{"issue":{"pull_request":{"diff_url":null,"html_url":null,"patch_url":null},"state":"open","milestone":null,"user":{"avatar_url":"https://secure.gravatar.com/avatar/4d6bdaa4e88952dd1b560f99ff5f9443?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","gravatar_id":"4d6bdaa4e88952dd1b560f99ff5f9443","url":"https://api.github.com/users/jvrao","login":"jvrao","id":41390},"labels":[],"assignee":null,"updated_at":"2011-11-18T02:10:27Z","closed_at":null,"comments":0,"url":"https://api.github.com/repos/phdeniel/nfs-ganesha/issues/24","body":"I have done some investigation on what level of permission/access checks are done during LOCK and IO requests on NFSv3 and NFSv4. I have compared and contrasted the behavior of kNFS(Kernel NFS) and Ganesha. Here are my observations.\r\n\r\nPOSIX Behavior:\r\nAccess check is done at the time of open(). \r\nSince then the IO and Lock operations are only checked against the filehandle, not\r\nwith the current credentials of the file. \r\n\r\n\r\nNFSv3:\r\n\r\nkNFS: \r\n- Not much permission checks; No permission checking in NLM code.\r\n- The first lock request need to agree with the opened fd. From then on no checking.\r\n   If a file is opened for read:\r\n      - A read lock followed by a write lock allowed\r\n      - If you attempt a write lock first it will fail.\r\n- IO that is incompatible with the file permissions at that time will fail.\r\n\r\nGanesha:\r\n- Not much permission checks\r\n- File need R+W access to get any lock. One can't get readlock on a read=only file.\r\n- Can do IO that is incompatible with the file permissions at the time of IO\r\n\r\nNFSv4\r\nkNFS:\r\n- Lock request compatibility is tested with the file permissions at the time of lock request.\r\n- No dependency of the open stateid. \r\n\r\nGanesha:\r\n- Mostly like POSIX; lock compatibility is tested against the open stateid; Not compared with the present file permissions.\r\n- IO is also behaved in the same way. If the open fd and the lock/IO request are compatible, then the operation is allowed\r\n  if not, it will be failed with EPERM.\r\n","html_url":"https://github.com/phdeniel/nfs-ganesha/issues/24","number":24,"title":"Lock and IO permissions","id":2276230,"created_at":"2011-11-18T02:10:27Z"},"action":"opened"}