From owner-freebsd-bugs@FreeBSD.ORG Thu Jan 3 15:40:01 2013 Return-Path: Delivered-To: freebsd-bugs@smarthost.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.FreeBSD.org [8.8.178.115]) by hub.freebsd.org (Postfix) with ESMTP id 6ADE7FE7 for ; Thu, 3 Jan 2013 15:40:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:1900:2254:206c::16:87]) by mx1.freebsd.org (Postfix) with ESMTP id 527DDF56 for ; Thu, 3 Jan 2013 15:40:01 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.5/8.14.5) with ESMTP id r03Fe1Oh055859 for ; Thu, 3 Jan 2013 15:40:01 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.5/8.14.5/Submit) id r03Fe1vx055858; Thu, 3 Jan 2013 15:40:01 GMT (envelope-from gnats) Resent-Date: Thu, 3 Jan 2013 15:40:01 GMT Resent-Message-Id: <201301031540.r03Fe1vx055858@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Sandra Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id A26F4EEE for ; Thu, 3 Jan 2013 15:38:38 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from red.freebsd.org (red.freebsd.org [IPv6:2001:4f8:fff6::22]) by mx1.freebsd.org (Postfix) with ESMTP id 93790F47 for ; Thu, 3 Jan 2013 15:38:38 +0000 (UTC) Received: from red.freebsd.org (localhost [127.0.0.1]) by red.freebsd.org (8.14.5/8.14.5) with ESMTP id r03FccIO007034 for ; Thu, 3 Jan 2013 15:38:38 GMT (envelope-from nobody@red.freebsd.org) Received: (from nobody@localhost) by red.freebsd.org (8.14.5/8.14.5/Submit) id r03FccYc007033; Thu, 3 Jan 2013 15:38:38 GMT (envelope-from nobody) Message-Id: <201301031538.r03FccYc007033@red.freebsd.org> Date: Thu, 3 Jan 2013 15:38:38 GMT From: Sandra To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Subject: misc/174948: owner@ always have ZFS ACL full permissions. Should not be the case. X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Jan 2013 15:40:01 -0000 >Number: 174948 >Category: misc >Synopsis: owner@ always have ZFS ACL full permissions. Should not be the case. >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Thu Jan 03 15:40:01 UTC 2013 >Closed-Date: >Last-Modified: >Originator: Sandra >Release: 9 >Organization: >Environment: >Description: The Oracle ZFS specs says http://docs.oracle.com/cd/E19253-01/819-5461/ftyxi/index.html "The owner of a file is granted the write_acl permission unconditionally, even if the permission is explicitly denied." But it is not possible to restrict the owner in any way. The following is the output from the script in "How to repeat the problem", which shows that removing all ACL's on owner@ have no effect. p="/tank/project1" f="$p/test2" u="user1" rm -f $f setfacl -b $p setfacl -m group@::fd:allow $p || exit 1 setfacl -m everyone@::fd:allow $p || exit 1 setfacl -m owner@::fd:allow $p || exit 1 setfacl -m u:$u:rwx:fd:allow $p || exit 1 setfacl -m u:$u:aA:fd:deny $p || exit 1 getfacl $p # file: /tank/project1 # owner: root # group: wheel user:user1:------aA------:fd----:deny user:user1:rwx-----------:fd----:allow owner@:--------------:fd----:allow group@:--------------:fd----:allow everyone@:--------------:fd----:allow su -m $u -c "echo test > $f" setfacl -m u:$u::allow $f || exit 1 getfacl $f # file: /tank/project1/test2 # owner: user1 # group: wheel user:user1:------aA------:------:deny user:user1:--------------:------:allow owner@:--------------:------:allow group@:--------------:------:allow everyone@:--------------:------:allow su -m $u -c "touch -amct 191212121212 $f" ls -l $f ----------+ 1 user1 wheel 5 Dec 12 1912 /tank/project1/test2 su -m $u -c "cat $f" cat: /tank/project1/test2: Permission denied su -m $u -c "chmod 777 $f" ls -l $f -rwxrwxrwx+ 1 user1 wheel 5 Dec 12 1912 /tank/project1/test2 su -m $u -c "cat $f" test su -m $u -c "setfacl -m u:$u:full_set:allow $f" su -m $u -c "setfacl -x u:$u::deny $f" getfacl $f # file: /tank/project1/test2 # owner: user1 # group: wheel user:user1:rwxpDdaARWcCos:------:allow owner@:rwxp--aARWcCos:------:allow group@:rwxp--a-R-c--s:------:allow everyone@:rwxp--a-R-c--s:------:allow >How-To-Repeat: p="/tank/project1" f="$p/test2" u="user1" rm -f $f setfacl -b $p setfacl -m group@::fd:allow $p || exit 1 setfacl -m everyone@::fd:allow $p || exit 1 setfacl -m owner@::fd:allow $p || exit 1 setfacl -m u:$u:rwx:fd:allow $p || exit 1 setfacl -m u:$u:aA:fd:deny $p || exit 1 getfacl $p su -m $u -c "echo test > $f" setfacl -m u:$u::allow $f || exit 1 getfacl $f su -m $u -c "touch -amct 191212121212 $f" ls -l $f su -m $u -c "cat $f" su -m $u -c "chmod 777 $f" ls -l $f su -m $u -c "cat $f" su -m $u -c "setfacl -m u:$u:full_set:allow $f" su -m $u -c "setfacl -x u:$u::deny $f" getfacl $f >Fix: >Release-Note: >Audit-Trail: >Unformatted: