userns: relax the posix_acl_valid() checks
userns: relax the posix_acl_valid() checks

So far, POSIX ACLs are using a canonical representation that keeps all ACL
entries in a strict order; the ACL_USER and ACL_GROUP entries for specific
users and groups are ordered by user and group identifier, respectively.
The user-space code provides ACL entries in this order; the kernel
verifies that the ACL entry order is correct in posix_acl_valid().

User namespaces allow to arbitrary map user and group identifiers which
can cause the ACL_USER and ACL_GROUP entry order to differ between user
space and the kernel; posix_acl_valid() would then fail.

Work around this by allowing ACL_USER and ACL_GROUP entries to be in any
order in the kernel.  The effect is only minor: file permission checks
will pick the first matching ACL_USER entry, and check all matching
ACL_GROUP entries.

(The libacl user-space library and getfacl / setfacl tools will not create
ACLs with duplicate user or group idenfifiers; they will handle ACLs with
entries in an arbitrary order correctly.)

Signed-off-by: Andreas Gruenbacher <803c310a1424fde72669c00c857729354974bc9f@linbit.com>
Cc: Eric W. Biederman <8a741aa8cbd77ebc4a56ddb528ce9fd15d42f034@xmission.com>
Cc: Theodore Tso <4ed386e0495d3e109932df055831d9ec2f824927@mit.edu>
Cc: Christoph Hellwig <923f7720577207a44b32e59bbfbea59d27f1ae8e@infradead.org>
Cc: Andreas Dilger <4b4177fd4bee9a83af4b5e2a7acf92bd6a42897f@dilger.ca>
Cc: Jan Kara <596727c8a0ea4db3ba2ceceedccbacd3d7b371b8@suse.cz>
Cc: Al Viro <de609eb4d5d70b1d38ec6642adbfc33a2781f63c@zeniv.linux.org.uk>
Signed-off-by: Andrew Morton <5c1e68b099950c134891f0b6e179498a8ebe9cf9@linux-foundation.org>
Signed-off-by: Linus Torvalds <69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org>

KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs