Summary:

The supplementary group retry mechanism fails when directory ACLs grant only execute permission (`g:GROUP:--x`). There are two separate issues.

Test environment:

Lustre master (2.17.56) with Gerrit 63144 rev 15 (retry mechanism for most syscalls) patched

RHEL 9.7, aarch64

Background:

When a Lustre client sends an RPC and the server denies access (EACCES), the server packs parent directory's GID and ACL into reply in this case, the client then scans the ACL to find a supplemental group to retry with. The scan uses:

```c
get_uc_group_from_acl(acl, want):
    for each ACE:
        if user is in group AND (e_perm & want) == want:
            return group
```

Issue 1: open path

Opening a file through a `--x` directory fails with EACCES after cache drop

In `ll_intent_lock()` (Gerrit 63144 version), the retry computes:

```c
rc = new_suppgid_from_req(true, op_data, reqp,
                          accmode_from_openflags(it->it_open_flags));
```

For `cat file.txt` (O_RDONLY), `it->it_open_flags` has `FMODE_READ`, so `accmode_from_openflags()` returns `MAY_READ` (4). The ACL scan then checks:

```
g:GROUP:--x → e_perm=1 → (1 & 4) == 4 → false → NO MATCH
```

The mismatch seems caused by 'want' is derived from file's access mode which is READ but ACL scanned is directory's which is EXECUTE only and these 2 are for different objects and not matching.

Issue 2: stat/getattr path

`stat` on a file through a `--x` directory fails with EACCES after cache drop.

Issue 2 is caused by below change, if I reverted it, I don't have this issue:

LU-20201 (Gerrit 65567) added:

```c
/* we want at least read access for getattr */
if (it->it_op & IT_GETATTR)
    it->it_open_flags |= FMODE_READ;
```

LU-20201 forces `FMODE_READ`, which makes the retry use `want=MAY_READ`. this can't match `--x` ACEs.

Reproducer attached below in reproducer.sh