On Fri, May 8, 2020 at 12:14 PM Chakra Divi <chakragithub@xxxxxxxxx> wrote: > > On Tue, Apr 28, 2020 at 1:51 PM Miklos Szeredi <miklos@xxxxxxxxxx> wrote: > > > > On Mon, Apr 27, 2020 at 3:46 PM Chakra Divi <chakragithub@xxxxxxxxx> wrote: > > > > > > On Tue, Apr 21, 2020 at 4:21 PM Chakra Divi <chakragithub@xxxxxxxxx> wrote: > > > > > > > > On Mon, Apr 20, 2020 at 4:55 PM Miklos Szeredi <miklos@xxxxxxxxxx> wrote: > > > > > > > > > > On Wed, Apr 1, 2020 at 11:31 AM Chakra Divi <chakragithub@xxxxxxxxx> wrote: > > > > > > > > > > > > In current code, for exec we are checking mode bits > > > > > > for x bit set even though the fuse_perm_getattr returns > > > > > > success. Changes in this patch avoids mode bit explicit > > > > > > check, leaves the exec checking to fuse file system > > > > > > in uspace. > > > > > > > > > > Why is this needed? > > > > > > > > Thanks for responding Miklos. We have an use case with our remote file > > > > system mounted on fuse , where permissions checks will happen remotely > > > > without the need of mode bits. In case of read, write it worked > > > > without issues. But for executable files, we found that fuse kernel is > > > > explicitly checking 'x' mode bit set on the file. We want this > > > > checking also to be pushed to remote instead of kernel doing it - so > > > > modified the kernel code to send getattr op to usespace in exec case > > > > too. > > > > > > Any help on this Miklos.... > > > > I still don't understand what you are requesting. What your patch > > does is unconditionally allow execution, even without any 'x' bits in > > the mode. What does that achieve? > > Thanks for the help Miklos. We have a network based filesystem that > supports acls. > As our filesystem give granular access, we wipe out the mode bits and > completely rely on ACLs. Are you using POSIX ACLs? Why can't you translate the ACL's back into mode bits (that's what all filesystems do)? > > Fuse works well for all other ops (with default_permissions disabled ) > as all the checks are done at the filesystems. > But only executables have problems because fuse kernel rejects the > execution by doing access checks on mode bit. > To push this check to filesystem, in the above patch - i'm relying on > return value from fuse_perm_getattr() ignoring the mode bits. > > When the fuse module is asked to rely on filesystem for access checks, > why do we need this explicit check for executables? Because there's no other check. Have you noticed that with your patch *all* files become executable? I guess that's not what you wanted... Thanks, Miklos
