Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

mount: acl implementation is probably wrong #3738

Closed
AkihiroSuda opened this issue Feb 10, 2023 · 1 comment · Fixed by #3739
Closed

mount: acl implementation is probably wrong #3738

AkihiroSuda opened this issue Feb 10, 2023 · 1 comment · Fixed by #3739
Labels

Comments

@AkihiroSuda
Copy link
Member

"acl": {false, unix.MS_POSIXACL},

Currently, runc maps the acl mount option strings to MS_POSIXACL, but this option doesn't seem used by util-linux: https://github.com/util-linux/util-linux/search?q=MS_POSIXACL

Surprisingly, MS_POSIXACL isn't even referred by the kernel, except in security/apparmor/mount.c:audit_mnt_flags(): https://elixir.bootlin.com/linux/v6.1.11/C/ident/MS_POSIXACL

Probably the acl string should be just passed to mount(2) via void *data.

@AkihiroSuda
Copy link
Member Author

From torvalds/linux@caaef1b (kernel 5.8) :

vfs: don't parse "posixacl" option

Unlike the others, this is not a standard option accepted by mount(8).

In fact SB_POSIXACL is an internal flag, and accepting MS_POSIXACL on the
mount(2) interface is possibly a bug.

The only filesystem that apparently wants to handle the "posixacl" option
is 9p, but it has special handling of that option besides setting
SB_POSIXACL.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant