[LTP] [PATCH v1 2/8] fs/acl: Add ACL mask interaction tests
Sachin Sant
sachinp@linux.ibm.com
Tue Jun 2 14:19:52 CEST 2026
Add acl_mask01 test with 3 test cases to validate ACL_MASK
interaction with named user and group entries:
1. ACL_USER with mask - Named user permissions restricted by mask
2. ACL_GROUP with mask - Named group permissions restricted by mask
3. ACL_GROUP_OBJ with mask - Group owner permissions restricted by mask
Each test verifies that:
- With mask set to rwx, access is granted
- With mask cleared (---), access is denied with EACCES
This validates that ACL_MASK correctly restricts permissions for
ACL_USER, ACL_GROUP, and ACL_GROUP_OBJ entries.
Signed-off-by: Sachin Sant <sachinp@linux.ibm.com>
---
V1 changes:
- Use HAVE_LIBACL guards in .c code
- Report TCONF when libacl is not available
- rfc link https://lore.kernel.org/ltp/477836fd-80c8-4168-bfe6-00b374bb2534@linux.ibm.com/T/#t
---
runtest/fs | 1 +
testcases/kernel/fs/acl/.gitignore | 1 +
testcases/kernel/fs/acl/acl_mask01.c | 283 +++++++++++++++++++++++++++
3 files changed, 285 insertions(+)
create mode 100644 testcases/kernel/fs/acl/acl_mask01.c
diff --git a/runtest/fs b/runtest/fs
index debedb9ae..b1202dc03 100644
--- a/runtest/fs
+++ b/runtest/fs
@@ -89,3 +89,4 @@ binfmt_misc02 binfmt_misc02.sh
squashfs01 squashfs01
acl_user_obj01 acl_user_obj01
+acl_mask01 acl_mask01
diff --git a/testcases/kernel/fs/acl/.gitignore b/testcases/kernel/fs/acl/.gitignore
index d9c46db11..bfcdee93d 100644
--- a/testcases/kernel/fs/acl/.gitignore
+++ b/testcases/kernel/fs/acl/.gitignore
@@ -1 +1,2 @@
/acl_user_obj01
+/acl_mask01
diff --git a/testcases/kernel/fs/acl/acl_mask01.c b/testcases/kernel/fs/acl/acl_mask01.c
new file mode 100644
index 000000000..bfcd4c285
--- /dev/null
+++ b/testcases/kernel/fs/acl/acl_mask01.c
@@ -0,0 +1,283 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (c) IBM, 2026
+ *
+ * Original shell test by Kai Zhao (ltcd3@cn.ibm.com)
+ * Converted to C by Sachin Sant <sachinp@linux.ibm.com>
+ */
+
+/*\
+ * Test ACL mask interaction with named users and groups.
+ *
+ * Verify that ACL_MASK correctly restricts permissions for:
+ * - ACL_USER (named user) entries
+ * - ACL_GROUP (named group) entries
+ * - ACL_GROUP_OBJ (group owner) entries
+ *
+ * The mask acts as an upper bound on permissions for these entry types.
+ * Even if an entry grants full permissions, the mask can restrict them.
+ * ACL_USER_OBJ and ACL_OTHER are not affected by the mask.
+ *
+ * [Algorithm]
+ *
+ * For each entry type (ACL_USER, ACL_GROUP, ACL_GROUP_OBJ):
+ * 1. Set up ACL with full permissions for the entry
+ * 2. Set mask to allow full permissions (rwx)
+ * 3. Verify access is granted
+ * 4. Clear mask permissions (---)
+ * 5. Verify access is denied despite entry having full permissions
+ */
+
+#include "acl_lib.h"
+
+uid_t user1_uid, user2_uid, user3_uid;
+gid_t user1_gid, user2_gid, user3_gid;
+int users_created = 0;
+
+#ifdef HAVE_LIBACL
+
+/*
+ * Test ACL_USER permissions with mask.
+ * Named user permissions should be restricted by ACL_MASK.
+ */
+static void test_acl_user_with_mask(void)
+{
+ acl_t acl;
+ int err;
+
+ tst_res(TINFO, "Testing ACL_USER with mask");
+ reset_test_path();
+
+ acl = acl_init(5);
+ if (!acl)
+ tst_brk(TBROK | TERRNO, "acl_init failed");
+
+ add_acl_entry(acl, ACL_USER_OBJ,
+ ACL_READ | ACL_WRITE | ACL_EXECUTE);
+ add_named_user_acl_entry(acl, user3_uid,
+ ACL_READ | ACL_WRITE | ACL_EXECUTE);
+ add_empty_acl_entry(acl, ACL_GROUP_OBJ);
+ add_acl_entry(acl, ACL_MASK,
+ ACL_READ | ACL_WRITE | ACL_EXECUTE);
+ add_empty_acl_entry(acl, ACL_OTHER);
+
+ set_acl_file(TESTDIR, ACL_TYPE_ACCESS, acl);
+ safe_acl_free(acl);
+
+ err = try_create_as(user3_uid, user3_gid, 0644);
+ if (err) {
+ errno = err;
+ tst_res(TFAIL | TERRNO,
+ "ACL_USER with mask rwx should allow access");
+ return;
+ }
+
+ cleanup_testfile();
+
+ acl = acl_get_file(TESTDIR, ACL_TYPE_ACCESS);
+ if (!acl)
+ tst_brk(TBROK | TERRNO, "acl_get_file failed");
+
+ clear_acl_mask_perms(acl);
+ set_acl_file(TESTDIR, ACL_TYPE_ACCESS, acl);
+ safe_acl_free(acl);
+
+ err = try_create_as(user3_uid, user3_gid, 0644);
+ if (!err) {
+ cleanup_testfile();
+ tst_res(TFAIL, "ACL_USER with mask --- should deny access");
+ return;
+ }
+
+ if (err != EACCES) {
+ errno = err;
+ tst_res(TFAIL | TERRNO, "Expected EACCES from named user");
+ return;
+ }
+
+ tst_res(TPASS, "ACL_USER with mask works correctly");
+}
+
+/*
+ * Test ACL_GROUP permissions with mask.
+ * Named group permissions should be restricted by ACL_MASK.
+ */
+static void test_acl_group_with_mask(void)
+{
+ acl_t acl;
+ int err;
+
+ tst_res(TINFO, "Testing ACL_GROUP with mask");
+ reset_test_path();
+
+ acl = acl_init(5);
+ if (!acl)
+ tst_brk(TBROK | TERRNO, "acl_init failed");
+
+ add_acl_entry(acl, ACL_USER_OBJ,
+ ACL_READ | ACL_WRITE | ACL_EXECUTE);
+ add_empty_acl_entry(acl, ACL_GROUP_OBJ);
+ add_named_group_acl_entry(acl, user2_gid,
+ ACL_READ | ACL_WRITE | ACL_EXECUTE);
+ add_acl_entry(acl, ACL_MASK,
+ ACL_READ | ACL_WRITE | ACL_EXECUTE);
+ add_empty_acl_entry(acl, ACL_OTHER);
+
+ set_acl_file(TESTDIR, ACL_TYPE_ACCESS, acl);
+ safe_acl_free(acl);
+
+ err = try_create_as(user2_uid, user2_gid, 0644);
+ if (err) {
+ errno = err;
+ tst_res(TFAIL | TERRNO,
+ "ACL_GROUP with mask rwx should allow access");
+ return;
+ }
+
+ cleanup_testfile();
+
+ acl = acl_get_file(TESTDIR, ACL_TYPE_ACCESS);
+ if (!acl)
+ tst_brk(TBROK | TERRNO, "acl_get_file failed");
+
+ clear_acl_mask_perms(acl);
+ set_acl_file(TESTDIR, ACL_TYPE_ACCESS, acl);
+ safe_acl_free(acl);
+
+ err = try_create_as(user2_uid, user2_gid, 0644);
+ if (!err) {
+ cleanup_testfile();
+ tst_res(TFAIL, "ACL_GROUP with mask --- should deny access");
+ return;
+ }
+
+ if (err != EACCES) {
+ errno = err;
+ tst_res(TFAIL | TERRNO, "Expected EACCES from named group");
+ return;
+ }
+
+ tst_res(TPASS, "ACL_GROUP with mask works correctly");
+}
+
+/*
+ * Test ACL_GROUP_OBJ permissions with mask.
+ * Group owner permissions should be restricted by ACL_MASK.
+ */
+static void test_acl_group_obj_with_mask(void)
+{
+ acl_t acl;
+ int err;
+
+ tst_res(TINFO, "Testing ACL_GROUP_OBJ with mask");
+ reset_test_path();
+
+ SAFE_CHOWN(TESTDIR, user1_uid, user2_gid);
+
+ acl = acl_init(4);
+ if (!acl)
+ tst_brk(TBROK | TERRNO, "acl_init failed");
+
+ add_acl_entry(acl, ACL_USER_OBJ,
+ ACL_READ | ACL_WRITE | ACL_EXECUTE);
+ add_acl_entry(acl, ACL_GROUP_OBJ,
+ ACL_READ | ACL_WRITE | ACL_EXECUTE);
+ add_acl_entry(acl, ACL_MASK,
+ ACL_READ | ACL_WRITE | ACL_EXECUTE);
+ add_empty_acl_entry(acl, ACL_OTHER);
+
+ set_acl_file(TESTDIR, ACL_TYPE_ACCESS, acl);
+ safe_acl_free(acl);
+
+ err = try_create_as(user2_uid, user2_gid, 0644);
+ if (err) {
+ errno = err;
+ tst_res(TFAIL | TERRNO,
+ "ACL_GROUP_OBJ with mask rwx should allow access");
+ return;
+ }
+
+ cleanup_testfile();
+
+ acl = acl_get_file(TESTDIR, ACL_TYPE_ACCESS);
+ if (!acl)
+ tst_brk(TBROK | TERRNO, "acl_get_file failed");
+
+ clear_acl_mask_perms(acl);
+ set_acl_file(TESTDIR, ACL_TYPE_ACCESS, acl);
+ safe_acl_free(acl);
+
+ err = try_create_as(user2_uid, user2_gid, 0644);
+ if (!err) {
+ cleanup_testfile();
+ SAFE_CHOWN(TESTDIR, user1_uid, user1_gid);
+ tst_res(TFAIL,
+ "ACL_GROUP_OBJ with mask --- should deny access");
+ return;
+ }
+
+ if (err != EACCES) {
+ SAFE_CHOWN(TESTDIR, user1_uid, user1_gid);
+ errno = err;
+ tst_res(TFAIL | TERRNO, "Expected EACCES from group owner");
+ return;
+ }
+
+ SAFE_CHOWN(TESTDIR, user1_uid, user1_gid);
+ tst_res(TPASS, "ACL_GROUP_OBJ with mask works correctly");
+}
+
+static void setup(void)
+{
+ init_test_users();
+ reset_test_path();
+}
+
+static void cleanup(void)
+{
+ cleanup_test_paths();
+ cleanup_test_users();
+}
+
+static void run(unsigned int n)
+{
+ switch (n) {
+ case 0:
+ test_acl_user_with_mask();
+ break;
+ case 1:
+ test_acl_group_with_mask();
+ break;
+ case 2:
+ test_acl_group_obj_with_mask();
+ break;
+ }
+}
+
+static struct tst_test test = {
+ .test = run,
+ .tcnt = 3,
+ .setup = setup,
+ .cleanup = cleanup,
+ .needs_root = 1,
+ .mount_device = 1,
+ .mntpoint = MNTPOINT,
+ .forks_child = 1,
+ .filesystems = (struct tst_fs[]) {
+ {.type = "ext2", .mnt_data = "acl"},
+ {.type = "ext3", .mnt_data = "acl"},
+ {.type = "ext4", .mnt_data = "acl"},
+ {.type = "xfs"},
+ {.type = "btrfs"},
+ {}
+ },
+ .needs_cmds = (struct tst_cmd[]) {
+ {.cmd = "useradd"},
+ {.cmd = "userdel"},
+ {}
+ }
+};
+
+#else
+TST_TEST_TCONF("libacl or ACL headers are not available");
+#endif
--
2.39.1
More information about the ltp
mailing list