From timh@spidey.central.sun.com Tue Apr 1 10:16:34 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m31HGYbx019144 for ; Tue, 1 Apr 2008 10:16:34 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m31HGXOg052243; Tue, 1 Apr 2008 11:16:33 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JYN00K09PBLL200@nwk-avmta-1.sfbay.Sun.COM>; Tue, 01 Apr 2008 10:16:33 -0700 (PDT) Received: from spidey.central.sun.com ([172.20.25.27]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JYN00AT9PBJTAA0@nwk-avmta-1.sfbay.Sun.COM>; Tue, 01 Apr 2008 10:16:32 -0700 (PDT) Received: from spidey.central.sun.com (localhost [127.0.0.1]) by spidey.central.sun.com (8.14.2+Sun/8.14.2) with ESMTP id m31HGVX4014237; Tue, 01 Apr 2008 11:16:31 -0600 (MDT) Received: (from timh@localhost) by spidey.central.sun.com (8.14.2+Sun/8.14.2/Submit) id m31HGV5E014235; Tue, 01 Apr 2008 11:16:31 -0600 (MDT) Date: Tue, 01 Apr 2008 11:16:31 -0600 (MDT) From: Tim Haley - Sun Microsystem Subject: New ZFS "passthrough" ACL inheritance rules [PSARC/2008/231 FastTrack timeout 04/08/2008] To: PSARC-ext@sun.com Cc: zfs-team@sun.com Message-id: <200804011716.m31HGV5E014235@spidey.central.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 8609 I am sponsoring this fasttrack on behalf of Mark Shellenbaum. The case proposes to change inheritance rules of ZFS ACLs when the 'passthrough' property is placed on a file system. This case seeks Patch/Micro Binding, timeout is 4/8/2008. Template Version: @(#)sac_nextcase 1.64 07/13/07 SMI This information is Copyright 2008 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: New ZFS "passthrough" ACL inheritance rules 1.2. Name of Document Author/Supplier: Author: Mark Shellenbaum 1.3 Date of This Document: 01 April, 2008 4. Technical Description SUMMARY: This proposal is to change the ZFS ACL inheritance rules when the zfs acl property is set to "passthrough". PROBLEM: The ZFS ACL subsystem provides a property aclinherit to control how ACL inheritance is performed. The default value "secure" creates ACLs that conform to POSIX access control semantics. Many customers desire native NFSv4 ACL inheritance. They want to be able to "force" the mode that files and directories are created with. In the past they would use default ACLs on UFS to achieve this. The NFSv4 ACL model can also do this, but the current implementation in ZFS disables the ACEs owner@, group@, and everyone@ in order to set the mode of the file to the mode the application requested. This problem has been discussed countless times on zfs-discuss@opensolaris.org and has caused some customers to not upgrade to ZFS because they need a way to force the creation mode for files and directories. The current behavior differs from UFS and is unintuitive to users and the zfs community consensus is that we should have a mechanism for inheriting permissions for ACEs that affect the mode of the file. PROPOSED SOLUTION: The aclinherit property already supports a "passthrough" value which is intended to provide a more native NFSv4 ACL representation, but today only allows an application to inherit the control permissions "write_owner and or write_acl". If we expand the meaning of this property, such that if a parent directory contains inheritable owner@, group@ or everyone@ ACEs then those permissions will replace the requested mode for the file or directory create. This will be similar to UFS default ACLs, except that the administrator will have to enable the capability on the file system via the aclinherit property. See below for an example of this. This behavior only affects the initial create of the file or directory. Subsequent chmod(2) requests will apply the chmod(2) algorithm that ZFS already uses to enforce POSIX semantics. ZFS already has other features that take us out of POSIX control. For example, the nbmand property, system attributes, such as readonly, immutable, nounlink, appendonly, quarantined, and so on. INHERITANCE EXAMPLES: First lets look at a UFS default ACL example For this example I will using user "sys" and "dladm" that are both in the "sys" group. # su sys # mkdir ufs-test # chmod 775 ufs-test Now lets create a default ACL that will specify 0666 for new files. # setfacl -m d:u::rw-,d:g::rw-,d:o:rw-,d:m:rwx ufs-test # ls -dV ufs-test drwxrwxr-x+ 2 sys sys 512 Mar 19 13:21 ufs-test 0:user::rwx 1:group::rwx #effective:rwx 2:mask:rwx 3:other:r-x 4:Default:user::rw- 5:default:group::rw- 6:default:mask:rwx 7:default:other:rw- Now switch to user dladm and create a new file and set our umask to 066. # su dladm dladm$ umask 066 dladm$ cd ufs-test dladm$ touch a dladm$ ls -l a # ls -l x -rw-rw-rw- 1 dladm sys 0 Mar 19 11:36 a The next example is what most users typical try to do with ZFS to achieve the same sort of thing. # mkdir dir1 Now lets prepend 3 ACEs to the beginning of the ACL on the directory for owner@, group@ and everyone@ that are specified to inherit to newly created files and directories. # mkdir /sandbox/dir1 # chmod 755 /sandbox/dir1 # chmod A+owner@:rw:fd:allow,group@:rw:fd:allow, \ everyone@:rw:fd:allow dir1 # ls -dV dir1 drwxrwxrwx+ 2 root root 3 Mar 19 13:04 dir1 owner@:rw------------:fd-----:allow group@:rw------------:fd-----:allow everyone@:rw------------:fd-----:allow owner@:--------------:-------:deny owner@:rwxp---A-W-Co-:-------:allow group@:rw-p----------:-------:deny group@:--x-----------:-------:allow everyone@:rw-p---A-W-Co-:-------:deny everyone@:--x---a-R-c--s:-------:allow # cd dir1 # touch a Now lets look at the new file. # ls -V a -rw-r--r--+ 1 root root 0 Mar 19 13:04 a owner@:--------------:------I:allow group@:--------------:------I:allow everyone@:--------------:------I:allow owner@:--x-----------:-------:deny owner@:rw-p---A-W-Co-:-------:allow group@:-wxp----------:-------:deny group@:r-------------:-------:allow everyone@:-wxp---A-W-Co-:-------:deny everyone@:r-----a-R-c--s:-------:allow What happens here is that ZFS inherited the 3 ACEs (owner@, group@, everyone@) as indicated by the ------I, but then they were disabled in order to place POSIX semantics on the file and also to set the mode to 0644. The customer was expecting the file to be created with mode 0666. The remaining examples are with the proposed solution to allow inheriting mode bit permissions. # zfs create sandbox/testfs Now lets set the passthrough mode for aclinherit # zfs set aclinherit=passthrough sandbox/testfs # cd /sandbox/testfs # mkdir testdir Now lets set up an ACL on testdir to cause inheritance. This will create a 3 member ACL for newly created files. It will have one owner@, group@, and everyone@ entry. Newly created Directories will have 3 entries for @owner@, group@, and everyone@. Additionally, directories will have 6 other ACEs which are for propagating the ACEs to newly created directories and files. # chmod A+owner@:rwxpAWC:d:allow,owner@:rwpAWC:f, \ group@:x:d:allow,group@::f:allow,everyone@:x:d, \ everyone@::f:allow testdir First lets create a file. # cd testdir # touch file.1 # ls -V file.1 -rw-------+ 1 root root 0 Mar 18 10:49 file.1 owner@:rw-p---A-W-C--:------I:allow group@:--------------:------I:allow everyone@:--------------:------I:allow This created an ACL with just the three ACEs that were specified to be inherited to newly created files. Now lets create a directory. The inherited ACL will include both ACEs that control access to this directory as well as ACEs for future propagation to children of the newly created directory. # mkdir dir.1 # ls -dV dir.1 drwx--x--x+ 2 root root 2 Mar 18 10:51 dir.1 owner@:rwxp---A-W-C--:-di---I:allow owner@:rwxp---A-W-C--:------I:allow