pastebin - collaborative debugging tool
nrubsig.kpaste.net RSS


ACL work backup 2024-06-27
Posted by Anonymous on Thu 27th Jun 2024 15:48
raw | new post
view followups (newest first): ACL work backup 2024-06-27 by Anonymous

  1. diff --git a/daemon/acl.c b/daemon/acl.c
  2. index 331fc8e..474a170 100644
  3. --- a/daemon/acl.c
  4. +++ b/daemon/acl.c
  5. @@ -1026,7 +1026,7 @@ static int map_dacl_2_nfs4acl(PACL acl, PSID sid, PSID gsid, nfsacl41 *nfs4_acl,
  6.          }
  7.          nfs4_acl->aces->aceflag = 0;
  8.      } else {
  9. -        int i;
  10. +        int win_i, nfs_i;
  11.          PACE_HEADER ace;
  12.          PBYTE tmp_pointer;
  13.          SID_NAME_USE who_sid_type = 0;
  14. @@ -1037,15 +1037,18 @@ static int map_dacl_2_nfs4acl(PACL acl, PSID sid, PSID gsid, nfsacl41 *nfs4_acl,
  15.              print_hexbuf_no_asci("ACL\n",
  16.                  (const unsigned char *)acl, acl->AclSize);
  17.          }
  18. -        nfs4_acl->count = acl->AceCount;
  19. -        nfs4_acl->aces = calloc(nfs4_acl->count, sizeof(nfsace4));
  20. +
  21. +        nfs4_acl->aces = calloc(acl->AceCount, sizeof(nfsace4));
  22.          if (nfs4_acl->aces == NULL) {
  23.              status = GetLastError();
  24.              goto out;
  25.          }
  26.          nfs4_acl->flag = 0;
  27. -        for (i = 0; i < acl->AceCount; i++) {
  28. -            status = GetAce(acl, i, &ace);
  29. +        for (win_i = nfs_i = 0; win_i < acl->AceCount; win_i++) {
  30. +            nfsace4 *curr_nfsace = &nfs4_acl->aces[nfs_i];
  31. +            PSID ace_sid;
  32. +
  33. +            status = GetAce(acl, win_i, &ace);
  34.              if (!status) {
  35.                  status = GetLastError();
  36.                  eprintf("map_dacl_2_nfs4acl: GetAce failed with %d\n", status);
  37. @@ -1058,9 +1061,9 @@ static int map_dacl_2_nfs4acl(PACL acl, PSID sid, PSID gsid, nfsacl41 *nfs4_acl,
  38.              }
  39.              DPRINTF(ACLLVL3, ("ACE TYPE: %x\n", ace->AceType));
  40.              if (ace->AceType == ACCESS_ALLOWED_ACE_TYPE)
  41. -                nfs4_acl->aces[i].acetype = ACE4_ACCESS_ALLOWED_ACE_TYPE;
  42. +                curr_nfsace->acetype = ACE4_ACCESS_ALLOWED_ACE_TYPE;
  43.              else if (ace->AceType == ACCESS_DENIED_ACE_TYPE)
  44. -                nfs4_acl->aces[i].acetype = ACE4_ACCESS_DENIED_ACE_TYPE;
  45. +                curr_nfsace->acetype = ACE4_ACCESS_DENIED_ACE_TYPE;
  46.              else {
  47.                  eprintf("map_dacl_2_nfs4acl: unsupported ACE type %d\n",
  48.                      ace->AceType);
  49. @@ -1069,8 +1072,40 @@ static int map_dacl_2_nfs4acl(PACL acl, PSID sid, PSID gsid, nfsacl41 *nfs4_acl,
  50.              }
  51.  
  52.              tmp_pointer += sizeof(ACCESS_MASK) + sizeof(ACE_HEADER);
  53. +            ace_sid = tmp_pointer;
  54. +
  55. +#ifdef NFS41_DRIVER_ACLS_SETACL_SKIP_WINNULLSID_ACES
  56. +            if (IsWellKnownSid(ace_sid, WinNullSid)) {
  57. +                /*
  58. +                 * Skip ACEs with SID==|WinNullSid|
  59. +                 *
  60. +                 * Cygwin generates artificial ACEs with SID user
  61. +                 * |WinNullSid| to encode permission information
  62. +                 * (see |CYG_ACE_ISBITS_TO_POSIX()| in
  63. +                 * Cygwin newlib-cygwin/winsup/cygwin/sec/acl.cc
  64. +                 *
  65. +                 * This assumes that the filesystem which stores
  66. +                 * the ACL data leaves them 1:1 intact - which is
  67. +                 * not the case for the Linux NFSv4.1 server
  68. +                 * (tested with Linux 6.6.32), which transforms the
  69. +                 * NFSv4.1 ACLs into POSIX ACLs at setacl time,
