[LU-4680] Invalid system.posix_acl_default breaks umask on ZFS MDT

• Type: Bug
• Resolution: Duplicate
• Priority: Major
• Affects Version/s: Lustre 2.4.1
• Labels: llnl prz
• Environment: lustre-2.4.0-19chaos (see http://github.com/chaos/lustre)
• Severity: 3
• Assignee: Lai Siyao
• Reporter: Ned Bass (Inactive)

Description

GNU cp -rp tries to store a default ACL on the destination if the source filesystem supports ACLs, even if the source file has no default ACL. If the destination is a Lustre filesystem with a ZFS MDT, an invalid or empty default ACL is applied, causing Lustre to bypass the umask in the destination directory. This shell snippet demonstrates the problem:

src=`mktemp -d XXXX`
dest=`mktemp -u XXXX`
getfattr -n system.posix_acl_default $src
cp -rp $src $dest
getfattr -n system.posix_acl_default $dest
umask
touch $dest/foo
ls -l $dest/foo

Example output:

# oslic6 /p/lscratchv/bass6 > src=`mktemp -d XXXX`
# oslic6 /p/lscratchv/bass6 > dest=`mktemp -u XXXX`
# oslic6 /p/lscratchv/bass6 > getfattr -n system.posix_acl_default $src 
# file: g9Lo
system.posix_acl_default

# oslic6 /p/lscratchv/bass6 > cp -rp $src $dest
# oslic6 /p/lscratchv/bass6 > getfattr -n system.posix_acl_default $dest
# file: U0tY
system.posix_acl_default=0sAgAAAA==

# oslic6 /p/lscratchv/bass6 > umask
0077
# oslic6 /p/lscratchv/bass6 > touch $dest/foo
# oslic6 /p/lscratchv/bass6 > ls -l $dest/foo
-rw-rw-rw- 1 root root 0 Feb 27 14:20 U0tY/foo

Note the file foo has mode 0666 even though umask was 0077. Running this test on an ldiskfs filesystem shows that the invalid/empty ACL is discarded, so umask still works as expected.

Issue Links

• is related to: LU-5150 NULL pointer dereference in posix_acl_valid() under mdc_get_lustre_md()
• is related to: LU-5434 Invalid system.posix_acl_access breaks permissions enforcement

Comments

[Peter Jones]

LLNL agree that this should be covered by the LU-5150 fix

[Emoly Liu]

Hi Chris,
Lai is on vacation. I think his patch http://review.whamcloud.com/#/c/10895/ for LU-5150 should help with this ticket.

[Christopher Morrone (Inactive)]

10850 is a patch, but not the fix we need for this ticket.