--- /dev/null	2007-08-22 11:21:03.626521839 -0400

+++ acl-2.2.39/libacl/acl_nfs4_get_who.c	2007-08-22 12:02:13.000000000 -0400

@@ -0,0 +1,103 @@

+/*

+ *  NFSv4 ACL Code

+ *  Read the who value from the ace and return its type and optionally

+ *  its value.

+ *

+ *  Ace is a reference to the ace to extract the who value from.

+ *  Type is a reference where the value of the whotype will be stored.

+ *  Who is a double reference that should either be passed as NULL

+ *  (and thus no who string will be returned) or as a pointer to a

+ *  char* where the who string will be allocated. This string must be

+ *  freed by the caller.

+ *

+ *  Copyright (c) 2002, 2003 The Regents of the University of Michigan.

+ *  All rights reserved.

+ *

+ *  Nathaniel Gallaher <ngallahe@umich.edu>

+ *

+ *  Redistribution and use in source and binary forms, with or without

+ *  modification, are permitted provided that the following conditions

+ *  are met:

+ *

+ *  1. Redistributions of source code must retain the above copyright

+ *     notice, this list of conditions and the following disclaimer.

+ *  2. Redistributions in binary form must reproduce the above copyright

+ *     notice, this list of conditions and the following disclaimer in the

+ *     documentation and/or other materials provided with the distribution.

+ *  3. Neither the name of the University nor the names of its

+ *     contributors may be used to endorse or promote products derived

+ *     from this software without specific prior written permission.

+ *

+ *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED

+ *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF

+ *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE

+ *  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE

+ *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR

+ *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF

+ *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR

+ *  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF

+ *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING

+ *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS

+ *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+ */

+

+#include "libacl_nfs4.h"

+

+int acl_nfs4_get_who(struct nfs4_ace* ace, int* type, char** who)

+{

+	int itype;

+	char* iwho = NULL;

+	int wholen;

+

+	if(ace == NULL || ace->who == NULL)

+		goto inval_failed;

+

+	itype = acl_nfs4_get_whotype(ace->who);

+

+	if(type != NULL) {

+		*type = itype;

+	}

+

+

+	if(who == NULL)

+		return 0;

+

+	switch(itype)

+	{

+		case NFS4_ACL_WHO_NAMED:

+			iwho = ace->who;

+			break;

+		case NFS4_ACL_WHO_OWNER:

+			iwho = NFS4_ACL_WHO_OWNER_STRING;

+			break;

+		case NFS4_ACL_WHO_GROUP:

+			iwho = NFS4_ACL_WHO_GROUP_STRING;

+			break;

+		case NFS4_ACL_WHO_EVERYONE:

+			iwho = NFS4_ACL_WHO_EVERYONE_STRING;

+			break;

+		default:

+			goto inval_failed;

+	}

+

+	wholen = strlen(iwho);

+	if(wholen < 0)

+		goto inval_failed;

+

+	(*who) = (char *) malloc(sizeof(char) * (wholen + 1));

+	if((*who) == NULL) {

+		errno = ENOMEM;

+		goto failed;

+	}

+

+	strcpy((*who), iwho);

+

+	return 0;

+

+inval_failed:

+	errno = EINVAL;

+

+failed:

+	return -1;

+}

+

--- /dev/null	2007-08-22 11:21:03.626521839 -0400

+++ acl-2.2.39/libacl/acl_nfs4_add_ace.c	2007-08-22 12:02:13.000000000 -0400

@@ -0,0 +1,83 @@

+/*

+ *  NFSv4 ACL Code

+ *  Add an ace to the acl

+ *

+ *  Copyright (c) 2002, 2003 The Regents of the University of Michigan.

+ *  All rights reserved.

