POSIX acls over nfs4

Hi
Is it possible for nfs4 to respect the acls I have setup on an ext4 export? Thanks,
Steve

openSUSE 12.1

Signature · 3 lines

To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Quoted 10 lines · steve

Hi
Is it possible for nfs4 to respect the acls I have setup on an ext4 export? Thanks,
Steve

openSUSE 12.1

Signature · 3 lines

To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Sorry, this is what I've tried so far:
cat /etc/exports
/home *(rw,no_root_squash,sec=none:sys:krb5:krb5i:krb5p,no_subtree_check,insecure)

1. Make a folder to share:
hh3:/home/CACTUS # mkdir -m 770 dropbox
hh3:/home/CACTUS # chown root:suseusers dropbox

2. Mount the share:
hh3:/home/CACTUS # mount -t nfs4 hh3:/home /mnt

3. Look at the acls:
nfs4_getfacl /mnt/CACTUS/dropbox
A::OWNER@:rwaDxtTcCy
A::GROUP@:rwaDxtcy
A::EVERYONE@:tcy

Set an acl so that members of suseusers have rw on the share:
hh3:/home/CACTUS # nfs4_setfacl -a A:g:[email protected]:RW /mnt/CACTUS/dropbox

hh3:/home/CACTUS # nfs4_getfacl /mnt/CACTUS/dropbox/ A::OWNER@:rwaDxtTcCy
A::GROUP@:rwaDxtcy A:g:[email protected]:rwaDtcy A::EVERYONE@:tcy

4. Yes. Back in the unmounted directory, the acl + has appeared:
hh3:/home/CACTUS # ls -la dropbox/
total 8
drwxrwx---+ 2 root suseusers 4096 Feb 19 10:55 .
drwxr-xr-x 9 root root 4096 Feb 19 10:55 ..

5. On the mounted share, the acl is not visible. steve6 can create a file but it is _not_ group rw:
steve6@hh3:~> cd /mnt/CACTUS/dropbox/
steve6@hh3:/mnt/CACTUS/dropbox> touch hola.txt
steve6@hh3:/mnt/CACTUS/dropbox> ls -la
total 8
drwxrwx--- 2 root suseusers 4096 Feb 19 11:02 .
drwxr-xr-x 9 root root 4096 Feb 19 10:55 ..
-rw-r--r-- 1 steve6 suseusers 0 Feb 19 11:02 hola.txt

6. Recreate the share but this time with a posix acl:
setfacl -d -m g::rw /home/CACTUS/dropbox steve6@hh3:/home/CACTUS> touch dropbox/h steve6@hh3:/home/CACTUS> ls -la dropbox/ total 8
drwxrws---+ 2 root suseusers 4096 Feb 19 11:13 .
drwxr-xr-x 9 root root 4096 Feb 19 11:11 ..
-rw-rw---- 1 steve6 suseusers 0 Feb 19 11:13 h

Yes. Now when steve6 creates a file it _is_ group rw. = posix acl is working.

7. Mount the new posix share and test again:
hh3:/home/CACTUS #chmod g+s /home/CACTUS/dropbox hh3:/home/CACTUS # mount -t nfs4 hh3:/home /mnt hh3:/home/CACTUS # nfs4_getfacl /mnt/CACTUS/dropbox/ A::OWNER@:rwaDxtTcCy
A::GROUP@:rwaDxtcy
A::EVERYONE@:tcy
A:fdi:OWNER@:rwaDxtTcCy
A:fdi:GROUP@:rwaDtcy
A:fdi:EVERYONE@:tcy

steve6@hh3:/mnt/CACTUS/dropbox> touch h2
steve6@hh3:/mnt/CACTUS/dropbox> ls -la
total 8
drwxrws--- 2 root suseusers 4096 Feb 19 11:19 .
drwxr-xr-x 9 root root 4096 Feb 19 11:11 ..

(quoted diff) +0 -2

-rw-rw---- 1 steve6 suseusers    0 Feb 19 11:13 h
-rw-r----- 1 steve6 suseusers    0 Feb 19 11:19 h2

hh3:/home/CACTUS # nfs4_getfacl /mnt/CACTUS/dropbox/
A::OWNER@:rwaDxtTcCy
A::GROUP@:rwaDxtcy
A::EVERYONE@:tcy
A:fdi:OWNER@:rwaDxtTcCy
A:fdi:GROUP@:rwaDtcy
A:fdi:EVERYONE@:tcy
hh3:/home/CACTUS # nfs4_setfacl -a A:fdi:GROUP@:RWX /mnt/CACTUS/dropboxhh3:/home/CACTUS # nfs4_getfacl /mnt/CACTUS/dropbox/ A::OWNER@:rwaDxtTcCy
A::GROUP@:rwaDxtcy
A::EVERYONE@:tcy
A:fdi:OWNER@:rwaDxtTcCy
A:fdi:GROUP@:rwaDxtcy
A:fdi:EVERYONE@:tcy

steve6@hh3:/mnt/CACTUS/dropbox> touch h3
steve6@hh3:/mnt/CACTUS/dropbox> ls -la
total 8
drwxrws--- 2 root suseusers 4096 Feb 19 11:21 .
drwxr-xr-x 9 root root 4096 Feb 19 11:11 ..