owner@:rw-p---A-W-C--:f-i---I:allow group@:--x-----------:-di---I:allow group@:--x-----------:------I:allow group@:--------------:f-i---I:allow everyone@:--x-----------:-di---I:allow everyone@:--x-----------:------I:allow everyone@:--------------:f-i---I:allow The entries with -di-- and f-i--- are for propagating and are not considered during access control. Now lets move to another directory where inherited ACEs aren't present and the file will be created with a trivial ACL. # cd /sandbox/testfs # touch file.1 # ls -V file.1 -rw-r--r-- 1 root root 0 Mar 18 10:53 file.1 owner@:--x-----------:-------:deny owner@:rw-p---A-W-Co-:-------:allow group@:-wxp----------:-------:deny group@:r-------------:-------:allow everyone@:-wxp---A-W-Co-:-------:deny everyone@:r-----a-R-c--s:-------:allow RELEASE BINDING Patch/Micro - Change will need to be backported to Solaris 10. No change to existing ACL interface stability levels. MANPAGE DIFFS 553a554,558 > When property value is set to "passthrough" files will be > created with a mode determined by the inheritable ACEs. > If no inheritable ACEs exist that affect the mode then > the mode will be set in accordance to the requested mode > from the application. 554a560 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: ON 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open From Darren.Moffat@sun.com Tue Apr 1 10:19:45 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m31HJi42019271 for ; Tue, 1 Apr 2008 10:19:45 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m31HJdI4012404; Wed, 2 Apr 2008 01:19:43 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JYN00A05PGSKB00@brm-avmta-1.central.sun.com>; Tue, 01 Apr 2008 11:19:40 -0600 (MDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JYN004QNPGRUW70@brm-avmta-1.central.sun.com>; Tue, 01 Apr 2008 11:19:40 -0600 (MDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-2-fe2.eu.sun.com [192.18.6.11]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m31HJdIT026753; Tue, 01 Apr 2008 17:19:39 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JYN00M01P929M00@fe-emea-09.sun.com> (original mail from Darren.Moffat@Sun.COM); Tue, 01 Apr 2008 18:19:39 +0100 (BST) Received: from [129.156.173.199] by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JYN00GSXPGQF810@fe-emea-09.sun.com>; Tue, 01 Apr 2008 18:19:39 +0100 (BST) Date: Tue, 01 Apr 2008 18:19:38 +0100 From: Darren J Moffat Subject: Re: New ZFS "passthrough" ACL inheritance rules [PSARC/2008/231 FastTrack timeout 04/08/2008] In-reply-to: <200804011716.m31HGV5E014235@spidey.central.sun.com> Sender: Darren.Moffat@sun.com To: Tim Haley - Sun Microsystem Cc: PSARC-ext@sun.com, zfs-team@sun.com Message-id: <47F26EAA.2040803@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200804011716.m31HGV5E014235@spidey.central.sun.com> User-Agent: Thunderbird 2.0.0.9 (X11/20080225) Status: RO Content-Length: 272 Since this proposed behaviour is the default for ACLs on UFS why isn't it the default for ZFS too ? Also shouldn't "secure" be "posix" because "secure" is subjective and relative. Is changing the default value of aclinherit considered to painful ? -- Darren J Moffat From Mark.Shellenbaum@sun.com Tue Apr 1 10:32:54 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m31HWraQ019934 for ; Tue, 1 Apr 2008 10:32:54 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m31HWmF4028147; Tue, 1 Apr 2008 18:32:52 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JYN00B0HQ2PDL00@brm-avmta-1.central.sun.com>; Tue, 01 Apr 2008 11:32:49 -0600 (MDT) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JYN0042KQ2OUS90@brm-avmta-1.central.sun.com>; Tue, 01 Apr 2008 11:32:48 -0600 (MDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m31HWmcq026822; Tue, 01 Apr 2008 17:32:48 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JYN00K01P5QGN00@mail-amer.sun.com> (original mail from Mark.Shellenbaum@Sun.COM); Tue, 01 Apr 2008 11:32:47 -0600 (MDT) Received: from [172.20.25.34] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JYN00GCMQ2NCA50@mail-amer.sun.com>; Tue, 01 Apr 2008 11:32:47 -0600 (MDT) Date: Tue, 01 Apr 2008 11:32:06 -0600 From: Mark Shellenbaum Subject: Re: New ZFS "passthrough" ACL inheritance rules [PSARC/2008/231 FastTrack timeout 04/08/2008] In-reply-to: <47F26EAA.2040803@Sun.COM> Sender: Mark.Shellenbaum@sun.com To: Darren J Moffat Cc: Tim Haley - Sun Microsystem , PSARC-ext@sun.com, zfs-team@sun.com Message-id: <47F27196.4020509@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200804011716.m31HGV5E014235@spidey.central.sun.com> <47F26EAA.2040803@Sun.COM> User-Agent: Thunderbird 2.0.0.6 (X11/20071203) Status: RO Content-Length: 728 Darren J Moffat wrote: > Since this proposed behaviour is the default for ACLs on UFS why isn't > it the default for ZFS too ? I'm more than willing to make this the default behavior for ZFS, but it will affect POSIX compliance. If thats alright with everyone then I can change it to be the default. > > Also shouldn't "secure" be "posix" because "secure" is subjective and > relative. > secure is what it was called in the original ZFS ARC case. I can change it to "posix" if you want. My only concern would be if users have become accustomed to its present value. > Is changing the default value of aclinherit considered to painful ? No, this is actually a very small code change. > > -- > Darren J Moffat From Darren.Moffat@sun.com Tue Apr 1 10:46:47 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m31HkkxX020577 for ; Tue, 1 Apr 2008 10:46:46 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m31Hkgg0004625; Tue, 1 Apr 2008 18:46:45 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JYN00003QPW9P00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 01 Apr 2008 10:46:44 -0700 (PDT) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JYN00AAIQPVTCF0@nwk-avmta-1.sfbay.Sun.COM>; Tue, 01 Apr 2008 10:46:43 -0700 (PDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-2-fe3.eu.sun.com [192.18.6.12]) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m31Hkg8a025190; Tue, 01 Apr 2008 17:46:42 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JYN00201QM10M00@fe-emea-09.sun.com> (original mail from Darren.Moffat@Sun.COM); Tue, 01 Apr 2008 18:46:42 +0100 (BST) Received: from [129.156.173.199] by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JYN00GUSQPUF810@fe-emea-09.sun.com>; Tue, 01 Apr 2008 18:46:42 +0100 (BST) Date: Tue, 01 Apr 2008 18:46:42 +0100 From: Darren J Moffat Subject: Re: New ZFS "passthrough" ACL inheritance rules [PSARC/2008/231 FastTrack timeout 04/08/2008] In-reply-to: <47F27196.4020509@Sun.COM> Sender: Darren.Moffat@sun.com To: Mark Shellenbaum Cc: Tim Haley - Sun Microsystem , PSARC-ext@sun.com, zfs-team@sun.com Message-id: <47F27502.4050802@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200804011716.m31HGV5E014235@spidey.central.sun.com> <47F26EAA.2040803@Sun.COM> <47F27196.4020509@Sun.COM> User-Agent: Thunderbird 2.0.0.9 (X11/20080225) Status: RO Content-Length: 1022 Mark Shellenbaum wrote: > Darren J Moffat wrote: >> Since this proposed behaviour is the default for ACLs on UFS why isn't >> it the default for ZFS too ? > > I'm more than willing to make this the default behavior for ZFS, but it > will affect POSIX compliance. If thats alright with everyone then I can > change it to be the default. Would this be the one and only setting that means that a ZFS dataset wouldn't be in a POSIX compliant configuration by default ? If it is then I would say it shouldn't be changed. However if there are others then IMO the default ACL behaviour should be the one that matches NFSv4 