+ *

+ *  Marius Aamodt Eriksen <marius@umich.edu>

+ *  J. Bruce Fields <bfields@umich.edu>

+ *  Nathaniel Gallaher <ngallahe@umich.edu>

+ *  Jeff Sedlak <jsedlak@umich.edu>

+ *

+ *  Redistribution and use in source and binary forms, with or without

+ *  modification, are permitted provided that the following conditions

+ *  are met:

+ *

+ *  1. Redistributions of source code must retain the above copyright

+ *     notice, this list of conditions and the following disclaimer.

+ *  2. Redistributions in binary form must reproduce the above copyright

+ *     notice, this list of conditions and the following disclaimer in the

+ *     documentation and/or other materials provided with the distribution.

+ *  3. Neither the name of the University nor the names of its

+ *     contributors may be used to endorse or promote products derived

+ *     from this software without specific prior written permission.

+ *

+ *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED

+ *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF

+ *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE

+ *  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE

+ *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR

+ *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF

+ *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR

+ *  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF

+ *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING

+ *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS

+ *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+ */

+

+#include "libacl_nfs4.h"

+

+int

+acl_nfs4_add_ace(struct nfs4_acl *acl, u32 type, u32 flag, u32 access_mask,

+		int whotype, char* who)

+{

+	struct nfs4_ace *ace;

+	int result;

+

+	if(acl == NULL)

+	{

+		errno = EINVAL;

+		return -1;

+	}

+

+	if ((ace = malloc(sizeof(*ace))) == NULL)

+	{

+		errno = ENOMEM;

+		return -1;

+	}

+

+	ace->type = type;

+	ace->flag = flag;

+

+	if( type == NFS4_ACE_ACCESS_DENIED_ACE_TYPE )

+		access_mask = access_mask & ~(NFS4_ACE_MASK_IGNORE);

+

+

+	/* Castrate delete_child if we aren't a directory */

+	if (!acl->is_directory)

+		access_mask &= ~NFS4_ACE_DELETE_CHILD;

+

+

+	ace->access_mask = access_mask & NFS4_ACE_MASK_ALL;

+

+	result = acl_nfs4_set_who(ace, whotype, who);

+	if(result < 0)

+		return -1;

+

+	TAILQ_INSERT_TAIL(&acl->ace_head, ace, l_ace);

+	acl->naces++;

+

+	return 0;

+}

+

--- /dev/null	2007-08-22 11:21:03.626521839 -0400

+++ acl-2.2.39/libacl/acl_nfs4_get_whotype.c	2007-08-22 12:02:13.000000000 -0400

@@ -0,0 +1,60 @@

+/*

+ *  NFSv4 ACL Code

+ *  Get the whotype of the who string passed

+ *

+ *  Copyright (c) 2002, 2003 The Regents of the University of Michigan.

+ *  All rights reserved.

+ *

+ *  Marius Aamodt Eriksen <marius@umich.edu>

+ *  J. Bruce Fields <bfields@umich.edu>

+ *  Nathaniel Gallaher <ngallahe@umich.edu>

+ *  Jeff Sedlak <jsedlak@umich.edu>

+ *

+ *  Redistribution and use in source and binary forms, with or without

+ *  modification, are permitted provided that the following conditions

+ *  are met:

+ *

+ *  1. Redistributions of source code must retain the above copyright

+ *     notice, this list of conditions and the following disclaimer.

+ *  2. Redistributions in binary form must reproduce the above copyright

+ *     notice, this list of conditions and the following disclaimer in the

+ *     documentation and/or other materials provided with the distribution.

+ *  3. Neither the name of the University nor the names of its

+ *     contributors may be used to endorse or promote products derived

+ *     from this software without specific prior written permission.

