glusterfs access-control xlator function question

[jifengzhou]

Glusterfs implements ACL support through features/access-control xlator. I have a question. If brick is a folder created on the XFS file system, xfs itself supports ACL. Why do you need to handle ACL permissions at the Gluster layer? ? When the fop request reaches the XFS file processing, ACL permissions will also be judged. Is it unnecessary for gluster to make this ACL judgment in advance?
I hope everyone can help explain, thanks

[pranithk]

@jifengzhou It is actually in xlators/system/posix-acl directory. What you said may work for some xlators in some cases but not all. For example,

1. with shard xlator the base file will have all the permissions where as the actual file is split and spread across different bricks with root permissions.
2. with afr/ec the file may need heal in some cases and the file may not have the permissions it needs on the bad bricks until heal. So the operations will fail till then.

Loading acl on the client gives the comprehensive view of the file and what happens below that xlator doesn't matter to it. This makes things easier than to handle all the corner cases that can happen by sending the fop to the underlying filesystem like xfs/zfs.

[jifengzhou]

I see. Thank you very much