Repository navigation
Fix send:raw permission for send -w -I - #18198
Merged
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
Fixes delegated permission checks for raw incremental sends with intermediates (zfs send -w -I) so that send:raw is accepted (regression introduced by the send:raw delegation work).
Changes:
- Adjust
zfs_secpolicy_send()/zfs_secpolicy_send_new()to treatrawokas a truthy flag rather than requiringrawok == B_TRUE. - Extend
zfs_send_usertest.kshto cover-w -Ibehavior undersend:rawdelegation (and fix missing comment markers).
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
module/zfs/zfs_ioctl.c |
Fixes the permission fallback logic so raw-send delegation is honored when rawok isn’t strictly B_TRUE. |
tests/zfs-tests/tests/functional/cli_user/zfs_send_delegation_user/zfs_send_usertest.ksh |
Adds a regression test for incremental raw send with intermediates under delegated permissions. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
When performing an incremental raw send with intermediates (-w -I), the standard 'send' permission was incorrectly required instead of allowing 'send:raw'. This was due to a strict boolean comparison on the 'rawok' flag in zfs_secpolicy_send() with non-boolean value. This change normalizes the 'rawok' variable to be strictly 0/1 and updates the test suite to properly verify delegated raw send behavior. Fixes: openzfs#18193 Introduced-by: openzfs#17543 Signed-off-by: Marc Sladek <marc@sladek.dev>
msladek
force-pushed
the
fix-send-raw-delegation
branch
from
February 11, 2026 14:05
92670bb to
b8b2483
Compare
amotin
approved these changes
Feb 11, 2026
behlendorf
approved these changes
Feb 11, 2026
behlendorf
added
Status: Accepted
tonyhutter
pushed a commit
to tonyhutter/zfs
that referenced
this pull request
Feb 11, 2026
When performing an incremental raw send with intermediates (-w -I), the standard 'send' permission was incorrectly required instead of allowing 'send:raw'. This was due to a strict boolean comparison on the 'rawok' flag in zfs_secpolicy_send() with non-boolean value. This change normalizes the 'rawok' variable to be strictly 0/1 and updates the test suite to properly verify delegated raw send behavior. Introduced-by: openzfs#17543 Reviewed-by: Alexander Motin <alexander.motin@TrueNAS.com> Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Signed-off-by: Marc Sladek <marc@sladek.dev> Closes openzfs#18198 Closes openzfs#18193
lundman
pushed a commit
to openzfsonosx/openzfs-fork
that referenced
this pull request
Jul 30, 2026
When performing an incremental raw send with intermediates (-w -I), the standard 'send' permission was incorrectly required instead of allowing 'send:raw'. This was due to a strict boolean comparison on the 'rawok' flag in zfs_secpolicy_send() with non-boolean value. This change normalizes the 'rawok' variable to be strictly 0/1 and updates the test suite to properly verify delegated raw send behavior. Introduced-by: openzfs#17543 Reviewed-by: Alexander Motin <alexander.motin@TrueNAS.com> Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Signed-off-by: Marc Sladek <marc@sladek.dev> Closes openzfs#18198 Closes openzfs#18193
pull Bot
pushed a commit
to A-Archives-and-Forks/openzfs
that referenced
this pull request
Sep 26, 2026
When performing an incremental raw send with intermediates (-w -I), the standard 'send' permission was incorrectly required instead of allowing 'send:raw'. This was due to a strict boolean comparison on the 'rawok' flag in zfs_secpolicy_send() with non-boolean value. This change normalizes the 'rawok' variable to be strictly 0/1 and updates the test suite to properly verify delegated raw send behavior. Introduced-by: openzfs#17543 Reviewed-by: Alexander Motin <alexander.motin@TrueNAS.com> Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Signed-off-by: Marc Sladek <marc@sladek.dev> Closes openzfs#18198 Closes openzfs#18193
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation and Context
Fixes: #18193
Introduced-by: #17543
When performing an incremental raw send with intermediates (
-w -I),send:rawintroduced in 2.4.0 is not accepted. The code falls back to requiring send and denies the operation when onlysend:rawis delegated.Description
This change relaxes the comparison
rawok == B_TRUEto a standard truthy check inzfs_secpolicy_send/_new()and updateszfs_send_usertest.kshto also verify incremental raw send with intermediates behaviour. Also added missing comment markers in the test script.How Has This Been Tested?
zfs_send_usertest.kshwithout the fix to confirm reproduction of the "Permission denied" error.Types of changes
Checklist:
Signed-off-by.