openzfs / zfs

OpenZFS on Linux and FreeBSD
https://openzfs.github.io/openzfs-docs
Other
10.48k stars 1.74k forks source link

.zfs and .zfs/snapshot directories do not support xattrs #7253

Open secabeen opened 6 years ago

secabeen commented 6 years ago

System information

Type Version/Name
Distribution Name CentOS
Distribution Version 7.4
Linux Kernel 3.10.0-693.17.1.el7.x86_64
Architecture amd64
ZFS Version zfs-0.7.5-1.el7_4.x86_64
SPL Version spl-0.7.5-1.el7_4.x86_64

Describe the problem you're observing

The .zfs and .zfs/snapshot directories do not support extended attributes. Any attempts to access them return "Operation not supported". This breaks Samba access to these directories when NTFS ACLs are used (it tries to check if the user has "List" permissions on these directories before granting access). Samba is considering programming around this issue, but I thought it might make more sense to do it in ZFS: https://bugzilla.samba.org/show_bug.cgi?id=13175

Once you are in the snapshot itself, getfattr() returns the xattrs from the snapshot, so that's fine, it's just the .zfs and .zfs/snapshot directories that don't work.

Describe how to reproduce the problem

# getfattr -n security.NTACL .zfs/snapshot
.zfs/snapshot: security.NTACL: Operation not supported

Possible Solution

A possible solution would be to return the xattrs set on the filesystem mountpoint when getfattr() is called on .zfs or .zfs/snapshot for a filesystem.

fcicq commented 6 years ago

seems the same issue for freebsd & fixed https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=225793

secabeen commented 6 years ago

Yeah, they only handled POSIX mode, and didn't take it to xattr, but the idea is similar.

behlendorf commented 6 years ago

Adopting something like the FreeBSD solution where a trival ACL is dynamically generated based on the mode bits would be a pretty reasonable solution. And as suggested we'd also want to support the get and list xattr handlers in the same way, as for set I'd suggest registering one but have it return -EPERM to indicate the xattrs are read-only.

If someone has time to work on this that would be welcome. Otherwise I'm not sure when we'll get to it.