Skip to content

Whm/volcreate acls #15

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
whm wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Whm/volcreate acls #15

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0f6000e
Update volcreate processing of ACLs
whm Aug 18, 2025
68f6c07
Update version strings in scripts
whm Aug 18, 2025
9faf994
Merge branch 'master' into whm/volcreate-acls
whm Aug 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions debian/changelog
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,10 @@
afs-admin-tools (2.9) unstable; urgency=medium

* Update volcreate processing of ACLs to allow volume creation
of volumes with no ACLs to proceed without warnings.

-- Bill MacAllister <bill@ca-zephyr.org> Mon, 18 Aug 2025 22:15:32 +0000

afs-admin-tools (2.8) unstable; urgency=medium

* Move the debian build directory into the master branch of
Expand Down
90 changes: 75 additions & 15 deletions volcreate
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ our $VERSION = '2.8 (2025-07-01)';
# The Board of Trustees of the Leland Stanford Junior University
#
# Updated by Bill MacAllister <bill@ca-zephyr.org>
# Copyright 2018
# Copyright 2018-2025
# Bill MacAllister <bill@ca-zephyr.org>
#
# This program is free software; you may redistribute it and/or modify it
Expand Down Expand Up @@ -286,14 +286,60 @@ sub find_best_replicated {
return @locations;
}

# Set the ACLs of the volume appropriately. Some volumes have their own
# particular ACL conventions; take care of those here as well.
sub get_acl_list {
my ($volume, @acls) = @_;

# Find any extra ACLs that apply to this volume.
my @extra;
if (open(ACLS, '<', $ACLS)) {
my $found = 0;
while (<ACLS>) {
chomp;
my $inline = $_;
if ($inline =~ /^\s+\#/) {
next;
}
if ($inline =~ /^\s*$/) {
next;
}
if ($inline =~ m%^/(.*)/\s*$%) {
my $regex = $1;
if ($volume =~ /$regex/) {
$found = 1;
}
} elsif ($found && $inline =~ /^\s/) {
my ($user, $acl, $bogus) = split;
if ($bogus || !$user || !$acl) {
warn "$0: syntax error on line $. of $ACLS\n";
next;
}
push(@extra, $user, $acl);
}
}
close ACLS;
} else {
warn "$0: cannot open $ACLS: $!\n";
}

# Append the extra ACLs that apply to this volume.
push(@acls, @extra);

return @acls;
}

##############################################################################
# AFS operations
##############################################################################

# Create a volume, given the server, partition, volume name, and quota. Dies
# on a failure to create the volume.
sub volume_create {
my ($server, $partition, $volume, $quota) = @_;
my ($server, $partition, $volume, $quota, @acls) = @_;

my @cmd = ();

my $quota_kbytes;
if ($quota =~ /^(\d+)$/xms) {
$quota_kbytes = $quota * 1024;
Expand All @@ -314,14 +360,31 @@ sub volume_create {
die "ERROR: invalid quota value ($quota)\n";
}

system(
$VOS, 'create', '-server', $server,
'-partition', $partition, '-name', $volume,
'-maxquota', $quota_kbytes
) == 0
or die 'Failed to create volume (status ', ($? >> 8), ")\n";
system($VOS, 'backup', '-id', $volume) == 0
or die 'Failed to backup volume (status ', ($? >> 8), ")\n";
@cmd = ($VOS, 'create');
push(@cmd, '-server', $server);
push(@cmd, '-partition', $partition);
push(@cmd, '-name', $volume);
push(@cmd, '-maxquota', $quota_kbytes);
if (system(@cmd)) {
die 'Failed to create volume (status ', ($? >> 8), ")\n";
}

@cmd = ($VOS, 'backup', '-id', $volume);
if (system(@cmd)) {
die 'Failed to backup volume (status ', ($? >> 8), ")\n";
}

# Set the acls on the volume

@jaltman jaltman Aug 25, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If the backup volume is created before the setting of the optional root acls, then the created .backup will not be protected by those acls.

my @this_acl_list = get_acl_list($volume, @acls);
if (scalar(@this_acl_list) > 0) {
@cmd = ($VOS, 'setrootacl');

@jaltman jaltman Aug 25, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is setting the volume root directory acl.

Should "volcreate" also provide for an option of setting the volume maximum acl?
"vos setmaxacl". The volume maximum acl is the maximum set of rights that can be granted by users that have administrator privilege on directories, files, etc.

Should "volcreate" also permit the volume owner to be assigned? "vos setowner". The volume owner is a "pts id" (user or group). The volume owner is permitted to fetch the contents of all directories, symlinks and mountpoints. The volume owner may also modify ACLs on all objects in the volume.

push(@cmd, '-id', $volume);
push(@cmd, '-acl', @this_acl_list);
if (system(@cmd)) {
warn 'Failed to set acls (status ', ($? >> 8), ")\n";
}
}

return;
}

Expand Down Expand Up @@ -580,12 +643,9 @@ if ($type) {
if ($clone) {
volume_clone($server, $partition, $volume, $clone);
} else {
volume_create($server, $partition, $volume, $quota);
volume_create($server, $partition, $volume, $quota, @acls);
}
volume_mount($volume, $mtpt);
if (!$clone) {
volume_setacls($volume, $mtpt, @acls);
}

# If the volume is replicated, take care of creating and releasing the
# replicas now that the ACL is set correctly.
Expand Down Expand Up @@ -946,7 +1006,7 @@ Updated with Auristor support by Bill MacAllister <bill@ca-zephyr.org>.
Copyright 1998, 1999, 2000, 2002, 2004, 2005, 2011 The Board of Trustees
of the Leland Stanford Junior University.

Copyright 2018 Bill MacAllister <bill@ca-zephyr.org>
Copyright 2018-2025 Bill MacAllister <bill@ca-zephyr.org>

This program is free software; you may redistribute it and/or modify it
under the same terms as Perl itself.
Expand Down