+ *

+ *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED

+ *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF

+ *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE

+ *  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE

+ *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR

+ *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF

+ *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR

+ *  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF

+ *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING

+ *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS

+ *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+ */

+

+#include "libacl_nfs4.h"

+

+inline int

+acl_nfs4_get_whotype(char *p)

+{

+	if(0 == strcmp(p, NFS4_ACL_WHO_OWNER_STRING) &&

+			strlen(p) == strlen(NFS4_ACL_WHO_OWNER_STRING)) {

+		return NFS4_ACL_WHO_OWNER;

+	}

+	if(0 == strcmp(p, NFS4_ACL_WHO_GROUP_STRING) &&

+			strlen(p) == strlen(NFS4_ACL_WHO_GROUP_STRING)) {

+		return NFS4_ACL_WHO_GROUP;

+	}

+	if(0 == strcmp(p, NFS4_ACL_WHO_EVERYONE_STRING) &&

+			strlen(p) == strlen(NFS4_ACL_WHO_EVERYONE_STRING)) {

+		return NFS4_ACL_WHO_EVERYONE;

+	}

+

+	return NFS4_ACL_WHO_NAMED;

+}

+

+

--- /dev/null	2007-08-22 11:21:03.626521839 -0400

+++ acl-2.2.39/libacl/acl_nfs4_free.c	2007-08-22 12:02:13.000000000 -0400

@@ -0,0 +1,61 @@

+/*

+ *  Copyright (c) 2004 The Regents of the University of Michigan.

+ *  All rights reserved.

+ *

+ *  Marius Aamodt Eriksen <marius@umich.edu>

+ *  J. Bruce Fields <bfields@umich.edu>

+ *  Nathaniel Gallaher <ngallahe@umich.edu>

+ *  Jeff Sedlak <jsedlak@umich.edu>

+ *

+ *  Redistribution and use in source and binary forms, with or without

+ *  modification, are permitted provided that the following conditions

+ *  are met:

+ *

+ *  1. Redistributions of source code must retain the above copyright

+ *     notice, this list of conditions, the following disclaimer, and

+ *     any and all other licensing or copyright notices included in

+ *     any files in this distribution.

+ *  2. Redistributions in binary form must reproduce the above copyright

+ *     notice, this list of conditions and the following disclaimer in the

+ *     documentation and/or other materials provided with the distribution.

+ *  3. Neither the name of the University nor the names of its

+ *     contributors may be used to endorse or promote products derived

+ *     from this software without specific prior written permission.

+ *

+ *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED

+ *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF

+ *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE

+ *  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE

+ *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR

+ *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF

+ *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR

+ *  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF

+ *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING

+ *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS

+ *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+ *

+ */

+

+#include "libacl_nfs4.h"

+

+void

+acl_nfs4_free(struct nfs4_acl *acl)

+{

+	struct nfs4_ace *ace;

+

+	if (!acl)

+		return;

+

+	while (!TAILQ_IS_EMPTY(acl->ace_head)) {

+		ace = (acl)->ace_head.tqh_first;

+

+		TAILQ_REMOVE( &(acl->ace_head), ace, l_ace);

+		free(ace->who);

+		free(ace);

+	}

+

+	free(acl);

+

+	return;

+}

+

--- /dev/null	2007-08-22 11:21:03.626521839 -0400

+++ acl-2.2.39/libacl/acl_n4tp_acl_trans.c	2007-08-22 12:02:13.000000000 -0400

@@ -0,0 +1,439 @@

+/*

+ *  NFSv4 ACL Code

+ *  Convert NFSv4 ACL to a POSIX ACL

+ *

+ *  Copyright (c) 2002, 2003 The Regents of the University of Michigan.

+ *  All rights reserved.

+ *

+ *  Nathaniel Gallaher <ngallahe@umich.edu>

+ *

+ *  Redistribution and use in source and binary forms, with or without

+ *  modification, are permitted provided that the following conditions

+ *  are met:

+ *

+ *  1. Redistributions of source code must retain the above copyright

+ *     notice, this list of conditions and the following disclaimer.

+ *  2. Redistributions in binary form must reproduce the above copyright

+ *     notice, this list of conditions and the following disclaimer in the

+ *     documentation and/or other materials provided with the distribution.

+ *  3. Neither the name of the University nor the names of its

+ *     contributors may be used to endorse or promote products derived

+ *     from this software without specific prior written permission.

+ *

+ *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED

+ *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF

+ *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE

+ *  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE

+ *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR

+ *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF

+ *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR

+ *  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF

+ *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING

+ *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS

+ *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+ */

+

+#include <acl/libacl.h>

+#include <nfsidmap.h>

+#include "libacl_nfs4.h"

+

+

+/*

+ * While processing the NFSv4 ACE, this maintains bitmasks representing

+ * which permission bits have been allowed and which denied to a given

+ * entity: */

+struct posix_ace_state {

+	u_int32_t allow;

+	u_int32_t deny;

+};

+

+struct posix_user_ace_state {

+	uid_t uid;

+	struct posix_ace_state perms;

+};

+

+struct posix_ace_state_array {

+	int n;

+	struct posix_user_ace_state aces[];

+};

+

+/*

+ * While processing the NFSv4 ACE, this maintains the partial permissions

+ * calculated so far: */

+

+struct posix_acl_state {

+	struct posix_ace_state owner;

+	struct posix_ace_state group;

+	struct posix_ace_state other;

+	struct posix_ace_state everyone;

+	struct posix_ace_state mask; /* Deny unused in this case */

+	struct posix_ace_state_array *users;

+	struct posix_ace_state_array *groups;

+};

+

+static int

+init_state(struct posix_acl_state *state, int cnt)

+{

+	int alloc;

+

+	memset(state, 0, sizeof(struct posix_acl_state));

+	/*

+	 * In the worst case, each individual acl could be for a distinct

+	 * named user or group, but we don't know which, so we allocate

+	 * enough space for either:

+	 */

+	alloc = sizeof(struct posix_ace_state_array)

+		+ cnt*sizeof(struct posix_user_ace_state);

+	state->users = calloc(1, alloc);

+	if (!state->users)

+		return -ENOMEM;

+	state->groups = calloc(1, alloc);

+	if (!state->groups) {

+		free(state->users);

+		return -ENOMEM;

+	}

+	return 0;

+}

+

+static void

+free_state(struct posix_acl_state *state) {

+	free(state->users);

+	free(state->groups);

+}

+

+static inline void add_to_mask(struct posix_acl_state *state, struct posix_ace_state *astate)

+{

+	state->mask.allow |= astate->allow;

+}

+

+/*

+ * We only map from NFSv4 to POSIX ACLs when getting ACLs, when we err on the

+ * side of permissiveness (so as not to make the file appear more secure than

+ * it really is), so the mode bit mapping below is optimistic.

+ */

+static void

+set_mode_from_nfs4(acl_entry_t pace, u_int32_t perm, int is_dir)

+{

+	u32 write_mode = NFS4_WRITE_MODE;

+	acl_permset_t perms;

+

+	acl_get_permset(pace, &perms;;

+	acl_clear_perms(perms);

+	if (is_dir)

+		write_mode |= NFS4_ACE_DELETE_CHILD;

+	if (perm & NFS4_READ_MODE)

+		acl_add_perm(perms, ACL_READ);

+	if (perm & write_mode)

+		acl_add_perm(perms, ACL_WRITE);

+	if (perm & NFS4_EXECUTE_MODE)

+		acl_add_perm(perms, ACL_EXECUTE);

+	acl_set_permset(pace, perms);

+}

+

+/* XXX: add a "check allow" that can warn on e.g. allows of WRITE_ACL

+ * to non-owner? */

+

+/* XXX: replace error returns by errno sets all over.  Ugh. */

+

+static acl_t

+posix_state_to_acl(struct posix_acl_state *state, int is_dir)

+{

+	acl_entry_t pace;

+	acl_t pacl;

+	int nace;

+	int i, error = 0;

+

+	if (state->users->n || state->groups->n)

+		nace = 4 + state->users->n + state->groups->n;

+	else

+		nace = 3;

