Mapping NFS4 ACL to POSIX mode

[slowfranklin]

Hi folks!

I have a question related to mapping NFS4 ACL special entries to POSIX mode.

Consider the following case of a file with POSIX mode 0421:

samba@freebsd:~/acltests $ touch file
samba@freebsd:~/acltests $ chmod 0421 file
samba@freebsd:~/acltests $ ls -l file
-r---w---x  1 samba samba 0 Jan 10 13:07 file
samba@freebsd:~/acltests $ getfacl file
# file: file
# owner: samba
# group: samba
            owner@:-wxp----------:-------:deny
            group@:--x-----------:-------:deny
            owner@:r-----aARWcCos:-------:allow
            group@:-w-p--a-R-c--s:-------:allow
         everyone@:--x---a-R-c--s:-------:allow
samba@freebsd:~/acltests $ echo foo > file2
-sh: cannot create file2: Permission denied

So far, so good. As required for effective POSIX mode permission semantics two deny ACEs are added to the NFS4 ACL.

Now what happens to the mapped POSIX owner permissions if we remove both deny ACEs:

samba@freebsd:~/acltests $ setfacl -x 0 file
samba@freebsd:~/acltests $ setfacl -x 0 file
samba@freebsd:~/acltests $ getfacl file
# file: file
# owner: samba
# group: samba
            owner@:r-----aARWcCos:-------:allow
            group@:-w-p--a-R-c--s:-------:allow
         everyone@:--x---a-R-c--s:-------:allow
samba@freebsd:~/acltests $ ls -l file
-r-x-wx--x+ 1 samba samba 0 Jan 10 13:07 file

Apparently, as expected, the "x" everyone permission is correctly added to the mapped owner permissions as, as that matches effective permissions of the ACL.

However, the same mapping is not done for group "w" access, so even though the effective permissions allow write access:

samba@freebsd:~/acltests $ echo foo > file
samba@freebsd:~/acltests $ cat file
foo

...according to the POSIX mode of the owner which is reported "rx" the user should be denied write access.

Any experts on the permission mapping code around? :) Thanks!