and what people expect of ACLs regardless of what POSIX thinks. >> >> Also shouldn't "secure" be "posix" because "secure" is subjective and >> relative. >> > > secure is what it was called in the original ZFS ARC case. I can change > it to "posix" if you want. My only concern would be if users have > become accustomed to its present value. What about an alias ? -- Darren J Moffat From don.cragun@sun.com Tue Apr 1 11:06:36 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m31I6ZVP021222 for ; Tue, 1 Apr 2008 11:06:35 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m31I6X7p013918; Tue, 1 Apr 2008 19:06:34 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JYN00201RMU0500@nwk-avmta-1.sfbay.Sun.COM>; Tue, 01 Apr 2008 11:06:30 -0700 (PDT) Received: from dm-eng-02.sfbay.sun.com ([129.146.11.32]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JYN0011URMTY400@nwk-avmta-1.sfbay.Sun.COM>; Tue, 01 Apr 2008 11:06:29 -0700 (PDT) Received: from spartan.eng.sun.com (spartan.SFBay.Sun.COM [129.146.226.64]) by dm-eng-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m31I6Tdr013276; Tue, 01 Apr 2008 11:06:29 -0700 (PDT) Received: from spartan (spartan [129.146.226.64]) by spartan.eng.sun.com (8.13.7+Sun/8.13.7) with SMTP id m31HpU09009376; Tue, 01 Apr 2008 10:51:30 -0700 (PDT) Date: Tue, 01 Apr 2008 10:51:30 -0700 (PDT) From: Don Cragun Subject: Re: New ZFS "passthrough" ACL inheritance rules [PSARC/2008/231 FastTrack timeout 04/08/2008] To: Mark.Shellenbaum@sun.com Cc: timh@spidey.central.sun.com, PSARC-ext@sun.com, zfs-team@sun.com Reply-to: Don Cragun Message-id: <200804011751.m31HpU09009376@spartan.eng.sun.com> MIME-version: 1.0 X-Mailer: dtmail 1.3.0 @(#)CDE Version 1.6.2 SunOS 5.10 sun4u sparc Content-type: TEXT/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-MD5: G1FR6h/MZS5K+9NA4hG26Q== X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 1415 >Date: Tue, 01 Apr 2008 11:32:06 -0600 >From: Mark Shellenbaum > >Darren J Moffat wrote: >> Since this proposed behaviour is the default for ACLs on UFS why isn't >> it the default for ZFS too ? > >I'm more than willing to make this the default behavior for ZFS, but it >will affect POSIX compliance. If thats alright with everyone then I can >change it to be the default. I believe that the default should be POSIX compliant. Let administrators specify options if they want non-standard behavior. > >> >> Also shouldn't "secure" be "posix" because "secure" is subjective and >> relative. >> > >secure is what it was called in the original ZFS ARC case. I can change >it to "posix" if you want. My only concern would be if users have >become accustomed to its present value. ACLs are not in POSIX. (POSIX does, however, specify two classes of extended access control mechanisms [known as "additional file access control mechanisms" and "alternate file access control mechanisms"] and specifies interactions between chmod() and these classes of file access control mechanisms. ACLs can be added as additional and/or alternate file access control mechanism as long as the interactions follow the standards.) - Don > >> Is changing the default value of aclinherit considered to painful ? > >No, this is actually a very small code change. > >> >> -- >> Darren J Moffat From Mark.Shellenbaum@Sun.COM Tue Apr 1 11:45:55 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m31IjsuY022363 for ; Tue, 1 Apr 2008 11:45:55 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m31IjcRk002424; Tue, 1 Apr 2008 19:45:53 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JYN00G1LTGGKW00@nwk-avmta-2.sfbay.sun.com>; Tue, 01 Apr 2008 11:45:52 -0700 (PDT) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JYN00BLMTGFVTA0@nwk-avmta-2.sfbay.sun.com>; Tue, 01 Apr 2008 11:45:51 -0700 (PDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m31IjpAx016599; Tue, 01 Apr 2008 18:45:51 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JYN00201SRIIG00@mail-amer.sun.com> (original mail from Mark.Shellenbaum@Sun.COM); Tue, 01 Apr 2008 12:45:51 -0600 (MDT) Received: from [172.20.25.34] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JYN00J1KTGEAG10@mail-amer.sun.com>; Tue, 01 Apr 2008 12:45:50 -0600 (MDT) Date: Tue, 01 Apr 2008 12:45:10 -0600 From: Mark Shellenbaum Subject: Re: New ZFS "passthrough" ACL inheritance rules [PSARC/2008/231 FastTrack timeout 04/08/2008] In-reply-to: <47F27502.4050802@Sun.COM> Sender: Mark.Shellenbaum@Sun.COM To: Darren J Moffat Cc: PSARC-ext@Sun.COM, zfs-team@Sun.COM Message-id: <47F282B6.3080208@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200804011716.m31HGV5E014235@spidey.central.sun.com> <47F26EAA.2040803@Sun.COM> <47F27196.4020509@Sun.COM> <47F27502.4050802@Sun.COM> User-Agent: Thunderbird 2.0.0.6 (X11/20071203) Status: RO Content-Length: 1321 Darren J Moffat wrote: > Mark Shellenbaum wrote: >> Darren J Moffat wrote: >>> Since this proposed behaviour is the default for ACLs on UFS why >>> isn't it the default for ZFS too ? >> >> I'm more than willing to make this the default behavior for ZFS, but >> it will affect POSIX compliance. If thats alright with everyone then >> I can change it to be the default. > > Would this be the one and only setting that means that a ZFS dataset > wouldn't be in a POSIX compliant configuration by default ? If it is > then I would say it shouldn't be changed. However if there are others > then IMO the default ACL behaviour should be the one that matches NFSv4 > and what people expect of ACLs regardless of what POSIX thinks. > Lets leave the default as it is, and have the new inheritance behavior only take place under "passthrough". We can always change this later with another fast track. > >>> >>> Also shouldn't "secure" be "posix" because "secure" is subjective and >>> relative. >>> >> >> secure is what it was called in the original ZFS ARC case. I can >> change it to "posix" if you want. My only concern would be if users >> have become accustomed to its present value. > > What about an alias ? > How about I rename "secure" to "restricted" and have an alias for "secure". -Mark From amw@sun.com Tue Apr 1 13:38:48 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m31KclVB027081 for ; Tue, 1 Apr 2008 13:38:48 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m31KcbMQ029118; Wed, 2 Apr 2008 04:38:46 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JYN0010NYOJ9Z00@brm-avmta-1.central.sun.com>; Tue, 01 Apr 2008 14:38:43 -0600 (MDT) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JYN000HAYOIOY00@brm-avmta-1.central.sun.com>; Tue, 01 Apr 2008 14:38:42 -0600 (MDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m31KcgKo004949; Tue, 01 Apr 2008 20:38:42 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JYN00E01YJERA00@mail-amer.sun.com> (original mail from amw@sun.com); Tue, 01 Apr 2008 14:38:42 -0600 (MDT) Received: from [10.1.98.35] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JYN009PHYO8CB20@mail-amer.sun.com>; Tue, 01 Apr 2008 14:38:33 -0600 (MDT) Date: Tue, 01 Apr 2008 13:37:43 -0700 From: Alan M Wright Subject: Re: New ZFS "passthrough" ACL inheritance rules [PSARC/2008/231 FastTrack timeout 04/08/2008] In-reply-to: <47F282B6.3080208@Sun.COM> Sender: Alan.M.Wright@sun.com To: Mark Shellenbaum Cc: Darren J Moffat , PSARC-ext@sun.com, zfs-team@sun.com Message-id: <47F29D17.5000801@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200804011716.m31HGV5E014235@spidey.central.sun.com> <47F26EAA.2040803@Sun.COM> <47F27196.4020509@Sun.COM> <47F27502.4050802@Sun.COM> <47F282B6.3080208@Sun.COM> User-Agent: Thunderbird 2.0.0.6 (X11/20070802) Status: RO Content-Length: 2318 Mark Shellenbaum wrote: > Darren J Moffat wrote: >> Mark Shellenbaum wrote: >>> Darren J Moffat wrote: >>>> Since this proposed behaviour is the default for ACLs on UFS why >>>> isn't it the default for ZFS too ? >>> >>> I'm more than willing to make this the default behavior for ZFS, but >>> it will affect POSIX compliance. If thats alright with everyone then >>> I can change it to be the default. >> >> Would this be the one and only setting that means that a ZFS dataset >> wouldn't be in a POSIX compliant configuration by default ? If it is >> then I would say it shouldn't be changed. However if there are others >> then IMO the default ACL behaviour should be the one that matches >> NFSv4 and what people expect of ACLs regardless of what POSIX thinks. >> > > Lets leave the default as it is, and have the new inheritance behavior > only take place under "passthrough". We can always change this later > with another fast track. > >> >>>> >>>> Also shouldn't "secure" be "posix" because "secure" is subjective >>>> and relative. >>>> >>> >>> secure is what it was called in the original ZFS ARC case. I can >>> change it to "posix" if you want. My only concern would be if users >>> have become accustomed to its present value. >> >> What about an alias ? >> > > How about I rename "secure" to "restricted" and have an alias for "secure". > > -Mark Mark, While you are doing this, would it be possible to get aliases for some standard chmod settings? For example, currently, to set FullControl we have: chmod A=everyone@:rwxpdDaARWcCos:fd:allow /pool/fs For most people that probably requires use of the man page every time. It would be nice if we could do: chmod A=everyone@:$FullControl:fd:allow /pool/fs How about three aliases: $READ, $CHANGE, $FULLCONTROL $Read: read, execute, view properties/permissions (directory: list contents) Alias for: rxacR $Change: $Read, write, delete, modify properties/permissions (directory: add files/sub-directories) Alias for: rwxpdDaARWcC $FullControl: $Change, write-owner Alias for: rwxpdDaARWcCos I'm not hung up on the doller ($) prefix or the names but it would be good to have something to make this easier than it is now. Alan From Nicolas.Williams@sun.com Tue Apr 1 13:48:29 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m31KmTL5027524 for ; Tue, 1 Apr 2008 13:48:29 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m31KmQUG025674; Tue, 1 Apr 2008 13:48:26 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JYN00K0TZ4QVX00@nwk-avmta-2.sfbay.sun.com>; Tue, 01 Apr 2008 13:48:26 -0700 (PDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JYN00I1PZ4O8W50@nwk-avmta-2.sfbay.sun.com>; Tue, 01 Apr 2008 13:48:25 -0700 (PDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id m31KmOFQ001054; Tue, 01 Apr 2008 15:48:24 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id m31KmOag001053; Tue, 01 Apr 2008 15:48:24 -0500 (CDT) Date: Tue, 01 Apr 2008 15:48:24 -0500 From: Nicolas Williams Subject: Re: New ZFS "passthrough" ACL inheritance rules [PSARC/2008/231 FastTrack timeout 04/08/2008] In-reply-to: <47F29D17.5000801@sun.com> To: Alan M Wright Cc: Mark Shellenbaum , Darren J Moffat , PSARC-ext@sun.com, zfs-team@sun.com Mail-followup-to: Alan M Wright , Mark Shellenbaum , Darren J Moffat , PSARC-ext@Sun.COM, zfs-team@sun.com Message-id: <20080401204824.GD16998@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200804011716.m31HGV5E014235@spidey.central.sun.com> <47F26EAA.2040803@Sun.COM> <47F27196.4020509@Sun.COM> <47F27502.4050802@Sun.COM> <47F282B6.3080208@Sun.COM> <47F29D17.5000801@sun.com> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 576 On Tue, Apr 01, 2008 at 01:37:43PM -0700, Alan M Wright wrote: > While you are doing this, would it be possible to get aliases for some > standard chmod settings? > > [...] > It would be nice if we could do: > > chmod A=everyone@:$FullControl:fd:allow /pool/fs > > How about three aliases: $READ, $CHANGE, $FULLCONTROL > > [...] > I'm not hung up on the doller ($) prefix or the names but it would > be good to have something to make this easier than it is now. +1, but I'd rather a different character be used for this than '$'... Underscore should be fine. Nico -- From Mark.Shellenbaum@sun.com Tue Apr 1 13:48:45 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m31KmjxH027536 for ; Tue, 1 Apr 2008 13:48:45 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m31Kmi9F021808; Tue, 1 Apr 2008 13:48:44 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JYN00H0BZ57RQ00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 01 Apr 2008 13:48:43 -0700 (PDT) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JYN001Q4Z57YAC0@nwk-avmta-1.sfbay.Sun.COM>; Tue, 01 Apr 2008 13:48:43 -0700 (PDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m31KmgrC002641; Tue, 01 Apr 2008 20:48:43 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JYN00E01YJERA00@mail-amer.sun.com> (original mail from Mark.Shellenbaum@Sun.COM); Tue, 01 Apr 2008 14:48:42 -0600 (MDT) Received: from [172.20.25.34] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JYN0097IZ4YCB80@mail-amer.sun.com>; Tue, 01 Apr 2008 14:48:35 -0600 (MDT) Date: Tue, 01 Apr 2008 14:47:52 -0600 From: Mark Shellenbaum Subject: Re: New ZFS "passthrough" ACL inheritance rules [PSARC/2008/231 FastTrack timeout 04/08/2008] In-reply-to: <47F29D17.5000801@sun.com> Sender: Mark.Shellenbaum@sun.com To: Alan M Wright Cc: Darren J Moffat , PSARC-ext@sun.com, zfs-team@sun.com Message-id: <47F29F78.3070308@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200804011716.m31HGV5E014235@spidey.central.sun.com> <47F26EAA.2040803@Sun.COM> <47F27196.4020509@Sun.COM> <47F27502.4050802@Sun.COM> <47F282B6.3080208@Sun.COM> <47F29D17.5000801@sun.com> User-Agent: Thunderbird 2.0.0.6 (X11/20071203) Status: RO Content-Length: 2546 Alan M Wright wrote: > Mark Shellenbaum wrote: >> Darren J Moffat wrote: >>> Mark Shellenbaum wrote: >>>> Darren J Moffat wrote: >>>>> Since this proposed behaviour is the default for ACLs on UFS why >>>>> isn't it the default for ZFS too ? >>>> >>>> I'm more than willing to make this the default behavior for ZFS, but >>>> it will affect POSIX compliance. If thats alright with everyone >>>> then I can change it to be the default. >>> >>> Would this be the one and only setting that means that a ZFS dataset >>> wouldn't be in a POSIX compliant configuration by default ? If it is >>> then I would say it shouldn't be changed. However if there are >>> others then IMO the default ACL behaviour should be the one that >>> matches NFSv4 and what people expect of ACLs regardless of what POSIX >>> thinks. >>> >> >> Lets leave the default as it is, and have the new inheritance behavior >> only take place under "passthrough". We can always change this later >> with another fast track. >> >>> >>>>> >>>>> Also shouldn't "secure" be "posix" because "secure" is subjective >>>>> and relative. >>>>> >>>> >>>> secure is what it was called in the original ZFS ARC case. I can >>>> change it to "posix" if you want. My only concern would be if users >>>> have become accustomed to its present value. >>> >>> What about an alias ? >>> >> >> How about I rename "secure" to "restricted" and have an alias for >> "secure". >> >> -Mark > > Mark, > > While you are doing this, would it be possible to get aliases for some > standard chmod settings? > Why don't you open an RFE for that and I will take care of it, but its not part of this case. > For example, currently, to set FullControl we have: > > chmod A=everyone@:rwxpdDaARWcCos:fd:allow /pool/fs > > For most people that probably requires use of the man page every