+	pacl = acl_init(nace);

+	if (!pacl)

+		return NULL;

+

+	error = acl_create_entry(&pacl, &pace);

+	if (error)

+		goto out_err;

+	acl_set_tag_type(pace, ACL_USER_OBJ);

+	set_mode_from_nfs4(pace, state->owner.allow, is_dir);

+

+	for (i=0; i < state->users->n; i++) {

+		error = acl_create_entry(&pacl, &pace);

+		if (error)

+			goto out_err;

+		acl_set_tag_type(pace, ACL_USER);

+		set_mode_from_nfs4(pace, state->users->aces[i].perms.allow,

+					is_dir);

+		acl_set_qualifier(pace, &state->users->aces[i].uid);

+		add_to_mask(state, &state->users->aces[i].perms);

+	}

+

+	error = acl_create_entry(&pacl, &pace);

+	if (error)

+		goto out_err;

+	acl_set_tag_type(pace, ACL_GROUP_OBJ);

+	set_mode_from_nfs4(pace, state->group.allow, is_dir);

+	add_to_mask(state, &state->group);

+

+	for (i=0; i < state->groups->n; i++) {

+		error = acl_create_entry(&pacl, &pace);

+		if (error)

+			goto out_err;

+		acl_set_tag_type(pace, ACL_GROUP);

+		set_mode_from_nfs4(pace, state->groups->aces[i].perms.allow,

+					is_dir);

+		acl_set_qualifier(pace, &state->groups->aces[i].uid);

+		add_to_mask(state, &state->groups->aces[i].perms);

+	}

+

+	if (nace > 3) {

+		error = acl_create_entry(&pacl, &pace);

+		if (error)

+			goto out_err;

+		acl_set_tag_type(pace, ACL_MASK);

+		set_mode_from_nfs4(pace, state->mask.allow, is_dir);

+	}

+

+	error = acl_create_entry(&pacl, &pace);

+	if (error)

+		goto out_err;

+	acl_set_tag_type(pace, ACL_OTHER);

+	set_mode_from_nfs4(pace, state->other.allow, is_dir);

+

+	return pacl;

+out_err:

+	acl_free(pacl);

+	return NULL;

+}

+

+static inline void allow_bits(struct posix_ace_state *astate, u32 mask)

+{

+	/* Allow all bits in the mask not already denied: */

+	astate->allow |= mask & ~astate->deny;

+}

+

+static inline void deny_bits(struct posix_ace_state *astate, u32 mask)

+{

+	/* Deny all bits in the mask not already allowed: */

+	astate->deny |= mask & ~astate->allow;

+}

+

+static int find_uid(struct posix_acl_state *state, struct posix_ace_state_array *a, uid_t uid)

+{

+	int i;

+

+	for (i = 0; i < a->n; i++)

+		if (a->aces[i].uid == uid)

+			return i;

+	/* Not found: */

+	a->n++;

+	a->aces[i].uid = uid;

+	a->aces[i].perms.allow = state->everyone.allow;

+	a->aces[i].perms.deny  = state->everyone.deny;

+

+	return i;

+}

+

+static void deny_bits_array(struct posix_ace_state_array *a, u32 mask)

+{

+	int i;

+

+	for (i=0; i < a->n; i++)

+		deny_bits(&a->aces[i].perms, mask);

+}

+

+static void allow_bits_array(struct posix_ace_state_array *a, u32 mask)

+{

+	int i;

+

+	for (i=0; i < a->n; i++)

+		allow_bits(&a->aces[i].perms, mask);

+}

+

+static acl_tag_t acl_n4tp_get_whotype(struct nfs4_ace *ace)

+{

+	int nfs4type;

+	int result;

+

+	result = acl_nfs4_get_who(ace, &nfs4type, NULL);

+	if (result < 0)

+		return -1;

+

+	switch (nfs4type) {

+		case NFS4_ACL_WHO_NAMED:

+			return (ace->flag & NFS4_ACE_IDENTIFIER_GROUP ?