(quoted diff) +0 -3

-rw-rw---- 1 steve6 suseusers    0 Feb 19 11:13 h
-rw-r----- 1 steve6 suseusers    0 Feb 19 11:19 h2
-rw-r----- 1 steve6 suseusers    0 Feb 19 11:21 h3

Still no group rw on created files. = nfs4 acl is not working as expected.

Workaround. Get the out the big hammer:
#!/bin/sh
while true; do $(chmod -R g+w /home/CACTUS/dropbox); sleep 2; done

Question:
What am I missing? How do I set files created on an nfs4 share to take group rw?

Thanks,
Steve

Signature · 3 lines

To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Quoted 6 lines

-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of steve
Sent: Thursday, February 23, 2012 3:15 PM
To: [email protected]
Subject: Re: POSIX acls over nfs4

Quoted 3 lines

Hi everyone
I'm sorry to bump this but I've tried the opensuse, ubuntu and samba lists without any luck.

Not reading the details in your setup, but maybe following summary can help you a bit.
http://www.suse.de/~agruen/acl/linux-acls/online/

Cheers,
Tao

Hi everyone
I'm sorry to bump this but I've tried the opensuse, ubuntu and samba lists without any luck.

The acls I have created are not inherited when exporting via nfs4. Can anyone help me with this? Tell me it can/can't be done? Versions of nfs to use? Details below.
Thanks,
Steve

Quoted 118 lines · steve

Quoted 11 lines

Hi
Is it possible for nfs4 to respect the acls I have setup on an ext4 export?
Thanks,
Steve

openSUSE 12.1

Signature · 3 lines

To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Sorry, this is what I've tried so far:
cat /etc/exports
/home *(rw,no_root_squash,sec=none:sys:krb5:krb5i:krb5p,no_subtree_check,insecure)

1. Make a folder to share:
hh3:/home/CACTUS # mkdir -m 770 dropbox
hh3:/home/CACTUS # chown root:suseusers dropbox

2. Mount the share:
hh3:/home/CACTUS # mount -t nfs4 hh3:/home /mnt

3. Look at the acls:
nfs4_getfacl /mnt/CACTUS/dropbox
A::OWNER@:rwaDxtTcCy
A::GROUP@:rwaDxtcy
A::EVERYONE@:tcy

Set an acl so that members of suseusers have rw on the share:
hh3:/home/CACTUS # nfs4_setfacl -a A:g:[email protected]:RW /mnt/CACTUS/dropbox

hh3:/home/CACTUS # nfs4_getfacl /mnt/CACTUS/dropbox/ A::OWNER@:rwaDxtTcCy
A::GROUP@:rwaDxtcy A:g:[email protected]:rwaDtcy A::EVERYONE@:tcy

4. Yes. Back in the unmounted directory, the acl + has appeared:
hh3:/home/CACTUS # ls -la dropbox/
total 8
drwxrwx---+ 2 root suseusers 4096 Feb 19 10:55 .
drwxr-xr-x 9 root root 4096 Feb 19 10:55 ..

5. On the mounted share, the acl is not visible. steve6 can create a file but it is _not_ group rw:
steve6@hh3:~> cd /mnt/CACTUS/dropbox/ steve6@hh3:/mnt/CACTUS/dropbox> touch hola.txt steve6@hh3:/mnt/CACTUS/dropbox> ls -la
total 8
drwxrwx--- 2 root suseusers 4096 Feb 19 11:02 .
drwxr-xr-x 9 root root 4096 Feb 19 10:55 ..
-rw-r--r-- 1 steve6 suseusers 0 Feb 19 11:02 hola.txt

6. Recreate the share but this time with a posix acl:
setfacl -d -m g::rw /home/CACTUS/dropbox steve6@hh3:/home/CACTUS> touch dropbox/h steve6@hh3:/home/CACTUS> ls -la dropbox/ total 8
drwxrws---+ 2 root suseusers 4096 Feb 19 11:13 .
drwxr-xr-x 9 root root 4096 Feb 19 11:11 ..
-rw-rw---- 1 steve6 suseusers 0 Feb 19 11:13 h

Yes. Now when steve6 creates a file it _is_ group rw. = posix acl is working.

7. Mount the new posix share and test again:
hh3:/home/CACTUS #chmod g+s /home/CACTUS/dropbox hh3:/home/CACTUS # mount -t nfs4 hh3:/home /mnt hh3:/home/CACTUS # nfs4_getfacl /mnt/CACTUS/dropbox/ A::OWNER@:rwaDxtTcCy
A::GROUP@:rwaDxtcy
A::EVERYONE@:tcy
A:fdi:OWNER@:rwaDxtTcCy
A:fdi:GROUP@:rwaDtcy
A:fdi:EVERYONE@:tcy

steve6@hh3:/mnt/CACTUS/dropbox> touch h2
steve6@hh3:/mnt/CACTUS/dropbox> ls -la
total 8
drwxrws--- 2 root suseusers 4096 Feb 19 11:19 .
drwxr-xr-x 9 root root 4096 Feb 19 11:11 ..

