www.cendio.com
Bug 4824 - unfs3 doesn't support local ACL:s
: unfs3 doesn't support local ACL:s
Status: CLOSED FIXED
: ThinLinc
Local drive redirection
: trunk
: PC Unknown
: P2 Normal
: 4.2.0
Assigned To:
:
:
:
:
  Show dependency treegraph
 
Reported: 2013-10-03 17:37 by
Modified: 2014-04-02 10:55 (History)


Attachments


Note

You need to log in before you can comment on or make changes to this bug.


Description From cendio 2013-10-03 17:37:46
Report from a customer:

> I've just encountered the following situtation
> - setup of '/media' in tlclient (Options > Local Devices > Drives: Details) won't work in Linux Mint 14.
> - instead you have to setup the individual usb stick (which is anoying).
> - the problem: tlclient/unfsd seems not to respect the ACL
>
>
> FYI:
> Our 'Mint 14' mounts the local USB sticks under
> /media/<local username>/<stickname>
>
> The permission of directory  '/media/<local username>' are:
>
> sysadmin@host /media/sysadmin $ ls -l /media
> drwxr-x---+ 2 root root 4096 Oct 2 12:55 sysadmin
>
> Showing ACL:
>
> sysadmin@host /media/sysadmin $ getfacl /media/sysadmin/
> getfacl: Removing leading '/' from absolute path names
> # file: media/sysadmin/
> # owner: root
> # group: root
> user::rwx
> user:sysadmin:r-x
> group::---
> mask::r-x
> other::---
>
> On the thinlinc session this leads to:
> $ ls -l ~/thindrives/media
> drwxr-x--- 3 root root  4096 Oct 2 12:55 sysadmin
>
> Which denies access unless I'm root.
>
> I'm not sure if this behaviour is new  or limited to 'Linux Mint 14'.

Since NFSv3 doesn't support ACL:s this is a bit troublesome. You could let
unfs3 try just doing whatever the user asked it to do, but that means that you
can't really trust the permissions the NFS server tells you files have.

I did some digging and found that udisks2 is using ACL:s to control access
rights for the automounted /media/username folders instead of the normal
tried-and-true owner/group settings. Attempts to make this configurable has
been met with hostility: https://bugs.freedesktop.org/show_bug.cgi?id=54866

*sigh*
------- Comment #1 From cendio 2014-02-19 13:53:52 -------
Fixed in r28463.
------- Comment #2 From cendio 2014-03-19 12:19:59 -------
Testing using tlclient build 4290 on fedora, redirecting drive /run/media.

Everything works as expected.