+					ACL_GROUP : ACL_USER);

+		case NFS4_ACL_WHO_OWNER:

+			return ACL_USER_OBJ;

+		case NFS4_ACL_WHO_GROUP:

+			return ACL_GROUP_OBJ;

+		case NFS4_ACL_WHO_EVERYONE:

+			return ACL_OTHER;

+	}

+	errno = EINVAL;

+	return -1;

+}

+

+static int process_one_v4_ace(struct posix_acl_state *state,

+				struct nfs4_ace *ace)

+{

+	u32 mask = ace->access_mask;

+	uid_t id;

+	int i;

+

+	if (nfs4_init_name_mapping(NULL))

+		return -1;

+

+	switch (acl_n4tp_get_whotype(ace)) {

+	case ACL_USER_OBJ:

+		if (ace->type == NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE) {

+			allow_bits(&state->owner, mask);

+		} else {

+			deny_bits(&state->owner, mask);

+		}

+		break;

+	case ACL_USER:

+		if (nfs4_name_to_uid(ace->who, &id))

+			return -1;

+		i = find_uid(state, state->users, id);

+		if (ace->type == NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE) {

+			allow_bits(&state->users->aces[i].perms, mask);

+			mask = state->users->aces[i].perms.allow;

+			allow_bits(&state->owner, mask);

+		} else {

+			deny_bits(&state->users->aces[i].perms, mask);

+		}

+		break;

+	case ACL_GROUP_OBJ:

+		if (ace->type == NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE) {

+			allow_bits(&state->group, mask);

+			mask = state->group.allow;

+			allow_bits(&state->owner, mask);

+			allow_bits(&state->everyone, mask);

+			allow_bits_array(state->users, mask);

+			allow_bits_array(state->groups, mask);

+		} else {

+			deny_bits(&state->group, mask);

+		}

+		break;

+	case ACL_GROUP:

+		if (nfs4_name_to_gid(ace->who, &id))

+			return -1;

+		i = find_uid(state, state->groups, id);

+		if (ace->type == NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE) {

+			allow_bits(&state->groups->aces[i].perms, mask);

+			mask = state->groups->aces[i].perms.allow;

+			allow_bits(&state->owner, mask);

+			allow_bits(&state->group, mask);

+			allow_bits(&state->everyone, mask);

+			allow_bits_array(state->users, mask);

+			allow_bits_array(state->groups, mask);

+		} else {

+			deny_bits(&state->groups->aces[i].perms, mask);

+		}

+		break;

+	case ACL_OTHER:

+		if (ace->type == NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE) {

+			allow_bits(&state->owner, mask);

+			allow_bits(&state->group, mask);

+			allow_bits(&state->other, mask);

+			allow_bits(&state->everyone, mask);

+			allow_bits_array(state->users, mask);

+			allow_bits_array(state->groups, mask);

+		} else {

+			deny_bits(&state->owner, mask);

+			deny_bits(&state->group, mask);

+			deny_bits(&state->other, mask);

+			deny_bits(&state->everyone, mask);

+			deny_bits_array(state->users, mask);

+			deny_bits_array(state->groups, mask);

+		}

+	}

+	return 0;

+}

+

+#define FILE_OR_DIR_INHERIT (NFS4_ACE_FILE_INHERIT_ACE \

+				| NFS4_ACE_DIRECTORY_INHERIT_ACE)

+

+/* Strip or keep inheritance aces depending on type of posix acl requested */

+static void acl_nfs4_check_inheritance(struct nfs4_acl *acl, u32 iflags)

+{

+	struct nfs4_ace * cur_ace;

+	struct nfs4_ace * temp_ace;

+

+	cur_ace = acl->ace_head.tqh_first;

+

+	while (cur_ace) {

+		/* get the next ace now in case we free the current ace */

+		temp_ace = cur_ace;