(quoted diff) +0 -2

-rw-rw---- 1 steve6 suseusers    0 Feb 19 11:13 h
-rw-r----- 1 steve6 suseusers    0 Feb 19 11:19 h2

hh3:/home/CACTUS # nfs4_getfacl /mnt/CACTUS/dropbox/ A::OWNER@:rwaDxtTcCy
A::GROUP@:rwaDxtcy
A::EVERYONE@:tcy
A:fdi:OWNER@:rwaDxtTcCy
A:fdi:GROUP@:rwaDtcy
A:fdi:EVERYONE@:tcy
hh3:/home/CACTUS # nfs4_setfacl -a A:fdi:GROUP@:RWX /mnt/CACTUS/dropboxhh3:/home/CACTUS # nfs4_getfacl /mnt/CACTUS/dropbox/ A::OWNER@:rwaDxtTcCy
A::GROUP@:rwaDxtcy
A::EVERYONE@:tcy
A:fdi:OWNER@:rwaDxtTcCy
A:fdi:GROUP@:rwaDxtcy
A:fdi:EVERYONE@:tcy

steve6@hh3:/mnt/CACTUS/dropbox> touch h3
steve6@hh3:/mnt/CACTUS/dropbox> ls -la
total 8
drwxrws--- 2 root suseusers 4096 Feb 19 11:21 .
drwxr-xr-x 9 root root 4096 Feb 19 11:11 ..

(quoted diff) +0 -3

-rw-rw---- 1 steve6 suseusers    0 Feb 19 11:13 h
-rw-r----- 1 steve6 suseusers    0 Feb 19 11:19 h2
-rw-r----- 1 steve6 suseusers    0 Feb 19 11:21 h3

Still no group rw on created files. = nfs4 acl is not working as expected.

Workaround. Get the out the big hammer:
#!/bin/sh
while true; do $(chmod -R g+w /home/CACTUS/dropbox); sleep 2; done

Quoted 11 lines

Question:
What am I missing? How do I set files created on an nfs4 share to take group rw?

Thanks,
Steve

Signature · 3 lines

To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Quoted 11 lines · On Thu, 23 Feb 2012 08:15:26 +0100 steve<[email protected]> wrote:

Hi everyone
I'm sorry to bump this but I've tried the opensuse, ubuntu and samba lists without any luck.

The acls I have created are not inherited when exporting via nfs4. Can anyone help me with this? Tell me it can/can't be done? Versions of nfs to use? Details below.
Thanks,
Steve

The NFSv4 protocol does not support POSIX ACLs. It has its own implementation of ACLs that is much more windows-like (yet not exactly either).

For enforcement, it doesn't really matter too much -- the server enforces POSIX ACLs since that's done within the VFS and local filesystem. The only "problem" is that you can't see and manipulate ACLs directly over NFSv4 using standard POSIX acl tools.

You can view and manipulate NFSv4 ACLs using the programs in the nfs4-acl-tools package. Linux' nfsd will map those to/from POSIX ACLs but it's always going to be a lossy mapping.

There are also patches in progress to add the ability for Linux filesystems to support NFSv4/Windows ACLs natively. That effort is called RichACLs, but it's not in mainline yet, and development on it seems to have stalled of late.

Quoted 134 lines · steve

Quoted 118 lines · steve

Quoted 11 lines

Hi
Is it possible for nfs4 to respect the acls I have setup on an ext4 export?
Thanks,
Steve

openSUSE 12.1

Signature · 3 lines

To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Sorry, this is what I've tried so far:
cat /etc/exports
/home *(rw,no_root_squash,sec=none:sys:krb5:krb5i:krb5p,no_subtree_check,insecure)

1. Make a folder to share:
hh3:/home/CACTUS # mkdir -m 770 dropbox
hh3:/home/CACTUS # chown root:suseusers dropbox

2. Mount the share:
hh3:/home/CACTUS # mount -t nfs4 hh3:/home /mnt

3. Look at the acls:
nfs4_getfacl /mnt/CACTUS/dropbox
A::OWNER@:rwaDxtTcCy
A::GROUP@:rwaDxtcy
A::EVERYONE@:tcy

Set an acl so that members of suseusers have rw on the share:
hh3:/home/CACTUS # nfs4_setfacl -a A:g:[email protected]:RW /mnt/CACTUS/dropbox

hh3:/home/CACTUS # nfs4_getfacl /mnt/CACTUS/dropbox/ A::OWNER@:rwaDxtTcCy
A::GROUP@:rwaDxtcy A:g:[email protected]:rwaDtcy A::EVERYONE@:tcy

4. Yes. Back in the unmounted directory, the acl + has appeared:
hh3:/home/CACTUS # ls -la dropbox/
total 8
drwxrwx---+ 2 root suseusers 4096 Feb 19 10:55 .
drwxr-xr-x 9 root root 4096 Feb 19 10:55 ..

