Re: [PATCH] fuse: Ensure posix acls are translated outside of init_user_ns

From: Seth Forshee
Date: Tue May 08 2018 - 09:37:59 EST


On Fri, May 04, 2018 at 11:47:28AM -0500, Eric W. Biederman wrote:
>
> Ensure the translation happens by failing to read or write
> posix acls when the filesystem has not indicated it supports
> posix acls.
>
> This ensures that modern cached posix acl support is available
> and used when dealing with posix acls. This is important
> because only that path has the code to convernt the uids and
> gids in posix acls into the user namespace of a fuse filesystem.
>
> Signed-off-by: "Eric W. Biederman" <ebiederm@xxxxxxxxxxxx>
> ---
>
> Miklos after several attempts to handle this better last cycle. I
> figure we should go with the stupid version for now. I think I know
> how to do better but I don't want that to gate forward progress on
> fully unprivileged fuse mounts. Especially as this is the last known
> issue to deal with.

This seems reasonable as a short-term measure.

Acked-by: Seth Forshee <seth.forshee@xxxxxxxxxxxxx>