]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
NFSD: Do not allow NFSv4 (N)VERIFY to check POSIX ACL attributes
authorRick Macklem <rmacklem@uoguelph.ca>
Fri, 9 Jan 2026 16:21:37 +0000 (11:21 -0500)
committerChuck Lever <chuck.lever@oracle.com>
Thu, 29 Jan 2026 14:48:33 +0000 (09:48 -0500)
commit9ac6fc0fabb72550846893a4f3cf8a8b701157d9
treeb0d2fa52a4aea32f98ee3dba567b9fb17717ff94
parent97e9a9ec32231d75cc241f63ed6fd4cd210079a0
NFSD: Do not allow NFSv4 (N)VERIFY to check POSIX ACL attributes

Section 9.3 of draft-ietf-nfsv4-posix-acls-00 prohibits use of
the POSIX ACL attributes with VERIFY and NVERIFY operations: the
server MUST reply NFS4ERR_INVAL when a client attempts this.

Beyond the protocol requirement, comparison of POSIX draft ACLs
via (N)VERIFY presents an implementation challenge. Clients are
not required to order the ACEs within a POSIX ACL in any
particular way, making reliable attribute comparison impractical.

Return nfserr_inval when the client requests FATTR4_POSIX_ACCESS_ACL
or FATTR4_POSIX_DEFAULT_ACL in a VERIFY or NVERIFY operation.

Signed-off-by: Rick Macklem <rmacklem@uoguelph.ca>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
fs/nfsd/nfs4proc.c