From nobody@FreeBSD.org  Thu Jan  3 15:47:00 2013
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.FreeBSD.org [8.8.178.115])
	by hub.freebsd.org (Postfix) with ESMTP id CD7217D9
	for <freebsd-gnats-submit@FreeBSD.org>; Thu,  3 Jan 2013 15:47:00 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from red.freebsd.org (red.freebsd.org [IPv6:2001:4f8:fff6::22])
	by mx1.freebsd.org (Postfix) with ESMTP id A77B7FC5
	for <freebsd-gnats-submit@FreeBSD.org>; Thu,  3 Jan 2013 15:47:00 +0000 (UTC)
Received: from red.freebsd.org (localhost [127.0.0.1])
	by red.freebsd.org (8.14.5/8.14.5) with ESMTP id r03Fl0GG023762
	for <freebsd-gnats-submit@FreeBSD.org>; Thu, 3 Jan 2013 15:47:00 GMT
	(envelope-from nobody@red.freebsd.org)
Received: (from nobody@localhost)
	by red.freebsd.org (8.14.5/8.14.5/Submit) id r03Fl0dA023761;
	Thu, 3 Jan 2013 15:47:00 GMT
	(envelope-from nobody)
Message-Id: <201301031547.r03Fl0dA023761@red.freebsd.org>
Date: Thu, 3 Jan 2013 15:47:00 GMT
From: Sandra <littlesandra88@gmail.com>
To: freebsd-gnats-submit@FreeBSD.org
Subject: delete ZFS ACL have no effect
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         174950
>Category:       kern
>Synopsis:       [zfs] delete ZFS ACL have no effect
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    trasz
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Jan 03 15:50:03 UTC 2013
>Closed-Date:    Mon Apr 01 13:25:50 UTC 2013
>Last-Modified:  Mon Apr 01 13:25:50 UTC 2013
>Originator:     Sandra
>Release:        9
>Organization:
>Environment:
>Description:
The d ZFS ACL is suppose to give or deny permission to delete a file. It have no effect.

The below is the output from the script in "How to repeat the problem", and please notice:

* Eventhough www doesn't have delete permission and there is an explicit deny, rm was possible.



p="/tank/project1"
f="$p/test2"
u="user1"

rm -f $f
setfacl -b $p

setfacl -m group@::fd:allow $p || exit 1
setfacl -m everyone@::fd:allow $p || exit 1
setfacl -m owner@:rwx:fd:allow $p || exit 1
setfacl -m u:$u:full_set:fd:allow $p || exit 1

setfacl -m u:www:rwxa:fd:allow $p || exit 1
setfacl -m u:www:d:fd:deny $p || exit 1
getfacl $p
# file: /tank/project1
# owner: root
# group: wheel
          user:www:-----d--------:fd----:deny
          user:www:rwx---a-------:fd----:allow
        user:user1:rwxpDdaARWcCos:fd----:allow
            owner@:rwx-----------:fd----:allow
            group@:--------------:fd----:allow
         everyone@:--------------:fd----:allow

su -m $u -c "touch $f"
getfacl $f
# file: /tank/project1/test2
# owner: user1
# group: wheel
          user:www:-----d--------:------:deny
          user:www:rw----a-------:------:allow
        user:user1:rw-pDdaARWcCos:------:allow
            owner@:rw------------:------:allow
            group@:--------------:------:allow
         everyone@:--------------:------:allow

su -m www -c "ls -l $f"
ls: /tank/project1/test2: Permission denied
-rw-------  1 user1  wheel  0 Dec 19 14:23 /tank/project1/test2

su -m www -c "rm $f"
ls -l $f
ls: /tank/project1/test2: No such file or directory

>How-To-Repeat:
p="/tank/project1"
f="$p/test2"
u="user1"

rm -f $f
setfacl -b $p

setfacl -m group@::fd:allow $p || exit 1
setfacl -m everyone@::fd:allow $p || exit 1
setfacl -m owner@:rwx:fd:allow $p || exit 1
setfacl -m u:$u:full_set:fd:allow $p || exit 1

setfacl -m u:www:rwxa:fd:allow $p || exit 1
setfacl -m u:www:d:fd:deny $p || exit 1
getfacl $p

su -m $u -c "touch $f"
getfacl $f

su -m www -c "ls -l $f"

su -m www -c "rm $f"
ls -l $f
>Fix:


>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->freebsd-fs 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Mon Jan 7 03:59:39 UTC 2013 
Responsible-Changed-Why:  
Over to maintainer(s). 

http://www.freebsd.org/cgi/query-pr.cgi?pr=174950 
Responsible-Changed-From-To: freebsd-fs->trasz 
Responsible-Changed-By: trasz 
Responsible-Changed-When: Tue Jan 15 16:57:28 UTC 2013 
Responsible-Changed-Why:  
I'll take it. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=174950 
State-Changed-From-To: open->closed 
State-Changed-By: trasz 
State-Changed-When: Mon Apr 1 13:25:50 UTC 2013 
State-Changed-Why:  
FreeBSD implements draft-ietf-nfsv4-minorversion1-03.txt, and the delete 
semantics is... complicated.  In short: if you have 'delete' or 
'delete_child' permission, the delete is allowed.  If 'delete_child' 
(but not 'delete') is explicitly denied, then removal is denied. 
Otherwise, fall back to the traditional unix semantics. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=174950 
>Unformatted:
