tech
> > sites, Slashdot.org! http://sdm.link/slashdot
> > _______________________________________________
> > Nfs-ganesha-devel mailing list
> > Nfs-ganesha-devel@lists.sourceforge.net
> > https://lists.sourceforge.net/lists/listinfo/nfs-ganesha-devel
>
>
> ------------------------------------------------------------
> ------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> Nfs-ganesha-devel mailing list
> Nfs-ganesha-devel@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/nfs-ganesha-devel
>
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Nfs-ganesha-devel mailing list
Nfs-ganesha-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs-ganesha-devel