time. > It would be nice if we could do: > > chmod A=everyone@:$FullControl:fd:allow /pool/fs > > How about three aliases: $READ, $CHANGE, $FULLCONTROL > > $Read: read, execute, view properties/permissions > (directory: list contents) > Alias for: rxacR > > $Change: $Read, write, delete, modify properties/permissions > (directory: add files/sub-directories) > Alias for: rwxpdDaARWcC > > $FullControl: $Change, write-owner > Alias for: rwxpdDaARWcCos > > I'm not hung up on the doller ($) prefix or the names but it would > be good to have something to make this easier than it is now. > > Alan From amw@sun.com Tue Apr 1 13:53:00 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m31KqxVw027725 for ; Tue, 1 Apr 2008 13:52:59 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m31Kqt9S005292; Wed, 2 Apr 2008 04:52:58 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JYN00I0BZC84Q00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 01 Apr 2008 13:52:56 -0700 (PDT) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JYN001WQZC7YBB0@nwk-avmta-1.sfbay.Sun.COM>; Tue, 01 Apr 2008 13:52:55 -0700 (PDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m31KqtPV010820; Tue, 01 Apr 2008 20:52:55 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JYN00D01W0GF900@mail-amer.sun.com> (original mail from amw@sun.com); Tue, 01 Apr 2008 14:52:55 -0600 (MDT) Received: from [10.1.98.35] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JYN00JHPZBGKX00@mail-amer.sun.com>; Tue, 01 Apr 2008 14:52:29 -0600 (MDT) Date: Tue, 01 Apr 2008 13:51:39 -0700 From: Alan M Wright Subject: Re: New ZFS "passthrough" ACL inheritance rules [PSARC/2008/231 FastTrack timeout 04/08/2008] In-reply-to: <47F29F78.3070308@Sun.COM> Sender: Alan.M.Wright@sun.com To: Mark Shellenbaum Cc: Darren J Moffat , PSARC-ext@sun.com, zfs-team@sun.com Message-id: <47F2A05B.8090704@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200804011716.m31HGV5E014235@spidey.central.sun.com> <47F26EAA.2040803@Sun.COM> <47F27196.4020509@Sun.COM> <47F27502.4050802@Sun.COM> <47F282B6.3080208@Sun.COM> <47F29D17.5000801@sun.com> <47F29F78.3070308@Sun.COM> User-Agent: Thunderbird 2.0.0.6 (X11/20070802) Status: RO Content-Length: 2654 Mark Shellenbaum wrote: > Alan M Wright wrote: >> Mark Shellenbaum wrote: >>> Darren J Moffat wrote: >>>> Mark Shellenbaum wrote: >>>>> Darren J Moffat wrote: >>>>>> Since this proposed behaviour is the default for ACLs on UFS why >>>>>> isn't it the default for ZFS too ? >>>>> >>>>> I'm more than willing to make this the default behavior for ZFS, >>>>> but it will affect POSIX compliance. If thats alright with >>>>> everyone then I can change it to be the default. >>>> >>>> Would this be the one and only setting that means that a ZFS dataset >>>> wouldn't be in a POSIX compliant configuration by default ? If it >>>> is then I would say it shouldn't be changed. However if there are >>>> others then IMO the default ACL behaviour should be the one that >>>> matches NFSv4 and what people expect of ACLs regardless of what >>>> POSIX thinks. >>>> >>> >>> Lets leave the default as it is, and have the new inheritance >>> behavior only take place under "passthrough". We can always change >>> this later with another fast track. >>> >>>> >>>>>> >>>>>> Also shouldn't "secure" be "posix" because "secure" is subjective >>>>>> and relative. >>>>>> >>>>> >>>>> secure is what it was called in the original ZFS ARC case. I can >>>>> change it to "posix" if you want. My only concern would be if >>>>> users have become accustomed to its present value. >>>> >>>> What about an alias ? >>>> >>> >>> How about I rename "secure" to "restricted" and have an alias for >>> "secure". >>> >>> -Mark >> >> Mark, >> >> While you are doing this, would it be possible to get aliases for some >> standard chmod settings? >> > > Why don't you open an RFE for that and I will take care of it, but its > not part of this case. Okay. Alan >> For example, currently, to set FullControl we have: >> >> chmod A=everyone@:rwxpdDaARWcCos:fd:allow /pool/fs >> >> For most people that probably requires use of the man page every time. >> It would be nice if we could do: >> >> chmod A=everyone@:$FullControl:fd:allow /pool/fs >> >> How about three aliases: $READ, $CHANGE, $FULLCONTROL >> >> $Read: read, execute, view properties/permissions >> (directory: list contents) >> Alias for: rxacR >> >> $Change: $Read, write, delete, modify properties/permissions >> (directory: add files/sub-directories) >> Alias for: rwxpdDaARWcC >> >> $FullControl: $Change, write-owner >> Alias for: rwxpdDaARWcCos >> >> I'm not hung up on the doller ($) prefix or the names but it would >> be good to have something to make this easier than it is now. >> >> Alan > From kmcdonald@egenera.com Tue Apr 1 14:00:55 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m31L0s7t028416 for ; Tue, 1 Apr 2008 14:00:55 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m31L0W8v008610; Wed, 2 Apr 2008 05:00:50 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JYN00I1ZZPDX300@nwk-avmta-1.sfbay.Sun.COM>; Tue, 01 Apr 2008 14:00:49 -0700 (PDT) Received: from sca-ea-mail-2.sun.com ([192.18.43.25]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JYN001SCZPAY9C0@nwk-avmta-1.sfbay.Sun.COM>; Tue, 01 Apr 2008 14:00:46 -0700 (PDT) Received: from relay11i.sun.com (ip121.net129179-4.block1.us.syntegra.com [129.179.4.121]) by sca-ea-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m31L0knQ025602; Tue, 01 Apr 2008 21:00:46 +0000 (GMT) Received: from mmp12es.sun.com ([160.41.209.22] [160.41.209.22]) by relay11i.sun.com with ESMTP id BT-MMP-253394; Tue, 01 Apr 2008 21:00:46 +0000 (Z) Received: from relay12i.sun.com (relay12i.sun.com [129.179.4.122]) by mmp12es.sun.com with ESMTP id BT-MMP-1830550; Tue, 01 Apr 2008 21:00:45 +0000 (Z) Received: from webaccess.egenera.com ([63.139.209.15] [63.139.209.15]) by relay1i.sun.com with ESMTP id BT-MMP-3261937; Tue, 01 Apr 2008 21:00:45 +0000 (Z) Received: from [172.23.2.108] ([172.23.2.108]) by webaccess.egenera.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.3959); Tue, 01 Apr 2008 17:01:00 -0400 Date: Tue, 01 Apr 2008 17:01:07 -0400 From: Kyle McDonald Subject: Re: New ZFS "passthrough" ACL inheritance rules [PSARC/2008/231 FastTrack timeout 04/08/2008] In-reply-to: <200804011751.m31HpU09009376@spartan.eng.sun.com> To: Don Cragun Cc: Mark.Shellenbaum@sun.com, zfs-team@sun.com, PSARC-ext@sun.com, timh@spidey.central.sun.com Message-id: <47F2A293.1060001@Egenera.COM> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 X-Brightmail-Tracker: AAAAAA== X-Antispam: No, score=-2.6/5.0, scanned in 0.047sec at (localhost [127.0.0.1]) by smf-spamd v1.3.1 - http://smfs.sf.net/ References: <200804011751.m31HpU09009376@spartan.eng.sun.com> User-Agent: Thunderbird 2.0.0.12 (Windows/20080213) X-OriginalArrivalTime: 01 Apr 2008 21:01:00.0254 (UTC) FILETIME=[7D148FE0:01C8943B] Status: RO Content-Length: 774 Don Cragun wrote: > > I believe that the default should be POSIX compliant. Let > administrators specify options if they want non-standard behavior. > > ... > ACLs are not in POSIX. (POSIX does, however, specify two classes of > extended access control mechanisms [known as "additional file access > control mechanisms" and "alternate file access control mechanisms"] and > specifies interactions between chmod() and these classes of file access > control mechanisms. ACLs can be added as additional and/or alternate > file access control mechanism as long as the interactions follow the > standards.) > > I'm confused. How is that the current default behavior is required in order to be POSIX