Andrew Walker 39b4adf91d Fix access check when cred allows override of ACL ... Properly evaluate edge cases where user credential may grant capability to override DAC in various situations. Switch to using ns-aware checks rather than capable(). Expand optimization allow bypass of zfs_zaccess() in case of trivial ACL if MAY_OPEN is included in requested mask. This will be evaluated in generic_permission() check, which is RCU walk safe. This means that in most cases evaluating permissions on boot volume with NFSv4 ACLs will follow the fast path on checking inode permissions. Additionally, CAP_SYS_ADMIN is granted to nfsd process, and so override for this capability in access2 policy check is removed in favor of a simple check for fsid == 0. Checks for CAP_DAC_OVERRIDE and other override capabilities are kept as-is. Signed-off-by: Andrew Walker <awalker@ixsystems.com>		2024-02-29 23:31:47 +05:00
..
freebsd	BRT: Fix FICLONE/FICLONERANGE shortened copy	2024-02-05 16:44:45 -08:00
linux	Fix access check when cred allows override of ACL	2024-02-29 23:31:47 +05:00