On Wed, 2023-05-17 at 09:42 +0200, Christian Brauner wrote: > On Tue, May 16, 2023 at 05:22:30PM -0400, Jeff Layton wrote: > > On Tue, 2023-05-16 at 20:50 +0000, Ondrej Valousek wrote: > > > > > > Hi Christian, > > > > > > Would it be possible to patch kernel the way it accepts native (i.e no > > > conversion to Posix ACL) NFSv4 style ACLs for filesystems that can > > > support them? > > > I.E. OpenZFS, NTFS, could be also interesting for Microsofts WSL2 or > > > Samba right? > > > > > > I mean, I am not trying to push richacl again knowing they have been > > > rejected, but just NFS4 style Acls as they are so similar to Windows > > > ACLs. > > > > > > > Erm, except you kind of are if you want to do this. I don't see how this > > idea works unless you resurrect RichACLs or something like them. > > I have no idea about the original flame war that ended RichACLs in > additition to having no clear clue what RichACLs are supposed to > achieve. My current knowledge extends to "Christoph didn't like them". > > > > > > The idea here would be that we could > > > - mount NTFS/ZFS filesystem and inspect ACLs using existing tools > > > (nfs4_getacl) > > > - share with NFSv4 in a pass through mode > > > - in Windows WSL2 we could inspect local filesystem ACLs using the > > > same tools > > > > > > Does it make any sense or it would require lot of changes to VFS > > > subsystem or its a nonsense altogether? > > Yes, very likely. > > We'd either have to change the current inode operations for getting and > setting acls to take a new struct acl that can contain either posix acls > or rich acls or add new ones just for these new fangled ones. > > Choosing the first - more sensible - of these two options will mean > updating each filesystem's acl inode operations. Might turn out to not > be invasive code as it might boil down to struct posix_acl *acl = > acl->posix at the beginning of each method but still. > > Then we'd probably also need to: > > * handle permission checking (see Jeff's comment below) > * change/update the ACL caching layer > * if the past hast taught me anything then overlayfs would probably need > some additional logic as well > Yeah, it's a significant project. > > > > > > > Eventually you have to actually enforce the ACL. Do NTFS/ZFS already > > have code to do this? If not then someone would need to write it. > > > > Also windows and nfs acls do have some differences, so you'll need a > > translation layer too. > > Jeff, I know you have some knowledge in this area you probably are > better equipped to judge the sanity and feasibility of this. I know a bit, but Andreas (cc'ed) is the undisputed expert. If you're looking to resurrect this effort, then you should definitely loop him in. -- Jeff Layton <jlayton@xxxxxxxxxx>