+		cur_ace = cur_ace->l_ace.tqe_next;

+

+		if (iflags & NFS4_ACL_REQUEST_DEFAULT) {

+			if (!(temp_ace->flag & FILE_OR_DIR_INHERIT))

+				acl_nfs4_remove_ace(acl, temp_ace);

+		} else {

+			if (temp_ace->flag & NFS4_ACE_INHERIT_ONLY_ACE)

+				acl_nfs4_remove_ace(acl, temp_ace);

+		}

+	}

+}

+

+acl_t acl_n4tp_acl_trans(struct nfs4_acl * nacl_p, acl_type_t ptype)

+{

+	struct posix_acl_state state;

+	acl_t pacl;

+	struct nfs4_acl * temp_acl;

+	struct nfs4_ace * cur_ace;

+	int ret;

+	u32 iflags = NFS4_ACL_NOFLAGS;

+

+	if (ptype == ACL_TYPE_DEFAULT) {

+		if (nacl_p->is_directory)

+			iflags |= NFS4_ACL_REQUEST_DEFAULT;

+		else {

+			errno = EINVAL;

+			return NULL;

+		}

+	}

+

+	/* Copy so we can delete bits without borking the original */

+	temp_acl = acl_nfs4_copy_acl(nacl_p);

+	if (temp_acl == NULL)

+		return NULL;

+

+	acl_nfs4_check_inheritance(temp_acl, iflags);

+

+	if (ptype == ACL_TYPE_DEFAULT && temp_acl->naces == 0) {

+		acl_nfs4_free(temp_acl);

+		return acl_init(0);

+	}

+

+	ret = init_state(&state, temp_acl->naces);

+	if (ret)

+		goto free_failed;

+

+	cur_ace = temp_acl->ace_head.tqh_first;

+	while (cur_ace) {

+		if (process_one_v4_ace(&state, cur_ace)) {

+			free_state(&state);

+			goto free_failed;

+		}

+		cur_ace = cur_ace->l_ace.tqe_next;

+	}

+

+	acl_nfs4_free(temp_acl);

+

+	pacl = posix_state_to_acl(&state, nacl_p->is_directory);

+

+	free_state(&state);

+

+	ret = acl_valid(pacl);

+	if (ret < 0)

+		goto free_failed;

+

+	return pacl;

+

+free_failed:

+	acl_nfs4_free(temp_acl);

+	return NULL;

+}

--- acl-2.2.39/libacl/acl_set_fd.c.orig	2006-06-20 02:51:25.000000000 -0400

+++ acl-2.2.39/libacl/acl_set_fd.c	2007-08-22 12:02:13.000000000 -0400

@@ -24,6 +24,11 @@

 #include "libacl.h"

 #include "__acl_to_xattr.h"

+#ifdef USE_NFSV4_TRANS

+ #include "libacl_nfs4.h"

+ #include <nfsidmap.h>

+#endif

+

 #include "byteorder.h"

 #include "acl_ea.h"

@@ -37,10 +42,42 @@ acl_set_fd(int fd, acl_t acl)

 	const char *name = ACL_EA_ACCESS;

 	size_t size;

 	int error;

+#ifdef USE_NFSV4_TRANS

+	int retval;

+	struct nfs4_acl * nacl;

+#endif

 	if (!acl_obj_p)

 		return -1;

+

+#ifdef USE_NFSV4_TRANS

+	retval = fgetxattr(fd, ACL_NFS4_XATTR, NULL, 0);

+

+	if(retval == -1 && (errno == ENOATTR || errno == EOPNOTSUPP)) {

+		ext_acl_p = __acl_to_xattr(acl_obj_p, &size);

+	} else {

+		char domain[NFS4_MAX_DOMAIN_LEN];

+		nfs4_init_name_mapping(NULL);

+		error = nfs4_get_default_domain(NULL, domain, sizeof(domain));

+		if (error)

+			return -1;

+		nacl = acl_nfs4_new(0);