5. On the mounted share, the acl is not visible. steve6 can create a file but it is _not_ group rw:
steve6@hh3:~> cd /mnt/CACTUS/dropbox/ steve6@hh3:/mnt/CACTUS/dropbox> touch hola.txt steve6@hh3:/mnt/CACTUS/dropbox> ls -la
total 8
drwxrwx--- 2 root suseusers 4096 Feb 19 11:02 .
drwxr-xr-x 9 root root 4096 Feb 19 10:55 ..
-rw-r--r-- 1 steve6 suseusers 0 Feb 19 11:02 hola.txt

6. Recreate the share but this time with a posix acl:
setfacl -d -m g::rw /home/CACTUS/dropbox steve6@hh3:/home/CACTUS> touch dropbox/h steve6@hh3:/home/CACTUS> ls -la dropbox/ total 8
drwxrws---+ 2 root suseusers 4096 Feb 19 11:13 .
drwxr-xr-x 9 root root 4096 Feb 19 11:11 ..
-rw-rw---- 1 steve6 suseusers 0 Feb 19 11:13 h

Yes. Now when steve6 creates a file it _is_ group rw. = posix acl is working.

7. Mount the new posix share and test again:
hh3:/home/CACTUS #chmod g+s /home/CACTUS/dropbox hh3:/home/CACTUS # mount -t nfs4 hh3:/home /mnt hh3:/home/CACTUS # nfs4_getfacl /mnt/CACTUS/dropbox/ A::OWNER@:rwaDxtTcCy
A::GROUP@:rwaDxtcy
A::EVERYONE@:tcy
A:fdi:OWNER@:rwaDxtTcCy
A:fdi:GROUP@:rwaDtcy
A:fdi:EVERYONE@:tcy

steve6@hh3:/mnt/CACTUS/dropbox> touch h2
steve6@hh3:/mnt/CACTUS/dropbox> ls -la
total 8
drwxrws--- 2 root suseusers 4096 Feb 19 11:19 .
drwxr-xr-x 9 root root 4096 Feb 19 11:11 ..

(quoted diff) +0 -2

-rw-rw---- 1 steve6 suseusers    0 Feb 19 11:13 h
-rw-r----- 1 steve6 suseusers    0 Feb 19 11:19 h2

hh3:/home/CACTUS # nfs4_getfacl /mnt/CACTUS/dropbox/ A::OWNER@:rwaDxtTcCy
A::GROUP@:rwaDxtcy
A::EVERYONE@:tcy
A:fdi:OWNER@:rwaDxtTcCy
A:fdi:GROUP@:rwaDtcy
A:fdi:EVERYONE@:tcy
hh3:/home/CACTUS # nfs4_setfacl -a A:fdi:GROUP@:RWX /mnt/CACTUS/dropboxhh3:/home/CACTUS # nfs4_getfacl /mnt/CACTUS/dropbox/ A::OWNER@:rwaDxtTcCy
A::GROUP@:rwaDxtcy
A::EVERYONE@:tcy
A:fdi:OWNER@:rwaDxtTcCy
A:fdi:GROUP@:rwaDxtcy
A:fdi:EVERYONE@:tcy

steve6@hh3:/mnt/CACTUS/dropbox> touch h3
steve6@hh3:/mnt/CACTUS/dropbox> ls -la
total 8
drwxrws--- 2 root suseusers 4096 Feb 19 11:21 .
drwxr-xr-x 9 root root 4096 Feb 19 11:11 ..

(quoted diff) +0 -3

-rw-rw---- 1 steve6 suseusers    0 Feb 19 11:13 h
-rw-r----- 1 steve6 suseusers    0 Feb 19 11:19 h2
-rw-r----- 1 steve6 suseusers    0 Feb 19 11:21 h3

Still no group rw on created files. = nfs4 acl is not working as expected.

Workaround. Get the out the big hammer:
#!/bin/sh
while true; do $(chmod -R g+w /home/CACTUS/dropbox); sleep 2; done

Quoted 11 lines

Question:
What am I missing? How do I set files created on an nfs4 share to take group rw?

Thanks,
Steve

Signature · 3 lines

To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Hi Jeff
Thanks for the reply. I'm trying to make the files created in a share take on group rw.

The trouble is that I've already tried setting the acl's via nfs4_setfacl on the mounted share too (please see details below). The acl + appears on the unmounted share and behaves as expected even when it is not mounted. The mounted share however ignores the acl I've set. I've tried remounting but still no acl is effective. My workaround is to scan the folder and change the files to group rw every few seconds.

Quoted 11 lines · steve

Hi Jeff
Thanks for the reply. I'm trying to make the files created in a share take on group rw.

The trouble is that I've already tried setting the acl's via nfs4_setfacl on the mounted share too (please see details below). The acl + appears on the unmounted share and behaves as expected even when it is not mounted. The mounted share however ignores the acl I've set. I've tried remounting but still no acl is effective. My workaround is to scan the folder and change the files to group rw every few seconds.

Without looking at your details, apologies:

First, if you want an ace on a directory to be inherited by files and directories created under that directory, make sure you're setting the f and d flags (see nfs4_getfacl -H).

Second, there's a umask problem: posix acl inheritance overrides the umask, but nfs4 acl inheritance isn't doing that. (The client combines the create mode and the umask and sets both together, there's no way for the server to even tell what the umask is.)

(We should do something about this if we can: maybe modifying the client to scan the directory acl for any inheritable aces and leaving out the umask if they're found? It has the obvious race, but I seem to recall we live with that in the v3 case. Or maybe there's something more clever, but this comes up every now and then and I can't remember a better solution.)

--b.

Quoted 23 lines · J. Bruce Fields

Quoted 11 lines · steve

Hi Jeff
Thanks for the reply. I'm trying to make the files created in a share take on group rw.

The trouble is that I've already tried setting the acl's via nfs4_setfacl on the mounted share too (please see details below). The acl + appears on the unmounted share and behaves as expected even when it is not mounted. The mounted share however ignores the acl I've set. I've tried remounting but still no acl is effective. My workaround is to scan the folder and change the files to group rw every few seconds.

Without looking at your details, apologies:

First, if you want an ace on a directory to be inherited by files and directories created under that directory, make sure you're setting the f and d flags (see nfs4_getfacl -H).

Second, there's a umask problem: posix acl inheritance overrides the umask, but nfs4 acl inheritance isn't doing that. (The client combines the create mode and the umask and sets both together, there's no way for the server to even tell what the umask is.)

Quoted 8 lines

(We should do something about this if we can: maybe modifying the client to scan the directory acl for any inheritable aces and leaving out the umask if they're found? It has the obvious race, but I seem to recall we live with that in the v3 case. Or maybe there's something more clever, but this comes up every now and then and I can't remember a better solution.)

--b.

Hi again
I have this:
nfs4_getfacl /mnt/CACTUS/dropbox/

A::OWNER@:rwaDxtTcCy
A::GROUP@:rwaDxtcy
A::EVERYONE@:tcy
A:fdi:OWNER@:rwaDxtTcCy
A:fdi:GROUP@:rwaDtcy
A:fdi:EVERYONE@:tcy

but files are created:
steve6@hh3:/mnt/CACTUS/dropbox> touch h3
ls -la
total 8
drwxrws--- 2 root suseusers 4096 Feb 19 11:21 .
drwxr-xr-x 9 root root 4096 Feb 19 11:11 ..

(quoted diff) +0 -2

-rw-rw---- 1 steve6 suseusers    0 Feb 19 11:13 h
-rw-r----- 1 steve6 suseusers    0 Feb 19 11:21 h3

where h is a file created on the unmounted share and h3 on the nfs4 mounted share. IOW the file created does not have group rw. Ahhgghh!!

Can anyone see anything wrong?

Thanks so much for your patience.
Steve.

Quoted 52 lines · steve

Quoted 23 lines · J. Bruce Fields

Quoted 11 lines · steve

Hi Jeff
Thanks for the reply. I'm trying to make the files created in a share take on group rw.

The trouble is that I've already tried setting the acl's via nfs4_setfacl on the mounted share too (please see details below). The acl + appears on the unmounted share and behaves as expected even when it is not mounted. The mounted share however ignores the acl I've set. I've tried remounting but still no acl is effective. My workaround is to scan the folder and change the files to group rw every few seconds.

Without looking at your details, apologies:

First, if you want an ace on a directory to be inherited by files and directories created under that directory, make sure you're setting the f and d flags (see nfs4_getfacl -H).

Second, there's a umask problem: posix acl inheritance overrides the umask, but nfs4 acl inheritance isn't doing that. (The client combines the create mode and the umask and sets both together, there's no way for the server to even tell what the umask is.)

Quoted 8 lines

(We should do something about this if we can: maybe modifying the client to scan the directory acl for any inheritable aces and leaving out the umask if they're found? It has the obvious race, but I seem to recall we live with that in the v3 case. Or maybe there's something more clever, but this comes up every now and then and I can't remember a better solution.)

--b.

Hi again
I have this:
nfs4_getfacl /mnt/CACTUS/dropbox/

A::OWNER@:rwaDxtTcCy
A::GROUP@:rwaDxtcy
A::EVERYONE@:tcy
A:fdi:OWNER@:rwaDxtTcCy
A:fdi:GROUP@:rwaDtcy
A:fdi:EVERYONE@:tcy

but files are created:
steve6@hh3:/mnt/CACTUS/dropbox> touch h3
ls -la
total 8
drwxrws--- 2 root suseusers 4096 Feb 19 11:21 .
drwxr-xr-x 9 root root 4096 Feb 19 11:11 ..

(quoted diff) +0 -2

-rw-rw---- 1 steve6 suseusers    0 Feb 19 11:13 h
-rw-r----- 1 steve6 suseusers    0 Feb 19 11:21 h3

Quoted 3 lines

where h is a file created on the unmounted share and h3 on the nfs4 mounted share. IOW the file created does not have group rw. Ahhgghh!!

Right, so see the second point above: what's your umask? (output of the "umask" command.)

--b.

Quoted 5 lines

Can anyone see anything wrong?

Thanks so much for your patience.
Steve.

Quoted 11 lines · J. Bruce Fields

Quoted 11 lines

Quoted 11 lines

First, if you want an ace on a directory to be inherited by files and directories created under that directory, make sure you're setting the f
and d flags (see nfs4_getfacl -H).

