glusterfs.git/xlators/system/posix-acl/src/posix-acl.c, branch v3.8.7

posix-acl: check dictionary before using it

2016-11-10T06:26:40+00:00

If extended attributes are not present in md-cache it returns NULL as xattr.
posix acl xlator should check for NULL before using xattr.

If normal and default ACLs are not set on file then md-cache will not contain
system.posix_acl_access and system.posix_acl_default extended attributes in
its cache.

Therefore posix_acl_lookup_cbk should check xattr before using it, otherwise
the logs will get filled with dictionary errors.

> Reviewed-on: http://review.gluster.org/15769
> Reviewed-by: Raghavendra Talur 
> Smoke: Gluster Build System 
> Reviewed-by: jiffin tony Thottan 
> NetBSD-regression: NetBSD Build System 
> Reviewed-by: Vijay Bellur 
> CentOS-regression: Gluster Build System 

(cherry picked from commit de7fe24663713fff364cfc2b52b675e3e979ee68)

Change-Id: Icebf73cf0b313bd3e82ca8cbda63786dd0fa47da
BUG: 1392868
Signed-off-by: Rajesh Joseph 
Reviewed-on: http://review.gluster.org/15799
Smoke: Gluster Build System 
CentOS-regression: Gluster Build System 
NetBSD-regression: NetBSD Build System 
Reviewed-by: Raghavendra Talur

system/posix-acl: Unwind with NULL xdata on error

2016-09-15T16:30:50+00:00

In posix-acl when there are errors xdata that comes as part of input is used to
unwind which can be used as response xdata which may lead to problems as the
keys in the input will match with keys in the output but the values the
response xdata may expect can be completely different.

For example, we see that dht sends DHT_IATT_IN_XDATA_KEY in setxattr
which will be unwound with the same key in the xdata-response which
dht thinks is valid response and fills stbuf with invalid values
leading to EIO

> BUG: 1374093
> Change-Id: I6b77a1fa1ee99cb62e181e1db2e6fea73f6eaaa3
> Signed-off-by: Pranith Kumar K 
> Reviewed-on: http://review.gluster.org/15421
> Smoke: Gluster Build System 
> NetBSD-regression: NetBSD Build System 
> CentOS-regression: Gluster Build System 
> Reviewed-by: jiffin tony Thottan 
> Reviewed-by: Niels de Vos 
(cherry picked from commit c9271ff14d3efa8279cf67907548b3f43970d4fb)

Change-Id: I6b77a1fa1ee99cb62e181e1db2e6fea73f6eaaa3
BUG: 1374640
Signed-off-by: Niels de Vos 
Reviewed-on: http://review.gluster.org/15473
Smoke: Gluster Build System 
NetBSD-regression: NetBSD Build System 
CentOS-regression: Gluster Build System 
Reviewed-by: Pranith Kumar Karampuri

posix_acl: create inode ctx for posix_acl_get

2016-04-11T15:37:36+00:00

Change-Id: Ibe5b00cd4b5d896133adc61f65094d783c492ed4
BUG: 1325822
Signed-off-by: vmallika 
Reviewed-on: http://review.gluster.org/13961
Smoke: Gluster Build System 
NetBSD-regression: NetBSD Build System 
CentOS-regression: Gluster Build System 
Reviewed-by: Jeff Darcy

posix_acl: skip acl_permits for special clients

2016-04-06T12:08:26+00:00

Change-Id: I3f478b7e4ecab517200f50eb09f65a634c029437
BUG: 1320818
Signed-off-by: vmallika 
Reviewed-on: http://review.gluster.org/13894
Smoke: Gluster Build System 
NetBSD-regression: NetBSD Build System 
Reviewed-by: jiffin tony Thottan 
CentOS-regression: Gluster Build System

storage/posix: send proper iatt attributes for the root inode

2016-03-26T16:33:48+00:00

* changes in posix to send proper iatt attributes for the root directory
  when ancestry is built. Before posix was filling only the gfid and the
  inode type in the iatt structure keeping rest of the fields zeros. This
  was cached by posix-acl and used to send EACCES when some fops came on
  that object if the uid of the caller is same as the uid of the object on
  the disk.

* getting and setting inode_ctx in function 'posix_acl_ctx_get' is not atomic
  and can lead to memory leak when there are multiple looups for an
  inode at same time. This patch fix this problem

* Linking an inode in posix_build_ancestry, can cause a race in
  posix_acl.
  When parent inode is linked in posix_build_ancestry, and before
  it reaches posix_acl_readdirp_cbkc, reate/lookup can
  come on a leaf-inode, as parent-inode-ctx not yet updated
  in posix_acl_readdirp_cbk, create/lookup can fail
  with EACCESS. So do the inode linking in the quota xlator

Change-Id: I3101eefb65551cc4162c4ff2963be1b73deacd6d
BUG: 1320818
Signed-off-by: Raghavendra Bhat 
Reviewed-on: http://review.gluster.org/13730
Tested-by: Vijaikumar Mallikarjuna 
Smoke: Gluster Build System 
NetBSD-regression: NetBSD Build System 
CentOS-regression: Gluster Build System 
Reviewed-by: Raghavendra G

access-control : remove spurious error message from the posix_setxattr_cbk

2016-02-09T14:33:18+00:00

A check for dictionary is required before calling handling_other_acl_related_xattr()
in posix_setxattr_cbk(). Otherwise following message will be poped up on every settxattr
call.