  70. +                 * and the POSIX ACLs back to NFSv4 ACLs at getacl
  71. +                 * time.
  72. +                 * And this lossy transformation screws-up Cygwin
  73. +                 * completly.
  74. +                 * The best we can do for now is to skip such
  75. +                 * ACEs, as we have no way to detect whether
  76. +                 * the NFS server supports full NFSv4 ACLs, or
  77. +                 * only POSIX ACLs disguised as NFSv4 ACLs.
  78. +                 */
  79. +                DPRINTF(ACLLVL3, ("Skipping WinNullSid ACE, "
  80. +                    "win_i=%d nfs_i=%d\n", (int)win_i, (int)nfs_i));
  81. +                continue;
  82. +            }
  83. +#endif /* NFS41_DRIVER_ACLS_SETACL_SKIP_WINNULLSID_ACES */
  84.  
  85. -            status = map_nfs4ace_who(tmp_pointer, sid, gsid, nfs4_acl->aces[i].who,
  86. +            status = map_nfs4ace_who(ace_sid, sid, gsid,
  87. +                curr_nfsace->who,
  88.                  domain, &who_sid_type);
  89.              if (status)
  90.                  goto out_free;
  91. @@ -1078,10 +1113,10 @@ static int map_dacl_2_nfs4acl(PACL acl, PSID sid, PSID gsid, nfsacl41 *nfs4_acl,
  92.              win_mask = *(PACCESS_MASK)(ace + 1);
  93.  
  94.              map_winace2nfs4aceflags(ace->AceFlags,
  95. -                &nfs4_acl->aces[i].aceflag);
  96. +                &curr_nfsace->aceflag);
  97.              map_winaccessmask2nfs4acemask(win_mask,
  98.                  file_type, named_attr_support,
  99. -                &nfs4_acl->aces[i].acemask);
  100. +                &curr_nfsace->acemask);
  101.  
  102.              /*
  103.               * Clear |ACE4_INHERITED_ACE|
  104. @@ -1104,8 +1139,8 @@ static int map_dacl_2_nfs4acl(PACL acl, PSID sid, PSID gsid, nfsacl41 *nfs4_acl,
  105.               * icacls(1win) if the parent directory has inheritance
  106.               * ACLs.
  107.               */
  108. -            if (nfs4_acl->aces[i].aceflag & ACE4_INHERITED_ACE) {
  109. -                nfs4_acl->aces[i].aceflag &= ~ACE4_INHERITED_ACE;
  110. +            if (curr_nfsace->aceflag & ACE4_INHERITED_ACE) {
  111. +                curr_nfsace->aceflag &= ~ACE4_INHERITED_ACE;
  112.                  DPRINTF(ACLLVL3, ("clearning ACE4_INHERITED_ACE\n"));
  113.              }
  114.  
  115. @@ -1125,8 +1160,8 @@ static int map_dacl_2_nfs4acl(PACL acl, PSID sid, PSID gsid, nfsacl41 *nfs4_acl,
  116.                      "aces[%d].who='%s': "
  117.                      "setting group flag\n",
  118.                      map_SID_NAME_USE2str(who_sid_type),
  119. -                    i, nfs4_acl->aces[i].who));
  120. -                nfs4_acl->aces[i].aceflag |= ACE4_IDENTIFIER_GROUP;
  121. +                    nfs_i, curr_nfsace->who));
  122. +                curr_nfsace->aceflag |= ACE4_IDENTIFIER_GROUP;
  123.              }
  124.  
  125.              if (DPRINTF_LEVEL_ENABLED(ACLLVL1)) {
  126. @@ -1134,24 +1169,30 @@ static int map_dacl_2_nfs4acl(PACL acl, PSID sid, PSID gsid, nfsacl41 *nfs4_acl,
  127.                      "acetype='%s', "
  128.                      "aceflag='%s'/0x%lx, "
  129.                      "acemask='%s'/0x%lx(=win_mask=0x%lx)), "
  130. -                    "who_sid_type='%s'\n",
  131. -                    i,
  132. -                    nfs4_acl->aces[i].who,
  133. -                    map_nfs_acetype2str(nfs4_acl->aces[i].acetype),
  134. -                    nfs_aceflag2shortname(nfs4_acl->aces[i].aceflag),
  135. -                    nfs4_acl->aces[i].aceflag,
  136. -                    nfs_mask2shortname(nfs4_acl->aces[i].acemask),
  137. -                    (long)nfs4_acl->aces[i].acemask,
  138. +                    "who_sid_type='%s', "
  139. +                    "win_i=%d\n",
  140. +                    nfs_i,
  141. +                    curr_nfsace->who,
  142. +                    map_nfs_acetype2str(curr_nfsace->acetype),
  143. +                    nfs_aceflag2shortname(curr_nfsace->aceflag),
  144. +                    curr_nfsace->aceflag,
  145. +                    nfs_mask2shortname(curr_nfsace->acemask),
  146. +                    (long)curr_nfsace->acemask,
  147.                      (long)win_mask,
  148. -                    map_SID_NAME_USE2str(who_sid_type));
  149. +                    map_SID_NAME_USE2str(who_sid_type),
  150. +                    (int)win_i);
  151.                  if (DPRINTF_LEVEL_ENABLED(ACLLVL2)) {
  152. -                    print_windows_access_mask(nfs4_acl->aces[i].who,
  153. +                    print_windows_access_mask(curr_nfsace->who,
  154.                          win_mask);
  155. -                    print_nfs_access_mask(nfs4_acl->aces[i].who,
  156. -                        nfs4_acl->aces[i].acemask);
  157. +                    print_nfs_access_mask(curr_nfsace->who,
  158. +                        curr_nfsace->acemask);
  159.                  }
  160.              }
  161. +
  162. +            nfs_i++;
  163.          }
  164. +
  165. +        nfs4_acl->count = nfs_i;
  166.      }
  167.      status = ERROR_SUCCESS;
  168.  out:
  169. diff --git a/daemon/nfs41_session.c b/daemon/nfs41_session.c
  170. index 98a2ccb..92741e7 100644
  171. --- a/daemon/nfs41_session.c
  172. +++ b/daemon/nfs41_session.c
  173. @@ -117,6 +117,9 @@ void nfs41_session_free_slot(
  174.      }
  175.      /* update highest_used if necessary */
  176.      if (slotid == table->highest_used) {
  177. +        EASSERT_MSG((table->highest_used < NFS41_MAX_NUM_SLOTS),
  178. +            ("table->highest_used=%lu\n",
  179. +            (unsigned long)table->highest_used));
  180.          while (table->highest_used && !table->used_slots[table->highest_used])
  181.              table->highest_used--;
  182.      }
  183. diff --git a/nfs41_build_features.h b/nfs41_build_features.h
  184. index 0fb2882..37c5995 100644
  185. --- a/nfs41_build_features.h
  186. +++ b/nfs41_build_features.h
  187. @@ -133,4 +133,24 @@
  188.   */
  189.  #define NFS41_DRIVER_DEBUG_FS_NAME 1
  190.  
  191. +/*
  192. + * NFS41_DRIVER_ACLS_SETACL_SKIP_WINNULLSID_ACES - Skip ACEs
  193. + * with SID==|WinNullSid|
  194. + *
  195. + * Cygwin generates artificial ACEs with SID user |WinNullSid| to
  196. + * encode permission information (follow |CYG_ACE_ISBITS_TO_POSIX()|
  197. + * in Cygwin newlib-cygwin/winsup/cygwin/sec/acl.cc
  198. + *
  199. + * This assumes that the filesystem which storesthe ACL data leaves
  200. + * them 1:1 intact - which is not the case for the Linux NFSv4.1
  201. + * server (tested with Linux 6.6.32), which transforms the NFSv4.1
  202. + * ACLs into POSIX ACLs at setacl time, and the POSIX ACLs back to
  203. + * NFSv4 ACLs at getacl time.
  204. + * And this lossy transformation screws-up Cygwin completly.
  205. + * The best we can do for now is to skip such ACEs, as we have no
  206. + * way to detect whether the NFS server supports full NFSv4 ACLs,
  207. + * or only POSIX ACLs disguised as NFSv4 ACLs.
  208. + */
  209. +#define NFS41_DRIVER_ACLS_SETACL_SKIP_WINNULLSID_ACES 1
  210. +
  211.  #endif /* !_NFS41_DRIVER_BUILDFEATURES_ */

Submit a correction or amendment below (click here to make a fresh posting)
After submitting an amendment, you'll be able to view the differences between the old and new posts easily.

Syntax highlighting:

To highlight particular lines, prefix each line with {%HIGHLIGHT}




All content is user-submitted.
The administrators of this site (kpaste.net) are not responsible for their content.
Abuse reports should be emailed to us at