[fuse-devel] ACL support

[Martin P. <ZR...@ch...>]

Hello,

I'm writing an overlay file system using the Fuse API. I found a (in my 
eyes a comprehensive one) test suite checking some POSIX calls. Regarding 
ACLs some of the tests were failing. Here an example:

I created a file with the following permissions:

[root@localhost orig]#  getfacl file
# file: file
# owner: 65533
# group: 65533
user::---
user:root:--x                   #effective:---
user:65531:r--
group::---
group:root:r-x                  #effective:r--
group:65532:-w-
mask::rw-
other::---

The getfacl call showed identical permissions on the overlay file system 
and the original one. If I try to open the file in the following way:

        setuid(65530);
        setgid(65530);

        if (open(argv[1], O_RDONLY) == -1) {
                std::cout << "open error: " << strerror(errno) << 
std::endl;
        }

within the overlay file system I got an error:

[root@localhost ovl]# /root/open file 
open error: Permission denied

while within the original (ext4/xfs) file system this works fine:

[root@localhost ovl]# /root/open file 
open error: Permission denied

I performed that test on a quite new Fedora 27:

[root@localhost orig]# cat /etc/redhat-release 
Fedora release 27 (Twenty Seven)
[root@localhost orig]# uname -a
Linux localhost.localdomain 4.13.9-300.fc27.x86_64 #1 SMP Mon Oct 23 
13:41:58 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
[root@localhost orig]# rpm -qi fuse
Name        : fuse
Version     : 2.9.7
Release     : 9.fc27
Architecture: x86_64
Install Date: Mon 09 Apr 2018 02:47:21 PM CEST
Group       : Unspecified
Size        : 199956
License     : GPL+
Signature   : RSA/SHA256, Wed 09 Aug 2017 04:00:47 AM CEST, Key ID 
f55e7430f5282ee4
Source RPM  : fuse-2.9.7-9.fc27.src.rpm
Build Date  : Mon 07 Aug 2017 04:55:03 PM CEST
Build Host  : buildvm-09.phx2.fedoraproject.org
Relocations : (not relocatable)
Packager    : Fedora Project
Vendor      : Fedora Project
URL         : http://fuse.sf.net
Summary     : File System in Userspace (FUSE) v2 utilities
Description :
With FUSE it is possible to implement a fully functional filesystem in a
userspace program. This package contains the FUSE v2 userspace tools to
mount a FUSE filesystem.

ACLs seems being set internally using the system.posix_acl_access xattr. 
Setting this attribute seems to work: otherwise the getfacl  command would 
report different values between the original and the overlay file system. 
There I have some questions:

I found some comments that are indicating that ACL work was in progress. 
Is there a specific kernel version/fuse release that should be used?
Beside implementing the xattr call backs is there anything else to do? In 
debugging mode I only see calls to the getattr call back.



Regards

Martin Petermann


Phone: 41-44 724 86 95
E-mail: MA...@zu...


Saeumerstrasse 4
Rueschlikon, 8803
Switzerland