Skip to content

Commit

Permalink
Fix regression in POSIX mode behavior
Browse files Browse the repository at this point in the history
Commit 235a856 introduced a regression in evaluation of POSIX modes
that require group DENY entries in the internal ZFS ACL (for example 007).
When write_implies_delete_child is set, then ACE_WRITE_DATA is added
to `wanted_dirperms` in zfs_zaccess_delete.

Unfortunately, when zfs_zaccess_aces_check hits this particular DENY
ACE, zfs_groupmember() is checked to determine whether access should be
denied, and since zfs_groupmember() always returns B_TRUE on Linux and
so this check is failed, resulting ultimately in EPERM being returned.

Signed-off-by: Andrew Walker <awalker@ixsystems.com>
  • Loading branch information
anodos325 committed Mar 17, 2021
1 parent f5ada65 commit 1553eb7
Showing 1 changed file with 0 additions and 4 deletions.
4 changes: 0 additions & 4 deletions module/zfs/zfs_fuid.c
Original file line number Diff line number Diff line change
Expand Up @@ -728,7 +728,6 @@ zfs_fuid_info_free(zfs_fuid_info_t *fuidp)
boolean_t
zfs_groupmember(zfsvfs_t *zfsvfs, uint64_t id, cred_t *cr)
{
#ifdef HAVE_KSID
uid_t gid;

#ifdef illumos
Expand Down Expand Up @@ -773,9 +772,6 @@ zfs_groupmember(zfsvfs_t *zfsvfs, uint64_t id, cred_t *cr)
*/
gid = zfs_fuid_map_id(zfsvfs, id, cr, ZFS_GROUP);
return (groupmember(gid, cr));
#else
return (B_TRUE);
#endif
}

void
Expand Down

0 comments on commit 1553eb7

Please sign in to comment.