[2016-01-31 17:38:48.027792] I [dict.c:473:dict_get]
 (-->/usr/lib/x86_64-linux-gnu/glusterfs/3.7.6/xlator/system/posix-acl.so
(posix_acl_setxattr_cbk+0x26) [0x7f2334c5c166] -->
/usr/lib/x86_64-linux-gnu/glusterfs/3.7.6/xlator/system/posix-acl.so
(handling_other_acl_related_xattr+0xb0) [0x7f2334c5c0f0]
-->/usr/lib/x86_64-linux-gnu/libglusterfs.so.0(dict_get+0x93)
[0x7f233c04b0c3] ) 0-dict: !this ||
key=system.posix_acl_default [Invalid argument]

Change-Id: I93f7e0f764c94dce38bdde95a68341f69a52122d
BUG: 1303501
Signed-off-by: Jiffin Tony Thottan 
Reviewed-on: http://review.gluster.org/13325
Smoke: Gluster Build System 
Reviewed-by: Kaleb KEITHLEY 
CentOS-regression: Gluster Build System 
NetBSD-regression: NetBSD Build System 
Reviewed-by: Jeff Darcy

dict: dict_set_bin() should never free the pointer on error

2015-07-24T15:09:08+00:00

dict_set_bin() is handling the pointer that it passed inconsistently.
Depending on the errors that can occur, the pointer passed to the dict
can be free'd, but there is no guarantee.

It is cleaner to have the caller free the pointer that allocated it and
dict_set_bin() returned an error. When dict_set_bin() returned success,
the given pointer will be free'd when dict_unref() calls data_destroy().

Many callers of dict_set_bin() already take care of free'ing the pointer
on error. The ones that did not, are corrected with this change too.

Change-Id: I39a4f7ebc0cae6d403baba99307d7ce408f25966
BUG: 1242280
Signed-off-by: Niels de Vos 
Reviewed-on: http://review.gluster.org/11638
Tested-by: Gluster Build System 
Reviewed-by: jiffin tony Thottan 
Reviewed-by: Raghavendra G 
Tested-by: NetBSD Build System

access_control : avoid double unrefing of acl variable in its context.

2015-07-12T10:57:15+00:00

In handling_other_acl_related_xattr(), acl variable is unrefered twice
after updating the context of access_control translator.So the acl variable
stored in the inmemory context will become invalid one. When the variable
accessed again , it will result in brick crash. This patch fixes the same.

Change-Id: Ib95d2e3d67b0fb20d201244a206379d6261aeb23
BUG: 1242041
Signed-off-by: Jiffin Tony Thottan 
Reviewed-on: http://review.gluster.org/11632
Tested-by: NetBSD Build System 
Reviewed-by: Niels de Vos 
Reviewed-by: soumya k 
Tested-by: Gluster Build System 
Reviewed-by: Kaleb KEITHLEY

access-control : validating context of access control translator

2015-07-03T01:45:22+00:00

By introduction of new acl conversion from http://review.gluster.org/#/c/9627/,
an acl can be set using GF_POSIX_ACL_*_KEY xattrs without notifying the
access-control translator. So evenif an acl is set correctly at the backend, it
might not work properly because access-control holds wrong acl information in
its context about that file.

Note : This is a simple workaround. The actual solution consists of three steps:
1.) Use new acl api's for acl conversion.
2.) Move the acl conversion part from access-control translator
3.) Introduces standard acl structures and libaries in access-translator
for caching, enforcing purposes.

Change-Id: Iacb6b323810ebe82f7f171f20be16429463cbcf0
BUG: 1229860
Signed-off-by: Jiffin Tony Thottan 
Reviewed-on: http://review.gluster.org/11144
Reviewed-by: Niels de Vos 
Tested-by: Gluster Build System 
Reviewed-by: Kaleb KEITHLEY

gNFS: Allow reading ACLs even without read permissions on the file.

2014-11-13T19:58:00+00:00

When root-squash is enabled or when no permissions are given to
a file, NFS threw permission errors. According to the kernel-nfs
behaviour, no permissions are required to read ACLs.

When no ACLs are set, the system call sys_lgetxattr fails and
returns a ENODATA error. This translates to ESERVERFAULT error
in NFS. Fuse makes an exception to this error and returns a success
case. Similar changes are made here to achieve the expected behaviour.

Change-Id: I46b8f5911114eb087a3f8ca4e921b6b41e83f3b3
BUG: 1161092
Signed-off-by: Meghana Madhusudhan 
Signed-off-by: Niels de Vos 
Reviewed-on: http://review.gluster.org/9085
Tested-by: Gluster Build System