From Tim.Haley@sun.com Thu Jan 7 22:09:02 2010 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id o08692aL027528 for ; Thu, 7 Jan 2010 22:09:02 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id o08691vQ027908; Thu, 7 Jan 2010 22:09:02 -0800 (PST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KVW00001ZR1D800@brm-avmta-1.central.sun.com>; Thu, 07 Jan 2010 23:09:01 -0700 (MST) Received: from dm-central-01.central.sun.com ([129.147.62.4]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KVW007H9ZR1P4C0@brm-avmta-1.central.sun.com>; Thu, 07 Jan 2010 23:09:01 -0700 (MST) Received: from spidey.local (spidey.Central.Sun.COM [172.20.25.27]) by dm-central-01.central.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id o08691mB049945; Thu, 07 Jan 2010 23:09:01 -0700 (MST) Received: from spidey.local (localhost [127.0.0.1]) by spidey.local (8.14.3+Sun/8.14.3) with ESMTP id o085s1vO001725; Thu, 07 Jan 2010 22:54:01 -0700 (MST) Received: (from timh@localhost) by spidey.local (8.14.3+Sun/8.14.3/Submit) id o085s1Xc001724; Thu, 07 Jan 2010 22:54:01 -0700 (MST) Date: Thu, 07 Jan 2010 22:54:01 -0700 (MST) From: Tim Haley Subject: Modified ZFS passthrough-x ACL inheritance [PSARC/2010/009 FastTrack timeout 01/14/2010] To: PSARC-ext@sun.com Cc: henson@acm.org, zfs-team@sun.com Message-id: <201001080554.o085s1Xc001724@spidey.local> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 4075 I am sponsoring the following fast-track for Paul Henson. This case makes a minor modification to the behavior originally introduced by PSARC/2008/659. That case introduced the 'passthrough-x' property value for the zfs aclinherit property. Requested binding is patch/micro. Timeout is 1/14/2010. Template Version: @(#)sac_nextcase 1.68 02/23/09 SMI This information is Copyright 2010 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: Modified ZFS passthrough-x ACL inheritance 1.2. Name of Document Author/Supplier: Author: Paul Henson 1.3 Date of This Document: 07 January, 2010 4. Technical Description SUMMARY: This proposal updates the ZFS aclinherit property value "passthrough-x" to apply to all ACEs rather than just the special ACEs. PROBLEM: The changes introduced by: PSARC/2008/659 New ZFS "passthrough-x" ACL inheritance rules allow an administrator to optionally include the execute bit from the file creation mode into the inherited ACL, which provides the ability to have a single set of inherited ACEs result in the correct permissions for both a data file and an executable file. However, the current "passthrough-x" implementation only performs the optional inheritance on the three special ACEs, any other inherited ACEs will unconditionally inherit the execute permission, resulting in a data file with unnecessary and unwanted execute permissions. PROPOSED SOLUTION: Update the aclinherit "passthrough-x" property value such that the ACE_EXECUTE permission will be optionally inherited for all ACEs, not just the special ACEs. EXAMPLES: First, look at an example of current behavior. The following ACL exists on a directory. $ ls -dV testdir owner@:rwxpdDaARWcC--:-di---:allow owner@:rwxpdDaARWcC--:------:allow group@:--x---a-R-c---:-di---:allow group@:--x---a-R-c---:------:allow everyone@:--x---a-R-c---:-di---:allow everyone@:--x---a-R-c---:------:allow owner@:rwxpdDaARWcC--:f-i---:allow group@:--------------:f-i---:allow everyone@:--------------:f-i---:allow user:henson:rwxpdDaARWcC--:f-i---:allow group:cpp:rwxpdDaARWcC--:f-i---:allow When a file is created, it has this ACL: $ touch file $ ls -V file -rw-------+ 1 root sys 0 Dec 22 13:04 file owner@:rw-pdDaARWcC--:------:allow group@:--------------:------:allow everyone@:--------------:------:allow user:henson:rwxpdDaARWcC--:------:allow group:cpp:rwxpdDaARWcC--:------:allow While the special owner@ ACE did not inherit the ACE_EXECUTE permission, the non-special ACEs did, resulting in incorrect execute permissions on the data file. With the proposed new "passthrough-x" behavior, the same set of inherited ACEs would result in the following permissions being set on the data file: -rw-------+ 1 root sys 0 Dec 22 13:04 file owner@:rw-pdDaARWcC--:------:allow group@:--------------:------:allow everyone@:--------------:------:allow user:henson:rw-pdDaARWcC--:------:allow group:cpp:rw-pdDaARWcC--:------:allow This change will allow consistancy in the inheritance of ACE_EXECUTE permissions for all ACL entries. MANPAGE DIFFS $ diff zfs.txt.new zfs.txt 677,679c677,679 < passthrough, except that all ACEs inherit the execute < permission only if the file creation mode also requests < the execute bit. --- > passthrough, except that the owner@, group@, and every- > one@ ACEs inherit the execute permission only if the > file creation mode also requests the execute bit. 