POSIX ACL

[jiefenghuang]

Why is this needed:
support POSIX ACL

• link: confusion over ACL: supported already? #2559
• link: Can not support setfacl, error message: Operation not supported #512

---

What would you like to be added:

basic ACL functionality

reference

• torvalds/linux@60bcc88

what to be added

• add enable-acl flag (also implies default_permissions) to check access acl
  • TODO: For SDK users, user-space ACL checking is required.
• update acl: in setxattr
• default acl: inheritance of default ACLs when new filesystem nodes are
  created
• sync between file mode and acl: setattr and setxattr

compatibility

(irreversible) global meta format flag

why is this needed

• Allowing client mount without ACL will disrupt the synchronization of file mode and ACL.
• Disabling ACL requires a time-consuming conversion of the group class part of file modes for all files (from mask to owner group), so currently, disabling ACL is not supported.

what to be added

• add enable-acl flag to meta format
• set fuse.MountOptions
  • DisableXAttrs = !(enable-acl || enable-xattr)
  • EnableAcl = enable-acl
  • IgnoreSecurityLabels = !enable-acl

client and meta format version matching

why is this needed

If an older version client mounts a newer version of meta format, it will disrupt the synchronization of mode and ACL.

what to be added

Setting the matching versions for the client and meta.

cases

1. old client <-> new fs without enable-acl, supported
2. old client <-> new fs with enable-acl, not supported

• logic of "setattr, getattr, mknod" is not compatible
• we need to change format's MinClientVersion when config "enable-acl" to true.

4. new client <-> old fs, supported.

• two new fields will be added to attr. SQL will sync the table, and KV storage is in []byte format, will ensuring compatibility in encode and decode.
• also support "enable-acl" for old fs.

storage

what to be added

• Implement an ACL value sharing mechanism
• We assume that the number of ACLs should be very limited. Having too many ACLs may indicate issues in the way they are being used, and it may be necessary to optimize them through group settings.

1. limited acls (ex. 65536)

• Adding two uint32 variables in the attr to store the index of access ACL and default ACL, enabling quick determination of whether a file/dir has ACL set.
• ACL value is stored in meta with the key 'acl_[index]'.
  • index will keep increasing
  • unused index will not be removed.
• Cache all ACL value in memory

test

• posix

[jiefenghuang]

acl support #4443
acl dump #4490