+		if (acl == NULL) {

+			errno = ENOMEM;

+			return -1;

+		}

+		error = acl_ptn4_acl_trans(acl, nacl, ACL_TYPE_ACCESS, 0, domain);

+		if (error)

+			return -1;

+

+		size = acl_nfs4_xattr_pack(nacl, &ext_acl_p);

+		name = ACL_NFS4_XATTR;

+		acl_nfs4_free(nacl);

+	}

+#else

 	ext_acl_p = __acl_to_xattr(acl_obj_p, &size);

+#endif

+

 	if (!ext_acl_p)

 		return -1;

 	error = fsetxattr(fd, name, (char *)ext_acl_p, size, 0);

--- acl-2.2.39/libacl/Makefile.orig	2006-06-20 02:51:25.000000000 -0400

+++ acl-2.2.39/libacl/Makefile	2007-08-22 12:02:13.000000000 -0400

@@ -8,19 +8,35 @@ LTLDFLAGS += -Wl,--version-script,$(TOPD

 include $(TOPDIR)/include/builddefs

 LTLIBRARY = libacl.la

-LTLIBS = -lattr $(LIBMISC)

+LTLIBS = -lattr -lnfsidmap $(LIBMISC)

 LTDEPENDENCIES = $(LIBMISC)

-LT_CURRENT = 2

+LT_CURRENT = 3

 LT_REVISION = 0

-LT_AGE = 1

+LT_AGE = 2

+

+CFILES = $(POSIX_CFILES) $(LIBACL_CFILES) $(LIBACL_NFS4_CFILES) \

+	$(INTERNAL_CFILES) perm_copy_fd.c perm_copy_file.c

-CFILES = $(POSIX_CFILES) $(LIBACL_CFILES) $(INTERNAL_CFILES) \

-	 perm_copy_fd.c perm_copy_file.c

 HFILES = libobj.h libacl.h byteorder.h __acl_from_xattr.h __acl_to_xattr.h \

-	 perm_copy.h

+	 perm_copy.h $(LIBACL_NFS4_HFILES)

 LCFLAGS = -include perm_copy.h

+LIBACL_NFS4_CFILES = \

+	acl_nfs4_get_who.c \

+	acl_n4tp_acl_trans.c       acl_nfs4_get_whotype.c \

+	acl_nfs4_new.c \

+	acl_nfs4_add_ace.c         acl_nfs4_remove_ace.c \

+	acl_nfs4_add_pair.c \

+	acl_nfs4_copy_acl.c        acl_nfs4_set_who.c \

+	acl_nfs4_free.c            acl_nfs4_xattr_load.c \

+	acl_nfs4_xattr_pack.c      acl_nfs4_xattr_size.c \

+	acl_ptn4_acl_trans.c \

+	acl_ptn4_get_mask.c        __posix_acl_from_nfs4_xattr.c \

+

+

+LIBACL_NFS4_HFILES = ../include/libacl_nfs4.h ../include/nfs4.h

+

 POSIX_CFILES = \

 	acl_add_perm.c acl_calc_mask.c acl_clear_perms.c acl_copy_entry.c \

 	acl_copy_ext.c acl_copy_int.c acl_create_entry.c acl_delete_def_file.c \

--- /dev/null	2007-08-22 11:21:03.626521839 -0400

+++ acl-2.2.39/libacl/acl_nfs4_remove_ace.c	2007-08-22 12:02:13.000000000 -0400

@@ -0,0 +1,48 @@

+/*

+ *  NFSv4 ACL Code

+ *  Remove an ace from an NFS4 ACL

+ *

+ *  Copyright (c) 2004 The Regents of the University of Michigan.

+ *  All rights reserved.

+ *

+ *  Nathaniel Gallaher <ngallahe@umich.edu>

+ *

+ *  Redistribution and use in source and binary forms, with or without

+ *  modification, are permitted provided that the following conditions

+ *  are met: