Closed zhoucheng361 closed 7 months ago
Reproduce by bash: cat acl.sh
#!/bin/bash -e
set -x
dir=$1
[[ -z "$dir" ]] && echo "usage: acl.sh /tmp/jfs/fsrand"
rm $dir -rf
mkdir $dir
chmod 6333 $dir
sudo -u user1 setfacl --remove-default $dir
umask 557
mkdir $dir/uopt -m 2142
umask 022
chown user1 $dir/uopt
usermod -g group4 -G group2 user1
sudo -u user1 setfacl --mask --no-mask -m u::-,g:group2:wrx,o::x $dir/uopt
getfacl $dir/uopt
Log:
root@bench-01:~/juicefs# ./acl.sh /tmp/jfs/fsrand
+ dir=/tmp/jfs/fsrand
+ [[ -z /tmp/jfs/fsrand ]]
+ rm /tmp/jfs/fsrand -rf
+ mkdir /tmp/jfs/fsrand
+ chmod 6333 /tmp/jfs/fsrand
+ sudo -u user1 setfacl --remove-default /tmp/jfs/fsrand
+ umask 557
+ mkdir /tmp/jfs/fsrand/uopt -m 2142
+ umask 022
+ chown user1 /tmp/jfs/fsrand/uopt
+ usermod -g group4 -G group2 user1
+ sudo -u user1 setfacl --mask --no-mask -m u::-,g:group2:wrx,o::x /tmp/jfs/fsrand/uopt
+ getfacl /tmp/jfs/fsrand/uopt
getfacl: Removing leading '/' from absolute path names
# file: tmp/jfs/fsrand/uopt
# owner: user1
# group: root
# flags: -s-
user::---
group::r--
group:group2:rwx #effective:r--
mask::r--
other::--x
root@bench-01:~/juicefs# ./acl.sh /tmp/fsrand
+ dir=/tmp/fsrand
+ [[ -z /tmp/fsrand ]]
+ rm /tmp/fsrand -rf
+ mkdir /tmp/fsrand
+ chmod 6333 /tmp/fsrand
+ sudo -u user1 setfacl --remove-default /tmp/fsrand
+ umask 557
+ mkdir /tmp/fsrand/uopt -m 2142
+ umask 022
+ chown user1 /tmp/fsrand/uopt
+ usermod -g group4 -G group2 user1
+ sudo -u user1 setfacl --mask --no-mask -m u::-,g:group2:wrx,o::x /tmp/fsrand/uopt
+ getfacl /tmp/fsrand/uopt
getfacl: Removing leading '/' from absolute path names
# file: tmp/fsrand/uopt
# owner: user1
# group: root
user::---
group::r--
group:group2:rwx #effective:r--
mask::r--
other::--x
we need FUSE_SETXATTR_EXT support to check if the extra_flag in SetXattr request is set. (clear sgid if set)
/*
* Fuse daemons without FUSE_POSIX_ACL never changed the passed
* through POSIX ACLs. Such daemons don't expect setgid bits to
* be stripped.
*/
if (fc->posix_acl &&
!vfsgid_in_group_p(i_gid_into_vfsgid(&nop_mnt_idmap, inode)) &&
!capable_wrt_inode_uidgid(&nop_mnt_idmap, inode, CAP_FSETID))
extra_flags |= FUSE_SETXATTR_ACL_KILL_SGID;
linux patch about clear sgid https://lore.kernel.org/linux-fsdevel/20210319195547.427371-1-vgoyal@redhat.com/
What happened: How to reproduce:
Logs:
What you expected to happen:
How to reproduce it (as minimally and precisely as possible):
Anything else we need to know?
Environment:
juicefs --version
) or Hadoop Java SDK version:cat /etc/os-release
):uname -a
):