From 93196e8d3c2bd2b44d892689dbf603516c0f131d Mon Sep 17 00:00:00 2001 From: Andrew Walker Date: Tue, 16 Mar 2021 14:58:05 -0400 Subject: [PATCH] Fix regression in POSIX mode behavior Commit 235a85657 introduced a regression in evaluation of POSIX modes that require group DENY entries in the internal ZFS ACL. An example of such a POSX mode is 007. When write_implies_delete_child is set, then ACE_WRITE_DATA is added to `wanted_dirperms` in prior to calling zfs_zaccess_common(). This occurs is zfs_zaccess_delete(). Unfortunately, when zfs_zaccess_aces_check hits this particular DENY ACE, zfs_groupmember() is checked to determine whether access should be denied, and since zfs_groupmember() always returns B_TRUE on Linux and so this check is failed, resulting ultimately in EPERM being returned. Signed-off-by: Andrew Walker --- module/zfs/zfs_fuid.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/module/zfs/zfs_fuid.c b/module/zfs/zfs_fuid.c index 015dde4811e4..a90bf5feeea1 100644 --- a/module/zfs/zfs_fuid.c +++ b/module/zfs/zfs_fuid.c @@ -728,7 +728,6 @@ zfs_fuid_info_free(zfs_fuid_info_t *fuidp) boolean_t zfs_groupmember(zfsvfs_t *zfsvfs, uint64_t id, cred_t *cr) { -#ifdef HAVE_KSID uid_t gid; #ifdef illumos @@ -773,9 +772,6 @@ zfs_groupmember(zfsvfs_t *zfsvfs, uint64_t id, cred_t *cr) */ gid = zfs_fuid_map_id(zfsvfs, id, cr, ZFS_GROUP); return (groupmember(gid, cr)); -#else - return (B_TRUE); -#endif } void