Derive UNDER_ACL from local ancestry

Summary: Compute UNDER_ACL from local inode ancestry and direct hasACL metadata instead of issuing remote ACL lookups. VirtualInode now keeps the direct ACL bit separate from inherited ancestor state, computes UNDER_ACL from those two inputs, and keeps local ACL-info population limited to the known-negative case where the ACL list is known empty.

Reviewed By: muirdm

Differential Revision: D104246345

fbshipit-source-id: f3f7d06eccd961110edfaf301aec5fac41cb0932

Author: MichaelCuevas

eden/fs/config/EdenConfig.h

@@ -2601,6 +2601,15 @@ class EdenConfig : private ConfigSettingManager {
       300,
       this};
 
+  /**
+   * Whether EdenFS should compute UNDER_ACL and local empty ACL info from
+   * source-control tree ACL metadata.
+   */
+  ConfigSetting<bool> enableLocalUnderAclComputation{
+      "acl:enable-local-under-acl-computation",
+      true,
+      this};
+
 // [facebook]
 // Facebook internal
 

eden/fs/inodes/AclState.h

@@ -0,0 +1,45 @@
+/*
+ * Copyright (c) Meta Platforms, Inc. and affiliates.
+ *
+ * This software may be used and distributed according to the terms of the
+ * GNU General Public License version 2.
+ */
+
+#pragma once
+
+#include <optional>
+
+namespace facebook::eden {
+
+struct AclState {
+  std::optional<bool> ancestorUnderAcl;
+  std::optional<bool> hasACL;
+};
+
+inline std::optional<bool> mergeAncestorAclState(
+    std::optional<bool> ancestorUnderAcl,
+    std::optional<bool> hasACL) {
+  if (ancestorUnderAcl == true || hasACL == true) {
+    return true;
+  }
+  if (ancestorUnderAcl == false && hasACL == false) {
+    return false;
+  }
+  return std::nullopt;
+}
+
+inline AclState adjustRootAclState(
+    bool isRoot,
+    std::optional<bool> ancestorUnderAcl,
+    std::optional<bool> hasACL) {
+  if (!isRoot || ancestorUnderAcl == true) {
+    return {ancestorUnderAcl, hasACL};
+  }
+
+  if (hasACL != true) {
+    hasACL = false;
+  }
+  return {false, hasACL};
+}
+
+} // namespace facebook::eden

eden/fs/inodes/BUCK

@@ -101,6 +101,7 @@ cpp_library(
         "VirtualInode.cpp",
     ],
     headers = [
+        "AclState.h",
         "CacheHint.h",
         "CheckoutAction.h",
         "CheckoutContext.h",

eden/fs/inodes/ChildEntryAttributes.cpp

@@ -16,19 +16,23 @@ namespace facebook::eden {
 
 folly::coro::Task<EntryAttributes> coFetchEntryAttributesFromVI(
     VirtualInode v,
+    std::optional<bool> ancestorUnderAcl,
     EntryAttributeFlags reqAttrs,
     RelativePath sub,
     std::shared_ptr<ObjectStore> store,
     timespec checkoutTime,
     ObjectFetchContextPtr ctx) {
   co_await folly::coro::co_reschedule_on_current_executor;
+  v.inheritAclFromAncestor(ancestorUnderAcl);
   co_return co_await v.co_getEntryAttributes(
       reqAttrs, sub, store, checkoutTime, ctx);
 }
 
 folly::coro::Task<EntryAttributes> coFetchTreeEntryAttributes(
     ObjectId oid,
     mode_t mode,
+    std::optional<bool> hasACL,
+    std::optional<bool> ancestorUnderAcl,
     EntryAttributeFlags reqAttrs,
     RelativePath sub,
     std::shared_ptr<ObjectStore> store,
@@ -37,19 +41,23 @@ folly::coro::Task<EntryAttributes> coFetchTreeEntryAttributes(
   co_await folly::coro::co_reschedule_on_current_executor;
   auto t = co_await store->co_getTree(oid, ctx);
   VirtualInode v{std::move(t), mode};
+  v.setHasACL(hasACL);
+  v.inheritAclFromAncestor(ancestorUnderAcl);
   co_return co_await v.co_getEntryAttributes(
       reqAttrs, sub, store, checkoutTime, ctx);
 }
 
 folly::coro::Task<EntryAttributes> coFetchLoadedInodeEntryAttributes(
     folly::SemiFuture<InodePtr> loadFut,
+    std::optional<bool> ancestorUnderAcl,
     EntryAttributeFlags reqAttrs,
     RelativePath sub,
     std::shared_ptr<ObjectStore> store,
     timespec checkoutTime,
     ObjectFetchContextPtr ctx) {
   auto inode = co_await std::move(loadFut);
   VirtualInode v{std::move(inode)};
+  v.inheritAclFromAncestor(ancestorUnderAcl);
   co_return co_await v.co_getEntryAttributes(
       reqAttrs, sub, store, checkoutTime, ctx);
 }

eden/fs/inodes/ChildEntryAttributes.h

@@ -11,6 +11,7 @@
 #include <folly/futures/Future.h>
 #include <sys/types.h>
 #include <memory>
+#include <optional>
 
 #include "eden/common/utils/PathFuncs.h"
 #include "eden/fs/inodes/InodePtrFwd.h"
@@ -45,6 +46,7 @@ class ObjectStore;
  */
 folly::coro::Task<EntryAttributes> coFetchEntryAttributesFromVI(
     VirtualInode v,
+    std::optional<bool> ancestorUnderAcl,
     EntryAttributeFlags reqAttrs,
     RelativePath sub,
     std::shared_ptr<ObjectStore> store,
@@ -58,6 +60,8 @@ folly::coro::Task<EntryAttributes> coFetchEntryAttributesFromVI(
 folly::coro::Task<EntryAttributes> coFetchTreeEntryAttributes(
     ObjectId oid,
     mode_t mode,
+    std::optional<bool> hasACL,
+    std::optional<bool> ancestorUnderAcl,
     EntryAttributeFlags reqAttrs,
     RelativePath sub,
     std::shared_ptr<ObjectStore> store,
@@ -69,6 +73,7 @@ folly::coro::Task<EntryAttributes> coFetchTreeEntryAttributes(
  */
 folly::coro::Task<EntryAttributes> coFetchLoadedInodeEntryAttributes(
     folly::SemiFuture<InodePtr> loadFut,
+    std::optional<bool> ancestorUnderAcl,
     EntryAttributeFlags reqAttrs,
     RelativePath sub,
     std::shared_ptr<ObjectStore> store,

eden/fs/inodes/TreeInode.cpp

@@ -39,6 +39,7 @@
 #include "eden/fs/config/CheckoutConfig.h"
 #include "eden/fs/fuse/FuseChannel.h"
 #include "eden/fs/fuse/FuseDirList.h"
+#include "eden/fs/inodes/AclState.h"
 #include "eden/fs/inodes/CheckoutAction.h"
 #include "eden/fs/inodes/CheckoutContext.h"
 #include "eden/fs/inodes/ChildEntryAttributes.h"
@@ -595,9 +596,11 @@ std::optional<ImmediateFuture<VirtualInode>> TreeInode::rlockGetOrFindChild(
     // the id
     return getObjectStore()
         .getTree(entry.getObjectId(), context)
-        .thenValue([mode = entry.getInitialMode()](
+        .thenValue([mode = entry.getInitialMode(), hasACL = entry.hasACL()](
                        std::shared_ptr<const Tree>&& tree) {
-          return VirtualInode(std::move(tree), mode);
+          auto virtualInode = VirtualInode(std::move(tree), mode);
+          virtualInode.setHasACL(hasACL);
+          return virtualInode;
         });
   }
   // This is a file, return the DirEntry if this was the last
@@ -758,7 +761,8 @@ std::optional<VirtualInode> TreeInode::rlockCheckChild(
           entry.getInitialMode(),
           contents.entries.getCaseSensitivity());
     }
-    dirFetch = PendingDirFetch{entry.getObjectId(), entry.getInitialMode()};
+    dirFetch = PendingDirFetch{
+        entry.getObjectId(), entry.getInitialMode(), entry.hasACL()};
     return std::nullopt;
   }
   return VirtualInode{UnmaterializedUnloadedBlobDirEntry(entry)};
@@ -830,7 +834,9 @@ folly::coro::now_task<VirtualInode> TreeInode::co_getOrFindChild(
   // All locks released before suspension
   if (dirFetch.has_value()) {
     auto tree = co_await getObjectStore().co_getTree(dirFetch->treeId, context);
-    co_return VirtualInode(std::move(tree), dirFetch->mode);
+    auto virtualInode = VirtualInode(std::move(tree), dirFetch->mode);
+    virtualInode.setHasACL(dirFetch->hasACL);
+    co_return virtualInode;
   }
 
   auto inode = co_await std::move(loadFuture);
@@ -953,7 +959,9 @@ TreeInode::co_getChildren(
                     -> folly::coro::Task<VirtualInode> {
                   co_await folly::coro::co_reschedule_on_current_executor;
                   auto tree = co_await s->co_getTree(fetch.treeId, ctx);
-                  co_return VirtualInode{std::move(tree), fetch.mode};
+                  auto virtualInode = VirtualInode{std::move(tree), fetch.mode};
+                  virtualInode.setHasACL(fetch.hasACL);
+                  co_return virtualInode;
                 },
                 store,
                 *dirFetch,
@@ -997,7 +1005,8 @@ TreeInode::co_getChildrenAttributes(
     RelativePath path,
     const std::shared_ptr<ObjectStore>& objectStore,
     timespec lastCheckoutTime,
-    const ObjectFetchContextPtr& context) {
+    const ObjectFetchContextPtr& context,
+    std::optional<bool> ancestorUnderAcl) {
   auto self = inodePtrFromThis();
 
   if (FOLLY_UNLIKELY(isRestricted())) {
@@ -1022,6 +1031,10 @@ TreeInode::co_getChildrenAttributes(
     names.reserve(contents->entries.size());
     tasks.reserve(contents->entries.size());
     inodeLoadCleanUps.reserve(contents->entries.size());
+    auto adjusted = adjustRootAclState(
+        getNodeId() == kRootNodeId, ancestorUnderAcl, hasACL());
+    auto thisUnderAcl =
+        mergeAncestorAclState(adjusted.ancestorUnderAcl, adjusted.hasACL);
 
     for (const auto& [name, _entry] : contents->entries) {
       auto subPath = path + name;
@@ -1032,6 +1045,7 @@ TreeInode::co_getChildrenAttributes(
       if (sync.has_value()) {
         tasks.emplace_back(coFetchEntryAttributesFromVI(
             std::move(*sync),
+            thisUnderAcl,
             requestedAttributes,
             std::move(subPath),
             objectStore,
@@ -1041,6 +1055,8 @@ TreeInode::co_getChildrenAttributes(
         tasks.emplace_back(coFetchTreeEntryAttributes(
             dirFetch->treeId,
             dirFetch->mode,
+            dirFetch->hasACL,
+            thisUnderAcl,
             requestedAttributes,
             std::move(subPath),
             objectStore,
@@ -1052,6 +1068,7 @@ TreeInode::co_getChildrenAttributes(
         inodeLoadCleanUps.emplace_back(name, std::move(childResult.second));
         tasks.emplace_back(coFetchLoadedInodeEntryAttributes(
             std::move(childResult.first),
+            thisUnderAcl,
             requestedAttributes,
             std::move(subPath),
             objectStore,

eden/fs/inodes/TreeInode.h

@@ -223,7 +223,8 @@ class TreeInode final : public InodeBaseMetadata<DirContents> {
       RelativePath path,
       const std::shared_ptr<ObjectStore>& objectStore,
       timespec lastCheckoutTime,
-      const ObjectFetchContextPtr& context);
+      const ObjectFetchContextPtr& context,
+      std::optional<bool> ancestorUnderAcl = std::nullopt);
 
   /**
    * Get the inode object for a child of this directory.
@@ -1361,6 +1362,7 @@ class TreeInode final : public InodeBaseMetadata<DirContents> {
   struct PendingDirFetch {
     ObjectId treeId;
     mode_t mode{};
+    std::optional<bool> hasACL{std::nullopt};
   };
 
   std::optional<VirtualInode> rlockCheckChild(

eden/fs/inodes/UnmaterializedUnloadedBlobDirEntry.h

@@ -7,6 +7,8 @@
 
 #pragma once
 
+#include <optional>
+
 #include "eden/common/utils/DirType.h"
 #include "eden/fs/inodes/DirEntry.h"
 #include "eden/fs/model/ObjectId.h"
@@ -35,7 +37,7 @@ class UnmaterializedUnloadedBlobDirEntry {
       : objectId_(entry.getObjectId()),
         dtype_(entry.getDtype()),
         initialMode_(entry.getInitialMode()),
-        isRestricted_(entry.isRestricted()) {}
+        aclRootState_(entry.aclRootState()) {}
 
   UnmaterializedUnloadedBlobDirEntry(
       const UnmaterializedUnloadedBlobDirEntry&) = default;
@@ -67,14 +69,18 @@ class UnmaterializedUnloadedBlobDirEntry {
   }
 
   bool isRestricted() const {
-    return isRestricted_;
+    return aclRootState_ == AclRootState::RestrictedAclRoot;
+  }
+
+  std::optional<bool> hasACL() const {
+    return hasACLFromAclRootState(aclRootState_);
   }
 
  private:
   ObjectId objectId_;
   dtype_t dtype_;
   mode_t initialMode_;
-  bool isRestricted_ = false;
+  AclRootState aclRootState_{AclRootState::Unknown};
 };
 
 } // namespace facebook::eden