Inherited NFSv4 ACLs are overwritten when moving a file

[evintechnik]

Ubuntu version: 22.04
libglib2.0 version: libglib2.0-0_2.72.4-0ubuntu2.2

We are mounting an NFS share from an NFS server (FreeBSD 13). Authorization to
directories in that share is enforced through NFSv4 ACLs on the server. When
copying or moving a file to the share, it will inherit ACLs from the destination
directory.

In most of the cases this works fine. However, when we move a file that has ACLs
to a directory in the share using Nautilus or "gio move", the ACL inheritance
goes wrong. The destination file will end up with the original ACLs (the ACLs it
had in the source location) instead of the ACLs that are inherited by the
destination directory.

This behaviour changed when we upgraded from Ubuntu 20.04 to Ubuntu 22.04. In
Ubuntu 20.04 the ACL inheritance worked as expected.

I assume what happens is the following:
1. A server-side move is performed
2. The destination file is assigned ACLs (they are inherited from the destination directory)
3. glib overwrites the ACLs of the destination file with the original ACLs

To workaround the issue we patched glib and removed a call to
g_file_set_attributes_from_info, see the attached patch. This brings the
expected behaviour but may have unintended side effects.

Steps to reproduce:
1. on the server (FreeBSD): prepare two directories A and B and assign the following NFSv4 ACLs:

# file: A
# owner: root
# group: wheel
user:alice:rwx--daARWc--s:fd-----:allow
    owner@:rwxp-daARWc--s:fd-----:allow
    group@:------a-R-c--s:fd-----:allow
 everyone@:------a-R-c--s:fd-----:allow

# file: B
# owner: root
# group: wheel
user:alice:rwx--daARWc--s:fd-----:allow
  user:bob:rwx--daARWc--s:fd-----:allow
    owner@:rwxp-daARWc--s:fd-----:allow
    group@:------a-R-c--s:fd-----:allow
 everyone@:------a-R-c--s:fd-----:allow

Note the inheritance flags (fd), which indicate that files in the directories will inherit the ACLs.

2. on the client (Ubuntu): mount the NFS share to /mnt using credentials of user "alice"
3. on the client: echo "hello world" > /mnt/A/test.txt
4. on the server: list the ACLs of A/test.txt:

# file: A/test.txt
# owner: alice
# group: wheel
user:alice:rw---daARWc--s:------I:allow
    owner@:rw-p-daARWc--s:------I:allow
    group@:------a-R-c--s:------I:allow
 everyone@:------a-R-c--s:------I:allow

5. on the client: gio move /mnt/A/test.txt /mnt/B/test.txt
6. on the server: list the ACLs of B/test.txt

# file: B/test.txt
# owner: alice
# group: wheel
user:alice:rw---daARWc--s:------I:allow
    owner@:rw-p-daARWc--s:------I:allow
    group@:------a-R-c--s:------I:allow
 everyone@:------a-R-c--s:------I:allow

We expected an ACE for user bob, but it is missing.

[evintechnik (evintechnik)]

Upstream bug report: https://gitlab.gnome.org/GNOME/glib/-/issues/3077

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "disable-setting-ACL-attributes.patch" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]