compliant if POSIX doesn't actually standardize ACLs? -Kyle From Mark.Shellenbaum@sun.com Tue Apr 1 14:08:47 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m31L8kAx029090 for ; Tue, 1 Apr 2008 14:08:47 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m31L8WRu011962; Wed, 2 Apr 2008 05:08:45 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JYO00J0C02JLG00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 01 Apr 2008 14:08:43 -0700 (PDT) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JYO0018K02JYAE0@nwk-avmta-1.sfbay.Sun.COM>; Tue, 01 Apr 2008 14:08:43 -0700 (PDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m31L8hBL001184; Tue, 01 Apr 2008 21:08:43 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JYN00E01YJERA00@mail-amer.sun.com> (original mail from Mark.Shellenbaum@Sun.COM); Tue, 01 Apr 2008 15:08:43 -0600 (MDT) Received: from [172.20.25.34] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JYO0077Y02BLMB0@mail-amer.sun.com>; Tue, 01 Apr 2008 15:08:36 -0600 (MDT) Date: Tue, 01 Apr 2008 15:07:53 -0600 From: Mark Shellenbaum Subject: Re: New ZFS "passthrough" ACL inheritance rules [PSARC/2008/231 FastTrack timeout 04/08/2008] In-reply-to: <47F2A293.1060001@Egenera.COM> Sender: Mark.Shellenbaum@sun.com To: Kyle McDonald Cc: zfs-team@sun.com, PSARC-ext@sun.com Message-id: <47F2A429.1060203@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200804011751.m31HpU09009376@spartan.eng.sun.com> <47F2A293.1060001@Egenera.COM> User-Agent: Thunderbird 2.0.0.6 (X11/20071203) Status: RO Content-Length: 1258 Kyle McDonald wrote: > Don Cragun wrote: >> >> I believe that the default should be POSIX compliant. Let >> administrators specify options if they want non-standard behavior. >> >> > ... >> ACLs are not in POSIX. (POSIX does, however, specify two classes of >> extended access control mechanisms [known as "additional file access >> control mechanisms" and "alternate file access control mechanisms"] and >> specifies interactions between chmod() and these classes of file access >> control mechanisms. ACLs can be added as additional and/or alternate >> file access control mechanism as long as the interactions follow the >> standards.) >> >> > I'm confused. How is that the current default behavior is required in > order to be POSIX compliant if POSIX doesn't actually standardize ACLs? > > -Kyle > Because the applications requested file creation mode must be honored. The default behavior today will disable inherited ACEs that affect the mode in order to set the mode of the file as requested by the application. The default behavior isn't being changed. The change is to allow "passthrough" to ignore the applications requested mode and instead use the mode as determined by inherited ACEs that affect the mode. -Mark From kmcdonald@egenera.com Tue Apr 1 14:13:38 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m31LDcB3029638 for ; Tue, 1 Apr 2008 14:13:38 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m31LDb7p056782; Tue, 1 Apr 2008 15:13:38 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JYO00K330AP2H00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 01 Apr 2008 14:13:37 -0700 (PDT) Received: from sca-ea-mail-1.sun.com ([192.18.43.24]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JYO001880APY9E0@nwk-avmta-1.sfbay.Sun.COM>; Tue, 01 Apr 2008 14:13:37 -0700 (PDT) Received: from relay21.sun.com (ip192-12-251-24.block6.us.syntegra.com [192.12.251.24]) by sca-ea-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m31KqqPB018999; Tue, 01 Apr 2008 21:13:36 +0000 (GMT) Received: from mms24es.sun.com ([150.143.232.74] [150.143.232.74]) by relay21i.sun.com with ESMTP id BT-MMP-1077490; Tue, 01 Apr 2008 21:13:36 +0000 (Z) Received: from relay21.sun.com (relay21.sun.com [192.12.251.24]) by mms24es.sun.com with ESMTP id BT-MMP-3889420; Tue, 01 Apr 2008 21:13:36 +0000 (Z) Received: from webaccess.egenera.com ([63.139.209.15] [63.139.209.15]) by relay21i.sun.com with ESMTP id BT-MMP-11839052; Tue, 01 Apr 2008 21:13:36 +0000 (Z) Received: from [172.23.2.108] ([172.23.2.108]) by webaccess.egenera.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.3959); Tue, 01 Apr 2008 17:13:30 -0400 Date: Tue, 01 Apr 2008 17:13:37 -0400 From: Kyle McDonald Subject: Re: New ZFS "passthrough" ACL inheritance rules [PSARC/2008/231 FastTrack timeout 04/08/2008] In-reply-to: <47F2A429.1060203@Sun.COM> To: Mark Shellenbaum Cc: zfs-team@sun.com, PSARC-ext@sun.com Message-id: <47F2A581.5050100@Egenera.COM> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 X-Brightmail-Tracker: AAAAAA== X-Antispam: No, score=-2.6/5.0, scanned in 0.059sec at (localhost [127.0.0.1]) by smf-spamd v1.3.1 - http://smfs.sf.net/ References: <200804011751.m31HpU09009376@spartan.eng.sun.com> <47F2A293.1060001@Egenera.COM> <47F2A429.1060203@Sun.COM> User-Agent: Thunderbird 2.0.0.12 (Windows/20080213) X-OriginalArrivalTime: 01 Apr 2008 21:13:30.0218 (UTC) FILETIME=[3C17FCA0:01C8943D] Status: RO Content-Length: 1350 Mark Shellenbaum wrote: > Kyle McDonald wrote: >> Don Cragun wrote: >>> >>> I believe that the default should be POSIX compliant. Let >>> administrators specify options if they want non-standard behavior. >>> >>> >> ... >>> ACLs are not in POSIX. (POSIX does, however, specify two classes of >>> extended access control mechanisms [known as "additional file access >>> control mechanisms" and "alternate file access control mechanisms"] and >>> specifies interactions between chmod() and these classes of file access >>> control mechanisms. ACLs can be added as additional and/or alternate >>> file access control mechanism as long as the interactions follow the >>> standards.) >>> >>> >> I'm confused. How is that the current default behavior is required in >> order to be POSIX compliant if POSIX doesn't actually standardize ACLs? >> >> -Kyle >> > > Because the applications requested file creation mode must be honored. > The default behavior today will disable inherited ACEs that affect > the mode in order to set the mode of the file as requested by the > application. > > The default behavior isn't being changed. The change is to allow > "passthrough" to ignore the applications requested mode and instead > use the mode as determined by inherited ACEs that affect the mode. > Ahh. I see. Cool! -Kyle > -Mark From Darren.Moffat@sun.com Wed Apr 2 04:19:33 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m32BJWXW023929 for ; Wed, 2 Apr 2008 04:19:33 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m32BJDOo001272; Wed, 2 Apr 2008 12:19:30 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JYP00L153GFJM00@brm-avmta-1.central.sun.com>; Wed, 02 Apr 2008 05:19:27 -0600 (MDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JYP00IOR3GD4F30@brm-avmta-1.central.sun.com>; Wed, 02 Apr 2008 05:19:26 -0600 (MDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-2-fe1.eu.sun.com [192.18.6.10]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m32BJPJu026984; Wed, 02 Apr 2008 11:19:25 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JYP00I0132HKR00@fe-emea-09.sun.com> (original mail from Darren.Moffat@Sun.COM); Wed, 02 Apr 2008 12:19:25 +0100 (BST) Received: from [129.156.173.199] by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JYP005BQ3GCK800@fe-emea-09.sun.com>; Wed, 02 Apr 2008 12:19:24 +0100 (BST) Date: Wed, 02 Apr 2008 12:19:24 +0100 From: Darren J Moffat Subject: Re: New ZFS "passthrough" ACL inheritance rules [PSARC/2008/231 FastTrack timeout 04/08/2008] In-reply-to: <200804011751.m31HpU09009376@spartan.eng.sun.com> Sender: Darren.Moffat@sun.com To: Don Cragun Cc: Mark.Shellenbaum@sun.com, timh@spidey.central.sun.com, psarc-ext@sun.com, zfs-team@sun.com Message-id: <47F36BBC.8030700@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200804011751.m31HpU09009376@spartan.eng.sun.com> User-Agent: Thunderbird 2.0.0.9 (X11/20080225) Status: RO Content-Length: 922 Don Cragun wrote: >> Date: Tue, 01 Apr 2008 11:32:06 -0600 >> From: Mark Shellenbaum >> >> Darren J Moffat wrote: >>> Since this proposed behaviour is the default for ACLs on UFS why isn't >>> it the default for ZFS too ? >> I'm more than willing to make this the default behavior for ZFS, but it >> will affect POSIX compliance. If thats alright with everyone then I can >> change it to be the default. > > I believe that the default should be POSIX compliant. Let > administrators specify options if they want non-standard behavior. That all depends on what standards apply to a given deployment. Given the motivation for this is alignment with NFSv4 and CIFS standards it basically comes down to which is more important (and depending on who you ask you will get different answers). However it may not be wise to change the existing default behaviour anyway. -- Darren J Moffat From Darren.Moffat@sun.com Wed Apr 2 04:21:19 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m32BLJnP023943 for ; Wed, 2 Apr 2008 04:21:19 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m32BLGvo002550; Wed, 2 Apr 2008 05:21:18 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JYP00I0V3JG3L00@nwk-avmta-1.sfbay.Sun.COM>; Wed, 02 Apr 2008 04:21:16 -0700 (PDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JYP0038R3JEVH80@nwk-avmta-1.sfbay.Sun.COM>; Wed, 02 Apr 2008 04:21:15 -0700 (PDT) Received: from fe-emea-10.sun.com (gmp-eb-lb-2-fe2.eu.sun.com [192.18.6.11]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m32BLEOM027274; Wed, 02 Apr 2008 11:21:14 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JYP00F012HP1C00@fe-emea-10.sun.com> (original mail from Darren.Moffat@Sun.COM); Wed, 02 Apr 2008 12:21:14 +0100 (BST) Received: from [129.156.173.199] by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JYP007A23JCDK00@fe-emea-10.sun.com>; Wed, 02 Apr 2008 12:21:13 +0100 (BST) Date: Wed, 02 Apr 2008 12:21:12 +0100 From: Darren J Moffat Subject: Re: New ZFS "passthrough" ACL inheritance rules [PSARC/2008/231 FastTrack timeout 04/08/2008] In-reply-to: <47F282B6.3080208@Sun.COM> Sender: Darren.Moffat@sun.com To: Mark Shellenbaum Cc: psarc-ext@sun.com, zfs-team@sun.com Message-id: <47F36C28.1070804@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200804011716.m31HGV5E014235@spidey.central.sun.com> <47F26EAA.2040803@Sun.COM> <47F27196.4020509@Sun.COM> <47F27502.4050802@Sun.COM> <47F282B6.3080208@Sun.COM> User-Agent: Thunderbird 2.0.0.9 (X11/20080225) Status: RO Content-Length: 564 Mark Shellenbaum wrote: > Lets leave the default as it is, and have the new inheritance behavior > only take place under "passthrough". We can always change this later > with another fast track. Fine with me. >>> secure is what it was called in the original ZFS ARC case. I can >>> change it to "posix" if you want. My only concern would be if users >>> have become accustomed to its present value. >> >> What about an alias ? >> > > How about I rename "secure" to "restricted" and have an alias for "secure". That would be better. -- Darren J Moffat From Mark.Shellenbaum@sun.com Wed Apr 2 10:40:12 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m32HeCe6011414 for ; Wed, 2 Apr 2008 10:40:12 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m32HeBtf013764; Wed, 2 Apr 2008 10:40:11 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JYP0000BL2ZVB00@brm-avmta-1.central.sun.com>; Wed, 02 Apr 2008 11:40:11 -0600 (MDT) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JYP0005UL2YPN00@brm-avmta-1.central.sun.com>; Wed, 02 Apr 2008 11:40:10 -0600 (MDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m32HeAiw024027; Wed, 02 Apr 2008 17:40:10 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JYP00201JPMDI00@mail-amer.sun.com> (original mail from Mark.Shellenbaum@Sun.COM); Wed, 02 Apr 2008 11:40:10 -0600 (MDT) Received: from [172.20.25.34] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JYP00619L2VLW20@mail-amer.sun.com>; Wed, 02 Apr 2008 11:40:07 -0600 (MDT) Date: Wed, 02 Apr 2008 11:39:24 -0600 From: Mark Shellenbaum Subject: Re: New ZFS "passthrough" ACL inheritance rules [PSARC/2008/231 FastTrack timeout 04/08/2008] In-reply-to: <47F36C28.1070804@Sun.COM> Sender: Mark.Shellenbaum@sun.com To: psarc-ext@sun.com Cc: zfs-team@sun.com Message-id: <47F3C4CC.7000408@Sun.COM> MIME-version: 1.0 Content-type: multipart/mixed; boundary="Boundary_(ID_BqSkdsW1qlkwkHrSjzbamg)" X-PMX-Version: 5.4.1.325704 References: <200804011716.m31HGV5E014235@spidey.central.sun.com> <47F26EAA.2040803@Sun.COM> <47F27196.4020509@Sun.COM> <47F27502.4050802@Sun.COM> <47F282B6.3080208@Sun.COM> <47F36C28.1070804@Sun.COM> User-Agent: Thunderbird 2.0.0.6 (X11/20071203) Status: RO Content-Length: 9689 This is a multi-part message in MIME format. --Boundary_(ID_BqSkdsW1qlkwkHrSjzbamg) Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT Darren J Moffat wrote: > Mark Shellenbaum wrote: >> Lets leave the default as it is, and have the new inheritance behavior >> only take place under "passthrough". We can always change this later >> with another fast track. > > Fine with me. > >>>> secure is what it was called in the original ZFS ARC case. I can >>>> change it to "posix" if you want. My only concern would be if users >>>> have become accustomed to its present value. >>> >>> What about an alias ? >>> >> >> How about I rename "secure" to "restricted" and have an alias for >> "secure". > > That would be better. > Alan Wright opened the chmod alias RFE yesterday 6682943 Request for aliases to simplify setting ACL permissions I'm also attaching the final spec. The only change is mentioning that "secure" is being renamed to "restricted" and an alias for "secure" will be provided. -Mark --Boundary_(ID_BqSkdsW1qlkwkHrSjzbamg) Content-type: text/plain; name=aclinherit.fasttrack Content-transfer-encoding: 7BIT Content-disposition: inline; filename=aclinherit.fasttrack SUMMARY: This proposal is to change the ZFS ACL inheritance rules when the zfs acl property is set to "passthrough". PROBLEM: The ZFS ACL subsystem provides a property aclinherit to control how ACL inheritance is performed. The default value "secure" creates ACLs that conform to POSIX access control semantics. Many customers desire native NFSv4 ACL inheritance. They want to be able to "force" the mode that files and directories are created with. In the past they would use default ACLs on UFS to achieve this. The NFSv4 ACL model can also do this, but the current implementation in ZFS disables the ACEs owner@, group@, and everyone@ in order to set the mode of the file to the mode the application requested. This problem has been discussed countless times on zfs-discuss@opensolaris.org and has caused some customers to not upgrade to ZFS because they need a way to force the creation mode for files and directories. The current behavior differs from UFS and is unintuitive to users and the zfs community consesus is that we should have a mechanism for inheriting permissions for ACEs that affect the mode of the file. PROPOSED SOLUTION: The aclinherit property already supports a "passthrough" value which is intended to provide a more native NFSv4 ACL representation, but today only allows an application to inherit the control permissions "write_owner and or write_acl". If we expand the meaning of this property, such that if a parent