glusterfs: add --acl command line option to load ACLs on the client side

also set the turn off filtering of ACL keys in FUSE xattr FOPs.

Signed-off-by: Anand Avati <avati@gluster.com>

BUG: 2815 (Server-enforced ACLs)
URL: http://bugs.gluster.com/cgi-bin/bugzilla3/show_bug.cgi?id=2815

4 files changed, 40 insertions, 0 deletions

diff --git a/glusterfsd/src/glusterfsd.c b/glusterfsd/src/glusterfsd.c
index 9a39570d7cd..2ee913eb694 100644
--- a/glusterfsd/src/glusterfsd.c
+++ b/glusterfsd/src/glusterfsd.c
@@ -146,6 +146,8 @@ static struct argp_option gf_options[] = {
          "Add/override a translator option for a volume with specified value"},
         {"read-only", ARGP_READ_ONLY_KEY, 0, 0,
          "Mount the filesystem in 'read-only' mode"},
+        {"acl", ARGP_ACL_KEY, 0, 0,
+         "Mount the filesystem with POSIX ACL support"},
         {"mac-compat", ARGP_MAC_COMPAT_KEY, "BOOL", OPTION_ARG_OPTIONAL,
          "Provide stubs for attributes needed for seamless operation on Macs "
 #ifdef GF_DARWIN_HOST_OS
@@ -287,6 +289,15 @@ create_fuse_mount (glusterfs_ctx_t *ctx)
                 }
         }
 
+        if (cmd_args->acl) {
+                ret = dict_set_static_ptr (master->options, "acl", "on");
+                if (ret < 0) {
+                        gf_log ("glusterfsd", GF_LOG_ERROR,
+                                "failed to set dict value for key acl");
+                        goto err;
+                }
+        }
+
         switch (cmd_args->fuse_direct_io_mode) {
         case GF_OPTION_DISABLE: /* disable */
                 ret = dict_set_static_ptr (master->options, ZR_DIRECT_IO_OPT,
@@ -479,6 +490,10 @@ parse_opts (int key, char *arg, struct argp_state *state)
                 cmd_args->read_only = 1;
                 break;
 
+        case ARGP_ACL_KEY:
+                cmd_args->acl = 1;
+                break;
+
         case ARGP_MAC_COMPAT_KEY:
                 if (!arg)
                         arg = "on";
diff --git a/glusterfsd/src/glusterfsd.h b/glusterfsd/src/glusterfsd.h
index 6fb1ebbe30c..6ea8c8e95e5 100644
--- a/glusterfsd/src/glusterfsd.h
+++ b/glusterfsd/src/glusterfsd.h
@@ -76,6 +76,7 @@ enum argp_option_keys {
         ARGP_BRICK_NAME_KEY               = 151,
         ARGP_BRICK_PORT_KEY               = 152,
         ARGP_CLIENT_PID_KEY               = 153,
+        ARGP_ACL_KEY                      = 154,
 };
 
 int glusterfs_mgmt_pmap_signout (glusterfs_ctx_t *ctx);
diff --git a/libglusterfs/src/glusterfs.h b/libglusterfs/src/glusterfs.h
index 72f4811471c..2c5d80508db 100644
--- a/libglusterfs/src/glusterfs.h
+++ b/libglusterfs/src/glusterfs.h
@@ -275,6 +275,7 @@ struct _cmd_args {
 	char            *run_id;
 	int              debug_mode;
         int              read_only;
+        int              acl;
         int              mac_compat;
 	struct list_head xlator_options;  /* list of xlator_option_t */
 
diff --git a/libglusterfs/src/graph.c b/libglusterfs/src/graph.c
index 990e96e2fd8..2cfed066919 100644
--- a/libglusterfs/src/graph.c
+++ b/libglusterfs/src/graph.c
@@ -232,6 +232,23 @@ glusterfs_graph_readonly (glusterfs_graph_t *graph, glusterfs_ctx_t *ctx)
 
 
 int
+glusterfs_graph_acl (glusterfs_graph_t *graph, glusterfs_ctx_t *ctx)
+{
+        int ret = 0;
+        cmd_args_t      *cmd_args = NULL;
+
+        cmd_args = &ctx->cmd_args;
+
+        if (!cmd_args->acl)
+                return 0;
+
+        ret = glusterfs_graph_insert (graph, ctx, "system/posix-acl",
+                                      "posix-acl-autoload");
+        return ret;
+}
+
+
+int
 glusterfs_graph_mac_compat (glusterfs_graph_t *graph, glusterfs_ctx_t *ctx)
 {
         int ret = 0;
@@ -458,6 +475,12 @@ glusterfs_graph_prepare (glusterfs_graph_t *graph, glusterfs_ctx_t *ctx)
                 return -1;
         }
 
+        ret = glusterfs_graph_acl (graph, ctx);
+        if (ret) {
+                gf_log ("graph", GF_LOG_ERROR, "glusterfs graph ACL failed");
+                return -1;
+        }
+
         /* XXX: MAC COMPAT */
         ret = glusterfs_graph_mac_compat (graph, ctx);
         if (ret) {