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: ON 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open From Darren.Moffat@sun.com Fri Jan 8 02:12:52 2010 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id o08ACqK3015629 for ; Fri, 8 Jan 2010 02:12:52 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.4) with ESMTP id o08ACpqM063859; Fri, 8 Jan 2010 03:12:51 -0700 (MST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KVX00365B1FBT00@brm-avmta-1.central.sun.com>; Fri, 08 Jan 2010 03:12:51 -0700 (MST) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KVX002ACB1CUT00@brm-avmta-1.central.sun.com>; Fri, 08 Jan 2010 03:12:49 -0700 (MST) Received: from fe-emea-10.sun.com (gmp-eb-lb-1-fe1.eu.sun.com [192.18.6.7] (may be forged)) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id o08ACkep009233; Fri, 08 Jan 2010 10:12:48 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KVX00H00AF8NU00@fe-emea-10.sun.com>; Fri, 08 Jan 2010 10:12:24 +0000 (GMT) Received: from [192.168.1.105] (cpc2-rdng20-2-0-cust917.15-3.cable.virginmedia.com [86.28.167.150]) by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KVX00LP9B0LBR80@fe-emea-10.sun.com>; Fri, 08 Jan 2010 10:12:21 +0000 (GMT) Date: Fri, 08 Jan 2010 10:12:20 +0000 From: Darren J Moffat Subject: Re: Modified ZFS passthrough-x ACL inheritance [PSARC/2010/009 FastTrack timeout 01/14/2010] In-reply-to: <201001080554.o085s1Xc001724@spidey.local> Sender: Darren.Moffat@sun.com To: Tim Haley Cc: PSARC-ext@sun.com, henson@acm.org, zfs-team@sun.com Message-id: <4B470504.80600@Sun.COM> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <201001080554.o085s1Xc001724@spidey.local> User-Agent: Thunderbird 2.0.0.23 (X11/20091124) Status: RO Content-Length: 516 Tim Haley wrote: > I am sponsoring the following fast-track for Paul Henson. This case > makes a minor modification to the behavior originally introduced > by PSARC/2008/659. That case introduced the 'passthrough-x' property > value for the zfs aclinherit property. Requested binding is > patch/micro. Timeout is 1/14/2010. Even though this is a change in behaviour I don't see any problems with this since it is an edge case feature that was introduced for the submitter. So +1 from me. -- Darren J Moffat From tim.haley@sun.com Fri Jan 15 08:20:23 2010 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id o0FGKMoj010461 for ; Fri, 15 Jan 2010 08:20:22 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.4) with ESMTP id o0FGKL05010553; Fri, 15 Jan 2010 09:20:22 -0700 (MST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KWA00711QPXWA00@nwk-avmta-1.sfbay.Sun.COM>; Fri, 15 Jan 2010 08:20:21 -0800 (PST) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KWA000VSQPVLE70@nwk-avmta-1.sfbay.Sun.COM>; Fri, 15 Jan 2010 08:20:19 -0800 (PST) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id o0FGKJY0003781; Fri, 15 Jan 2010 16:20:19 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KWA00I00QKRR200@mail-amer.sun.com>; Fri, 15 Jan 2010 09:20:19 -0700 (MST) Received: from [172.20.25.27] ([unknown] [172.20.25.27]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KWA00F3IQPMFD20@mail-amer.sun.com>; Fri, 15 Jan 2010 09:20:16 -0700 (MST) Date: Fri, 15 Jan 2010 09:20:10 -0700 From: timh Subject: Re: Modified ZFS passthrough-x ACL inheritance [PSARC/2010/009 FastTrack timeout 01/14/2010] In-reply-to: <201001080554.o085s1Xc001724@spidey.local> Sender: Timothy.Haley@sun.com To: PSARC-ext@sun.com Cc: zfs-team@sun.com, henson@acm.org Message-id: <4B5095BA.4050902@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <201001080554.o085s1Xc001724@spidey.local> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.5) Gecko/20091207 Lightning/1.0pre Thunderbird/3.0 Status: RO Content-Length: 127 The fast-track period has timed out and the proposal received a +1 from a member, so I'm marking the case as approved. -tim