directory contains inheritable owner@, group@ or everyone@ ACEs then those permissions will replace the requested mode for the file or directory create. This will be similar to UFS default ACLs, except that the administrator will have to enable the capability on the file system via the aclinherit property. See below for an example of this. This behavior only affects the initial create of the file or directory. Subsequent chmod(2) requests will apply the chmod(2) algorithm that ZFS already uses to enforce POSIX semantics. ZFS already has other features that take us out of POSIX control. For example, the nbmand property, system attributes, such as readonly, immutable, nounlink, appendonly, quarantined, and so on. The default value "secure" is being renamed to "restricted", but an alias for "secure" will be provided for existing users. INHERITANCE EXAMPLES: First lets look at a UFS default ACL example For this example I will using user "sys" and "dladm" that are both in the "sys" group. # su sys # mkdir ufs-test # chmod 775 ufs-test Now lets create a default ACL that will specify 0666 for new files. # setfacl -m d:u::rw-,d:g::rw-,d:o:rw-,d:m:rwx ufs-test # ls -dV ufs-test drwxrwxr-x+ 2 sys sys 512 Mar 19 13:21 ufs-test 0:user::rwx 1:group::rwx #effective:rwx 2:mask:rwx 3:other:r-x 4:Default:user::rw- 5:default:group::rw- 6:default:mask:rwx 7:default:other:rw- Now switch to user dladm and create a new file and set our umask to 066. # su dladm dladm$ umask 066 dladm$ cd ufs-test dladm$ touch a dladm$ ls -l a # ls -l x -rw-rw-rw- 1 dladm sys 0 Mar 19 11:36 a The next example is what most users typical try to do with ZFS to achieve the same sort of thing. # mkdir dir1 Now lets prepend 3 ACEs to the beginning of the ACL on the directory for owner@, group@ and everyone@ that are specified to inherit to newly created files and directories. # mkdir /sandbox/dir1 # chmod 755 /sandbox/dir1 # chmod A+owner@:rw:fd:allow,group@:rw:fd:allow, \ everyone@:rw:fd:allow dir1 # ls -dV dir1 drwxrwxrwx+ 2 root root 3 Mar 19 13:04 dir1 owner@:rw------------:fd-----:allow group@:rw------------:fd-----:allow everyone@:rw------------:fd-----:allow owner@:--------------:-------:deny owner@:rwxp---A-W-Co-:-------:allow group@:rw-p----------:-------:deny group@:--x-----------:-------:allow everyone@:rw-p---A-W-Co-:-------:deny everyone@:--x---a-R-c--s:-------:allow # cd dir1 # touch a Now lets look at the new file. # ls -V a -rw-r--r--+ 1 root root 0 Mar 19 13:04 a owner@:--------------:------I:allow group@:--------------:------I:allow everyone@:--------------:------I:allow owner@:--x-----------:-------:deny owner@:rw-p---A-W-Co-:-------:allow group@:-wxp----------:-------:deny group@:r-------------:-------:allow everyone@:-wxp---A-W-Co-:-------:deny everyone@:r-----a-R-c--s:-------:allow What happens here is that ZFS inherited the 3 ACEs (owner@, group@, everyone@) as indicated by the ------I, but then they were disabled in order to place POSIX semantics on the file and also to set the mode to 0644. The customer was expecting the file to be created with mode 0666. The remaining examples are with the proposed solution to allow inheriting mode bit permissions. # zfs create sandbox/testfs Now lets set the passthrough mode for aclinherit # zfs set aclinherit=passthrough sandbox/testfs # cd /sandbox/testfs # mkdir testdir Now lets set up an ACL on testdir to cause inheritance. This will create a 3 member ACL for newly created files. It will have one owner@, group@, and everyone@ entry. Newly created Directories will have 3 entries for @owner@, group@, and everyone@. Additionally, directories will have 6 other ACEs which are for propagating the ACEs to newly created directories and files. # chmod A+owner@:rwxpAWC:d:allow,owner@:rwpAWC:f, \ group@:x:d:allow,group@::f:allow,everyone@:x:d, \ everyone@::f:allow testdir First lets create a file. # cd testdir # touch file.1 # ls -V file.1 -rw-------+ 1 root root 0 Mar 18 10:49 file.1 owner@:rw-p---A-W-C--:------I:allow group@:--------------:------I:allow everyone@:--------------:------I:allow This created an ACL with just the three ACEs that were specified to be inherited to newly created files. Now lets create a directory. The inherited ACL will include both ACEs that control access to this directory as well as ACEs for future propagation to children of the newly created directory. # mkdir dir.1 # ls -dV dir.1 drwx--x--x+ 2 root root 2 Mar 18 10:51 dir.1 owner@:rwxp---A-W-C--:-di---I:allow owner@:rwxp---A-W-C--:------I:allow owner@:rw-p---A-W-C--:f-i---I:allow group@:--x-----------:-di---I:allow group@:--x-----------:------I:allow group@:--------------:f-i---I:allow everyone@:--x-----------:-di---I:allow everyone@:--x-----------:------I:allow everyone@:--------------:f-i---I:allow The entries with -di-- and f-i--- are for propagating and are not considered during access control. Now lets move to another directory where inherited ACEs aren't present and the file will be created with a trivial ACL. # cd /sandbox/testfs # touch file.1 # ls -V file.1 -rw-r--r-- 1 root root 0 Mar 18 10:53 file.1 owner@:--x-----------:-------:deny owner@:rw-p---A-W-Co-:-------:allow group@:-wxp----------:-------:deny group@:r-------------:-------:allow everyone@:-wxp---A-W-Co-:-------:deny everyone@:r-----a-R-c--s:-------:allow RELEASE BINDING Patch/Micro - Change will need to be backported to Solaris 10. No change to existing ACL interface stability levels. MANPAGE DIFFS 539c539 < aclinherit=discard | noallow | restricted | passthrough --- > aclinherit=discard | noallow | secure | passthrough 547c547 < "restricted" (the default) removes the "write_acl" and --- > "secure" (the default) removes the "write_acl" and 554,558d553 < When property value is set to "passthrough" files will be < created with a mode determined by the inheritable ACEs. < If no inheritable ACEs exist that affect the mode then < the mode will be set in accordance to the requested mode < from the application. 560d554 < 2295c2289 < pool/home/bob aclinherit restricted default --- > pool/home/bob aclinherit secure default --Boundary_(ID_BqSkdsW1qlkwkHrSjzbamg)-- From Timothy.Haley@sun.com Wed Apr 2 12:03:07 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m32J37wZ014622 for ; Wed, 2 Apr 2008 12:03:07 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m32J2n4v004393; Wed, 2 Apr 2008 20:03:06 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JYP0060JOX3L100@brm-avmta-1.central.sun.com>; Wed, 02 Apr 2008 13:03:03 -0600 (MDT) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JYP000Q6OX1PQ70@brm-avmta-1.central.sun.com>; Wed, 02 Apr 2008 13:03:01 -0600 (MDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m32J314L009862; Wed, 02 Apr 2008 19:03:01 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JYP00D01OCK2600@mail-amer.sun.com> (original mail from Timothy.Haley@Sun.COM); Wed, 02 Apr 2008 13:03:01 -0600 (MDT) Received: from [172.20.25.27] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JYP00J0UOWTSBB0@mail-amer.sun.com>; Wed, 02 Apr 2008 13:02:53 -0600 (MDT) Date: Wed, 02 Apr 2008 13:02:52 -0600 From: Tim Haley Subject: Re: New ZFS "passthrough" ACL inheritance rules [PSARC/2008/231 FastTrack timeout 04/08/2008] In-reply-to: <200804011716.m31HGV5E014235@spidey.central.sun.com> Sender: Timothy.Haley@sun.com To: PSARC-ext@sun.com Cc: zfs-team@sun.com Message-id: <47F3D85C.10807@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200804011716.m31HGV5E014235@spidey.central.sun.com> User-Agent: Thunderbird 2.0.0.12 (X11/20080310) Status: RO Content-Length: 60 This case was approved during today's PSARC meeting. -tim