Re: NFSv4 default ACL

On Wednesday 30 August 2006 14:49, Andre Roth wrote:
> Hello,
>
> I'm having some problems using ACL's on a mounted NFSv4 directory.
> Setting simple ACL's works fine, but default ACL's conflict with normal
> ACLs and the Unix permissions.
> I don't know if default ACLs are possible with NFSv4 ACLs, if this is a
> bug or a configuration issue. The NFSv4 server is a NetApp Filer.
>
> [...]

Are you sure you are using NFSv4 and not NFSv3?

You might want to create a tcpdump (with -s 0 -w dump) and see what's 
happening on the wire (e.g., with ethereal). It might be a bug in the Linux 
client, or a problem on the NetApp side.

In general, POSIX and NFSv4 ACLs do not interact very well. The NFSv4 patches 
against libacl which make getfacl and setfacl emulate NFSv4 ACLs are not in 
the upstream version, and never will be. Instead, we'll likely have tools 
that can manipulate NFSv4 ACLs directly. Apparently Gentoo still took the 
CITI libacl patches.

> Setting simple ACLs works fine: 
>
>    joe@server ~ $ mkdir test
>    joe@server ~ $ getfacl test
>    # file: test
>    # owner: joe
>    # group: Staff
>    user::rwx
>    group::r-x
>    other::r-x
>
>    joe@server ~ $ setfacl -m u:alice:rwx test/
>    joe@server ~ $ getfacl test
>    # file: test
>    # owner: joe
>    # group: Staff
>    user::rwx
>    user:alice:rwx
>    group::r-x
>    mask::rwx
>    other::r-x
>
> Setting default ACL's removes the normal ACL:
>
>    joe@server ~ $ setfacl -d -m u:alice:rwx test/
>    joe@server ~ $ ls -l
>    total 4
>    drw xr-xr-x 2 joe Staff 4096 Aug 30 14:13 test
>    joe@server ~ $ getfacl test
>    # file: test
>    # owner: joe
>    # group: Staff
>
>    default:user::rwx
>    default:user:alice:rwx
>    default:group::r-x
>    default:mask::rwx
>    default:other::r-x

That's a bug: a file cannot not have an ACL; there should at least be user::, 
group::, and other:: entries.

> Setting Unix permissions removes all ACLs:
>
>    joe@server ~ $ chmod 700 test
>    joe@server ~ $ getfacl test
>    # file: test
>    # owner: joe
>    # group: Staff
>    user::rwx
>    group::---
>    other::---
>
>    joe@server ~ $ ls -l
>    total 4
>    drwx------ 2 joe Staff 4096 Aug 30 14:13 test

That's probably by design (but I wouldn't call it expected behavior).

> Trying to set default ACLs again:
>
>    joe@server ~ $ setfacl -d -m u:alice:rwx test/
>    joe@server ~ $ ls -l
>    total 4
>    drwx------ 2 joe Staff 4096 Aug 30 14:13 test
>    joe@server ~ $ getfacl test
>    # file: test
>    # owner: joe
>    # group: Staff
>
>    default:user::rwx
>    default:user:alice:rwx
>    default:group::---
>    default:mask::rwx
>    default:other::---
>
> After this, I cannot set ACLs anymore:
>
>    joe@server ~ $ setfacl -m u:alice:rwx test/
>    setfacl: test: Malformed access ACL `user:alice:rwx,mask::rwx':
>                         Missing or wrong entry at entry 1
>    joe@server ~ $ getfacl test
>    # file: test
>    # owner: joe
>    # group: Staff
>
>    default:user::rwx
>    default:user:alice:rwx
>    default:group::---
>    default:mask::rwx
>    default:other::---

That seems to be a consequence of the server returning an (invalid) empty 
access ACL -- this case should not occur, so setfacl probably also doesn't 
cope with it very well. It tells you that the ACL it tried to create is not a 
proper POSIX ACL though.

> Interesting as well is this behavior:
>
>    joe@server ~ $ mkdir test
>    joe@server ~ $ chmod 700 test
>    joe@server ~ $ setfacl -m u:alice:rwx test/
>    joe@server ~ $ setfacl -d -m u:alice:rwx test/
>    joe@server ~ $ ls -l
>    total 4
>    drwx------ 2 joe Staff 4096 Aug 30 14:29 test
>    joe@server ~ $ getfacl test
>    # file: test
>    # owner: joe
>    # group: Staff
>
>    default:user::rwx
>    default:user:alice:rwx
>    default:group::---
>    default:mask::rwx
>    default:other::---
>
>    joe@server ~ $ ls -l
>    total 4
>    d--------- 2 joe Staff 4096 Aug 30 14:29 test

Huh? Getfacl modifies the file mode?

> Can anyone point me in the right direction ?

For client-side bugs, you mayn want to get in contact with J. Bruce Fields 
<[email protected]>. I don't know the right contact for NFSv4 filer 
problems.

Andreas
_______________________________________________
acl-devel mailing list
[email protected]
http://acl.bestbits.at/mailman/listinfo/acl-devel