From: Rick Macklem Date: Fri, 9 Jan 2026 16:21:37 +0000 (-0500) Subject: NFSD: Do not allow NFSv4 (N)VERIFY to check POSIX ACL attributes X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9ac6fc0fabb72550846893a4f3cf8a8b701157d9;p=thirdparty%2Fkernel%2Flinux.git NFSD: Do not allow NFSv4 (N)VERIFY to check POSIX ACL attributes Section 9.3 of draft-ietf-nfsv4-posix-acls-00 prohibits use of the POSIX ACL attributes with VERIFY and NVERIFY operations: the server MUST reply NFS4ERR_INVAL when a client attempts this. Beyond the protocol requirement, comparison of POSIX draft ACLs via (N)VERIFY presents an implementation challenge. Clients are not required to order the ACEs within a POSIX ACL in any particular way, making reliable attribute comparison impractical. Return nfserr_inval when the client requests FATTR4_POSIX_ACCESS_ACL or FATTR4_POSIX_DEFAULT_ACL in a VERIFY or NVERIFY operation. Signed-off-by: Rick Macklem Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever --- diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index e7ec87b6c3319..a77ec0685eeec 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -2380,6 +2380,11 @@ _nfsd4_verify(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, if (verify->ve_attrlen & 3) return nfserr_inval; + /* The POSIX draft ACLs cannot be tested via (N)VERIFY. */ + if (verify->ve_bmval[2] & (FATTR4_WORD2_POSIX_DEFAULT_ACL | + FATTR4_WORD2_POSIX_ACCESS_ACL)) + return nfserr_inval; + /* count in words: * bitmap_len(1) + bitmap(2) + attr_len(1) = 4 */