[LU-18158] Hint client about supplementary groups and ACLs in case of file create

• Type: Bug
• Resolution: Unresolved
• Priority: Minor
• Fix Version/s: Lustre 2.17.0
• Affects Version/s: Lustre 2.16.0
• Labels: patch sec
• Severity: 3
• Assignee: Sebastien Buisson
• Reporter: Sebastien Buisson

Description

When a regular user on a Lustre client tries to open a file, the client's normal behavior is to send a maximum of 2 supplementary groups for the user to the servers. Without complete supplementary group information, the MDS may not be able to authorize access to a resource, so may return "permission denied", even though the user is technically authorized to access the resource. This is especially true for resources with access controlled by ACLs. For this reason, the client is able to send alternative supplementary groups to the server using a retry mechanism. If the first authorization fails, then the failure reply from the server will include a hint that the client is able to retry. A retried authorization attempt is then sent, including alternative supplementary groups, selected using group information hinted in the reply from the MDT.

This retry mechanism only exists for file open, but could also be implemented for file create.

Issue Links

• is related to: LU-19949 supplementary gid is not honored when identity_upcall is disabled
• is related to: LU-19590 Supp gid fix for cross-MDT operations where parent/child on diff MDTs w/ different groups