[Bug 216886] ZFS with aclinherit and aclmode set to passthrough adds an extra default ACLs

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=216886

--- Comment #3 from commit-hook at freebsd.org ---
A commit references this bug:

Author: avg
Date: Wed Mar  7 13:49:27 UTC 2018
New revision: 330592
URL: https://svnweb.freebsd.org/changeset/base/330592

Log:
  MFV r330591: 8984 fix for 6764 breaks ACL inheritance

  illumos/illumos-gate at e9bacc6d1a71ea3f7082038b2868de8c4dd98bdc
 
https://github.com/illumos/illumos-gate/commit/e9bacc6d1a71ea3f7082038b2868de8c4dd98bdc

  https://www.illumos.org/issues/8984
    Consider a directory configured as:
    drwx-ws---+ 2 henson cpp 3 Jan 23 12:35 dropbox/
    user:henson:rwxpdDaARWcC--:f-i----:allow
    owner@:--------------:f-i----:allow
    group@:--------------:f-i----:allow
    everyone@:--------------:f-i----:allow
    owner@:rwxpdDaARWcC--:-di----:allow
    group:cpp:-wx-----------:-------:allow
    owner@:rwxpdDaARWcC--:-------:allow
    A new file created in this directory ends up looking like:
    rw-r--r-+ 1 astudent cpp 0 Jan 23 12:39 testfile
    user:henson:rw-pdDaARWcC--:------I:allow
    owner@:--------------:------I:allow
    group@:--------------:------I:allow
    everyone@:--------------:------I:allow
    owner@:rw-p--aARWcCos:-------:allow
    group@:r-----a-R-c--s:-------:allow
    everyone@:r-----a-R-c--s:-------:allow
    with extraneous group@ and everyone@ entries allowing read access that
    shouldn't exist.
    Per Albert Lee on the zfs mailing list:
    "aclinherit=passthrough/passthrough-x should still
    ignore the requested mode when an inheritable ACE for owner@ group@,
    or everyone@ is present in the parent directory.
    It appears there was an oversight in my fix for
    https://www.illumos.org/issues/6764 which made calling zfs_acl_chmod
    from zfs_acl_inherit unconditional. I think the parent ACL check for
    aclinherit=passthrough needs to be reintroduced in zfs_acl_inherit."
    We have a large number of faculty who use dropbox directories like the
example
    to have students submit projects. All of these directories are now allowing

  Reviewed by: Sam Zaydel <szaydel at racktopsystems.com>
  Reviewed by: Paul B. Henson <henson at acm.org>
  Reviewed by: Prakash Surya <prakash.surya at delphix.com>
  Approved by: Matthew Ahrens <mahrens at delphix.com>
  Author: Dominik Hassler <hadfl at omniosce.org>

  PR:           216886
  MFC after:    2 weeks

Changes:
_U  head/sys/cddl/contrib/opensolaris/
  head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_acl.c

-- 
You are receiving this mail because:
You are the assignee for the bug.