Second, there's a umask problem: posix acl inheritance overrides the umask, but nfs4 acl inheritance isn't doing that. (The client combines the create mode and the umask and sets both together, there's no way for
the server to even tell what the umask is.)

Quoted 8 lines

Quoted 8 lines

Quoted 8 lines

(We should do something about this if we can: maybe modifying the client
to scan the directory acl for any inheritable aces and leaving out the umask if they're found? It has the obvious race, but I seem to recall we live with that in the v3 case. Or maybe there's something more clever, but this comes up every now and then and I can't remember a better solution.)

Quoted 12 lines · steve

Quoted 11 lines · J. Bruce Fields

Quoted 11 lines

Quoted 11 lines

First, if you want an ace on a directory to be inherited by files and directories created under that directory, make sure you're setting the f
and d flags (see nfs4_getfacl -H).

Second, there's a umask problem: posix acl inheritance overrides the umask, but nfs4 acl inheritance isn't doing that. (The client combines the create mode and the umask and sets both together, there's no way for
the server to even tell what the umask is.)

Quoted 8 lines

Quoted 8 lines

Quoted 8 lines

Quoted 8 lines

(We should do something about this if we can: maybe modifying the client
to scan the directory acl for any inheritable aces and leaving out the umask if they're found? It has the obvious race, but I seem to recall we live with that in the v3 case. Or maybe there's something more clever, but this comes up every now and then and I can't remember a better solution.)

Hi everyone

This really is a show stopper for us.

Would it be possible to give users the choice of being able to disable nfs4 acls so we can fall back to POSIX or nt acls? Or at least until the nfs4 team have had time to consider the situation?

Mounting with -o nofacl in the hope that the POSIX acl set on the unmounted directory would take effect, seems to have no effect.

What I'm doing at the moment is scanning the unmounted directory every few seconds using 'find' and changing the files to g+rw:-(

Thanks,
Steve
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Quoted 23 lines · steve

Quoted 12 lines · steve

Quoted 11 lines · J. Bruce Fields

Quoted 11 lines

Quoted 11 lines

First, if you want an ace on a directory to be inherited by files and directories created under that directory, make sure you're setting the f
and d flags (see nfs4_getfacl -H).

Second, there's a umask problem: posix acl inheritance overrides the umask, but nfs4 acl inheritance isn't doing that. (The client combines the create mode and the umask and sets both together, there's no way for
the server to even tell what the umask is.)

Quoted 8 lines

Quoted 8 lines

Quoted 8 lines

Quoted 8 lines

(We should do something about this if we can: maybe modifying the client
to scan the directory acl for any inheritable aces and leaving out the umask if they're found? It has the obvious race, but I seem to recall we live with that in the v3 case. Or maybe there's something more clever, but this comes up every now and then and I can't remember a better solution.)

Hi everyone

Quoted 5 lines

This really is a show stopper for us.

Would it be possible to give users the choice of being able to disable nfs4 acls so we can fall back to POSIX or nt acls? Or at least until the nfs4 team have had time to consider the situation?

The NFSv4 protocol has no support for posix acls, so this isn't an option; possibly you're best off with v3 for some reason. (Why the migration to v4?)

--b.

Quoted 12 lines

Mounting with -o nofacl in the hope that the POSIX acl set on the unmounted directory would take effect, seems to have no effect.

What I'm doing at the moment is scanning the unmounted directory every few seconds using 'find' and changing the files to g+rw:-(

Thanks,
Steve
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

We are authenticating against Samba4, so our domain user accounts are under Kerberos.

We could wait for the s4 cifs fileserver and
winbind to be ready but would rather stick with nfs for our Linux clients. Simple reason being that it beats cifs on speed, especially when the lan is busy.

Is there an option to turn off the nfs4 acl's? I see that there is a -o noacl mount option but it seems to have no effect for us.

Guys, basically we don't know where to turn next. We have this issue open here, and on the samba and openSUSE lists. Is there anyway we can get together to thrash this out?

Thanks so much for replying.
Cheers,
Steve pp the Spanish team at lcb

Quoted 15 lines

--b.

Quoted 12 lines

Mounting with -o nofacl in the hope that the POSIX acl set on the unmounted directory would take effect, seems to have no effect.

What I'm doing at the moment is scanning the unmounted directory every few seconds using 'find' and changing the files to g+rw:-(

Thanks,
Steve
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Quoted 2 lines · steve

We are authenticating against Samba4, so our domain user accounts are under Kerberos.

Kerberos works fine with v3.

--b.

Quoted 4 lines · J. Bruce Fields

Quoted 2 lines · steve

We are authenticating against Samba4, so our domain user accounts are under Kerberos.

Quoted 3 lines

Kerberos works fine with v3.

--b.

Hi
Unfortunately, it doesn't seem to. We just tried it, and anyone (with or without a ticket) gets access:-(

Quoted 6 lines · steve

Quoted 5 lines · J. Bruce Fields

Quoted 2 lines · steve

We are authenticating against Samba4, so our domain user accounts are under Kerberos.

Kerberos works fine with v3.

Quoted 4 lines

Quoted 1 line

--b.

Hi
Unfortunately, it doesn't seem to. We just tried it, and anyone (with or without a ticket) gets access:-(

Could you give any more detail about your test?

--b.

Quoted 7 lines · J. Bruce Fields

Quoted 6 lines · steve

Quoted 5 lines · J. Bruce Fields

Quoted 2 lines · steve

We are authenticating against Samba4, so our domain user accounts are under Kerberos.

Kerberos works fine with v3.

Quoted 7 lines

Quoted 4 lines

Quoted 1 line

--b.

Hi
Unfortunately, it doesn't seem to. We just tried it, and anyone (with or without a ticket) gets access:-(

Could you give any more detail about your test?

--b.

steve is a /etc/passwd user

steve@hh3:~$ sudo su
[sudo] password for steve:
root@hh3:/home/steve# mount -t nfs4 hh3:/home /mnt -o sec=krb5
root@hh3:/home/steve# exit
exit
steve@hh3:~$ cd /mnt
bash: cd: /mnt: Permission denied
steve@hh3:~$ sudo su
root@hh3:/home/steve# umount /mnt
root@hh3:/home/steve# mount -t nfs hh3:/home /mnt -o sec=krb5
root@hh3:/home/steve# exit
exit
steve@hh3:~$ cd /mnt
steve@hh3:/mnt$

Quoted 17 lines · steve

Quoted 7 lines · J. Bruce Fields

Quoted 6 lines · steve

Quoted 5 lines · J. Bruce Fields

Quoted 2 lines · steve

We are authenticating against Samba4, so our domain user accounts are under Kerberos.

Kerberos works fine with v3.

Quoted 7 lines

Quoted 4 lines

Quoted 1 line

--b.

Hi
Unfortunately, it doesn't seem to. We just tried it, and anyone (with or without a ticket) gets access:-(

Could you give any more detail about your test?

--b.

steve is a /etc/passwd user

Quoted 14 lines

steve@hh3:~$ sudo su
[sudo] password for steve:
root@hh3:/home/steve# mount -t nfs4 hh3:/home /mnt -o sec=krb5
root@hh3:/home/steve# exit
exit
steve@hh3:~$ cd /mnt
bash: cd: /mnt: Permission denied
steve@hh3:~$ sudo su
root@hh3:/home/steve# umount /mnt
root@hh3:/home/steve# mount -t nfs hh3:/home /mnt -o sec=krb5
root@hh3:/home/steve# exit
exit
steve@hh3:~$ cd /mnt
steve@hh3:/mnt$

Why is that a problem? You haven't actually accessed anything on the filesystem.

--b.

Quoted 18 lines · J. Bruce Fields

Quoted 17 lines · steve

Quoted 7 lines · J. Bruce Fields

Quoted 6 lines · steve

Quoted 5 lines · J. Bruce Fields

Quoted 2 lines · steve

We are authenticating against Samba4, so our domain user accounts are under Kerberos.

Kerberos works fine with v3.

Quoted 7 lines

Quoted 4 lines

Quoted 1 line

--b.

Hi
Unfortunately, it doesn't seem to. We just tried it, and anyone (with or without a ticket) gets access:-(

Could you give any more detail about your test?

--b.

steve is a /etc/passwd user

Quoted 10 lines

Quoted 10 lines

steve@hh3:~$ sudo su
[sudo] password for steve:
root@hh3:/home/steve# mount -t nfs4 hh3:/home /mnt -o sec=krb5
root@hh3:/home/steve# exit
exit
steve@hh3:~$ cd /mnt
bash: cd: /mnt: Permission denied
steve@hh3:~$ sudo su
root@hh3:/home/steve# umount /mnt
root@hh3:/home/steve# mount -t nfs hh3:/home /mnt -o sec=krb5

Quoted 8 lines

Quoted 4 lines

root@hh3:/home/steve# exit
exit
steve@hh3:~$ cd /mnt
steve@hh3:/mnt$

Why is that a problem? You haven't actually accessed anything on the filesystem.

--b.

Steve can access the mounted folder. I can live with that but the acl still isn't working:

lynn2 has authinticated by Kerberos

root@hh3:~# setfacl -d -m g::rw /home/CACTUS/dropbox
root@hh3:~# mount -t nfs hh3:/home /mnt -o sec=krb5
lynn2@hh3:/mnt/CACTUS$ ls -la
total 28
drwxr-xr-x  6 root   root         4096 2012-02-27 14:24 .
drwxr-xr-x  4 root   root         4096 2012-02-18 18:52 ..
drwxrws---  3 root   debusers     4096 2012-02-29 15:31 dropbox
drwxr-xr-x 20 lynn2  debusers     4096 2012-02-26 16:43 lynn2
drwxrwxrwx  5 root   root         4096 2012-02-29 14:19 profiles
drwxr-xr-x  4 steve2 Domain Users 4096 2012-02-29 14:36 steve2

lynn2 then crates a file in the mount called l3:

lynn2@hh3:/mnt/CACTUS$ ls -la /home/CACTUS/dropbox/
total 20
drwxrws---+ 3 root  debusers 4096 2012-02-29 15:31 .
drwxr-xr-x  6 root  root     4096 2012-02-27 14:24 ..
-rw-r-----  1 lynn2 debusers    0 2012-02-29 15:31 a
drwxrwS---+ 2 root  debusers 4096 2012-02-29 14:28 adminfolder

(quoted diff) +0 -4

-rw-rw----  1 lynn2 debusers    0 2012-02-25 23:23 l2
-rw-r-----  1 lynn2 debusers    0 2012-02-29 15:24 l3
-rw-rw----  1 lynn2 debusers    0 2012-02-26 16:20 lynn2-ubuntu.txt
-rw-rw----  1 lynn2 debusers   11 2012-02-26 00:46 lynnnautilus.txt

??

Quoted 19 lines · steve

Quoted 18 lines · J. Bruce Fields

Quoted 17 lines · steve

Quoted 7 lines · J. Bruce Fields

Quoted 6 lines · steve

Quoted 5 lines · J. Bruce Fields

Quoted 2 lines · steve

We are authenticating against Samba4, so our domain user accounts are under Kerberos.

Kerberos works fine with v3.

Quoted 7 lines

Quoted 4 lines

Quoted 1 line

--b.

Hi
Unfortunately, it doesn't seem to. We just tried it, and anyone (with or without a ticket) gets access:-(

Could you give any more detail about your test?

--b.

steve is a /etc/passwd user

Quoted 10 lines

Quoted 10 lines

Quoted 10 lines

steve@hh3:~$ sudo su
[sudo] password for steve:
root@hh3:/home/steve# mount -t nfs4 hh3:/home /mnt -o sec=krb5
root@hh3:/home/steve# exit
exit
steve@hh3:~$ cd /mnt
bash: cd: /mnt: Permission denied
steve@hh3:~$ sudo su
root@hh3:/home/steve# umount /mnt
root@hh3:/home/steve# mount -t nfs hh3:/home /mnt -o sec=krb5

Careful: a recent client will negotiate v4 if you leave this unspecified. You want -onfsversion=3,sec=krb5.

Quoted 37 lines

Quoted 8 lines

Quoted 4 lines

root@hh3:/home/steve# exit
exit
steve@hh3:~$ cd /mnt
steve@hh3:/mnt$

Why is that a problem? You haven't actually accessed anything on the filesystem.

--b.

Steve can access the mounted folder. I can live with that but the acl still isn't working:

lynn2 has authinticated by Kerberos

root@hh3:~# setfacl -d -m g::rw /home/CACTUS/dropbox
root@hh3:~# mount -t nfs hh3:/home /mnt -o sec=krb5
lynn2@hh3:/mnt/CACTUS$ ls -la
total 28
drwxr-xr-x  6 root   root         4096 2012-02-27 14:24 .
drwxr-xr-x  4 root   root         4096 2012-02-18 18:52 ..
drwxrws---  3 root   debusers     4096 2012-02-29 15:31 dropbox
drwxr-xr-x 20 lynn2  debusers     4096 2012-02-26 16:43 lynn2
drwxrwxrwx  5 root   root         4096 2012-02-29 14:19 profiles
drwxr-xr-x  4 steve2 Domain Users 4096 2012-02-29 14:36 steve2

lynn2 then crates a file in the mount called l3:

lynn2@hh3:/mnt/CACTUS$ ls -la /home/CACTUS/dropbox/
total 20
drwxrws---+ 3 root  debusers 4096 2012-02-29 15:31 .
drwxr-xr-x  6 root  root     4096 2012-02-27 14:24 ..
-rw-r-----  1 lynn2 debusers    0 2012-02-29 15:31 a
drwxrwS---+ 2 root  debusers 4096 2012-02-29 14:28 adminfolder

(quoted diff) +0 -4

-rw-rw----  1 lynn2 debusers    0 2012-02-25 23:23 l2
-rw-r-----  1 lynn2 debusers    0 2012-02-29 15:24 l3
-rw-rw----  1 lynn2 debusers    0 2012-02-26 16:20 lynn2-ubuntu.txt
-rw-rw----  1 lynn2 debusers   11 2012-02-26 00:46 lynnnautilus.txt

Quoted 1 line

??

I would have expected the default acl on the parent to override any umask on v3.

So if it's actually v3, then that looks like a bug to me.

--b.

1. Do we need to remove /etc/idmapd.conf for nfs3?

2. Could I take this opportunity to ask as a feature request that nfs4_setfacl be able to offer group rw from a 0022 umask?

OK. I see what you mean. umask 0022
So I can have a group rw with posix but not with nfs4_setfacl:-(

That's on openSUSE who default to 0022. The default on Ubuntu is 0002 so presumably we could have group rw over nfs4 there out of the box?

Is it a lot of work to implement umask override for nfs4? Or make it an option perhaps?

At the moment I'm using a big hammer and scanning the share every 4 seconds to change the permissions of any files created there. My other thought was to have the share on a different partition, umask it to 0002 and export that. But these are workarounds. It would be really good to have the nfs4 acls do it.