Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1266638

Re: [PATCH v15 00/22] Richacls (Core and Ext4)

Show all headers | View raw

On Tue, Nov 10, 2015 at 6:39 AM, Andreas Gruenbacher
<agruenba@redhat.com> wrote:
> On Tue, Nov 10, 2015 at 12:29 PM, Christoph Hellwig <hch@infradead.org> wrote:
>> On Mon, Nov 09, 2015 at 12:08:41PM +0100, Andreas Gruenbacher wrote:
>>> Here is another update to the richacl patch queue.  This posting contains
>>> the patches ready to be merged; the patches later in the queue still need
>>> some more review.
<snip>
>> and still abuses xattrs instead of a proper syscall interface.
>> That's far from being ready to merge.
>
> The xattr syscall interface is what's used for very similar kinds of
> things today; using it for richacls as well sure does not count as
> abuse. Things could be improved in the xattr interface and in its
> implementation, but we need more substantial reasons than that for
> reimplementing the wheel once again.

I don't have strong disagreement with using pseudo-xattrs to
store/retrieve ACLs (we already do this) but retrieving/setting an ACL
all at once can be awkward  when ACLs are quite large e.g. when it
encodes to over 1MB (not all administrators think about the size of
ACLs when they add hundreds of users or groups or apps to ACLs).

The bigger problem is that when ACLs are created -- after -- the file
is created there is a potential race (harder to deal with in cluster
and network file systems).   Ideally we should be able to optionally
pass all the security information needed to create a file in the
create call itself.  For apps which don't care they can continue to
use the old syscalls.

In the meantime, I don't mind the approach of staging this in via a
pseudo-xattr, Samba can deal with that (and it will make some of the
backup and data movement tools easier for the cifs.ko client which
currently rely on a cifs specific xattr).

In cifs.ko I still need to enable the SMB3 ACL helper functions
(currently only enabled for the older cifs dialect) since that will
make it easier, and figure out a way to allow helper tools to view
"claims based ACLs" (DAC), not just traditional
CIFS/NTFS/SMB3/RichACLs.
-- 
Thanks,

Steve
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v15 00/22] Richacls (Core and Ext4) Andreas Gruenbacher <agruenba@redhat.com> - 2015-11-09 12:10 +0100
  [PATCH v15 02/22] vfs: Add MAY_CREATE_FILE and MAY_CREATE_DIR permission flags Andreas Gruenbacher <agruenba@redhat.com> - 2015-11-09 12:10 +0100
  [PATCH v15 21/22] ext4: Add richacl support Andreas Gruenbacher <agruenba@redhat.com> - 2015-11-09 12:20 +0100
  [PATCH v15 06/22] richacl: In-memory representation and helper functions Andreas Gruenbacher <agruenba@redhat.com> - 2015-11-09 12:20 +0100
  [PATCH v15 20/22] vfs: Add richacl permission checking Andreas Gruenbacher <agruenba@redhat.com> - 2015-11-09 12:20 +0100
  [PATCH v15 09/22] richacl: Permission check algorithm Andreas Gruenbacher <agruenba@redhat.com> - 2015-11-09 12:20 +0100
  [PATCH v15 14/22] richacl: Update the file masks in chmod() Andreas Gruenbacher <agruenba@redhat.com> - 2015-11-09 12:20 +0100
  [PATCH v15 19/22] richacl: Add richacl xattr handler Andreas Gruenbacher <agruenba@redhat.com> - 2015-11-09 12:20 +0100
    Re: [PATCH v15 19/22] richacl: Add richacl xattr handler Andreas Gruenbacher <agruenba@redhat.com> - 2015-11-11 02:20 +0100
  [PATCH v15 18/22] richacl: xattr mapping functions Andreas Gruenbacher <agruenba@redhat.com> - 2015-11-09 12:20 +0100
  [PATCH v15 22/22] ext4: Add richacl feature flag Andreas Gruenbacher <agruenba@redhat.com> - 2015-11-09 12:20 +0100
  [PATCH v15 08/22] richacl: Compute maximum file masks from an acl Andreas Gruenbacher <agruenba@redhat.com> - 2015-11-09 12:20 +0100
  [PATCH v15 13/22] vfs: Cache richacl in struct inode Andreas Gruenbacher <agruenba@redhat.com> - 2015-11-09 12:20 +0100
  [PATCH v15 17/22] richacl: Automatic Inheritance Andreas Gruenbacher <agruenba@redhat.com> - 2015-11-09 12:20 +0100
  [PATCH v15 12/22] vfs: Add get_richacl and set_richacl inode operations Andreas Gruenbacher <agruenba@redhat.com> - 2015-11-09 12:20 +0100
  [PATCH v15 15/22] richacl: Check if an acl is equivalent to a file mode Andreas Gruenbacher <agruenba@redhat.com> - 2015-11-09 12:20 +0100
  [PATCH v15 16/22] richacl: Create-time inheritance Andreas Gruenbacher <agruenba@redhat.com> - 2015-11-09 12:20 +0100
  [PATCH v15 10/22] posix_acl: Unexport acl_by_type and make it static Andreas Gruenbacher <agruenba@redhat.com> - 2015-11-09 12:20 +0100
  [PATCH v15 11/22] vfs: Cache base_acl objects in inodes Andreas Gruenbacher <agruenba@redhat.com> - 2015-11-09 12:30 +0100
  [PATCH v15 07/22] richacl: Permission mapping functions Andreas Gruenbacher <agruenba@redhat.com> - 2015-11-09 12:30 +0100
  [PATCH v15 01/22] vfs: Add IS_ACL() and IS_RICHACL() tests Andreas Gruenbacher <agruenba@redhat.com> - 2015-11-09 12:30 +0100
  Re: [PATCH v15 00/22] Richacls (Core and Ext4) Christoph Hellwig <hch@infradead.org> - 2015-11-10 12:30 +0100
    Re: [PATCH v15 00/22] Richacls (Core and Ext4) Andreas Gruenbacher <agruenba@redhat.com> - 2015-11-10 13:50 +0100
      Re: [PATCH v15 00/22] Richacls (Core and Ext4) Steve French <smfrench@gmail.com> - 2015-11-10 17:50 +0100
        Re: [PATCH v15 00/22] Richacls (Core and Ext4) "J. Bruce Fields" <bfields@fieldses.org> - 2015-11-10 18:10 +0100
          Re: [PATCH v15 00/22] Richacls (Core and Ext4) Andreas Gruenbacher <agruenba@redhat.com> - 2015-11-10 19:10 +0100
            Re: [PATCH v15 00/22] Richacls (Core and Ext4) "J. Bruce Fields" <bfields@fieldses.org> - 2015-11-10 20:20 +0100
      Re: [PATCH v15 00/22] Richacls (Core and Ext4) Christoph Hellwig <hch@infradead.org> - 2015-11-11 09:00 +0100
        Re: [PATCH v15 00/22] Richacls (Core and Ext4) Andreas Gruenbacher <agruenba@redhat.com> - 2015-11-11 15:00 +0100

csiph-web