2

Since the specific limits at which the file system fails depends on the OS, we have a test that validates just that we can get up to 500 entries on an ACL, and that 4000 entries fails (should fail on all UNIX platforms at that level), this test has been working for a long time on different architecture and os version.

Recently while running the test on:

cat /etc/os-release
NAME="SLES"
VERSION="12-SP1"
VERSION_ID="12.1"
PRETTY_NAME="SUSE Linux Enterprise Server 12 SP1"
ID="sles"
ANSI_COLOR="0;32"
CPE_NAME="cpe:/o:suse:sles:12:sp1"

and filesystem type:

cat /etc/fstab 
UUID=61e7-43bb-8cdc-80a3718e27b9 /                    xfs        defaults              1 1

it passes and able to set ACL upto 4000 and doesn't complain, so I wanted to know whether OS allows for this file system to have this many acls and what's the limit?

1

Xfs had a limit of 25 ACL entries for a long time but the limit was lifted in kernel 3.11. For xfs v5 or later, the limit is now as many as fit in the extended attribute list (64kB), which at 12 bytes per entry means 5460 entries if there are no other extended attributes (e.g. no SELinux context).

I think some Linux filesystems can compress most ACL entries down to 4 bytes which would allow a little under 16384 entries.

I don't understand why you'd test that there is a maximum number of ACL entries. This is not something you can count on. At any time the number could become effectively unlimited.

  • The main reason of counting or at least getting a ball park number is, our product lets user create file in a container with different ACLs and there is no limit but OS limit and our product also supports various old version of OS where we have limitation on number of ACL, so it is required to test the maximum number of ACL on various os(there different versions) on different architecture. – MikasaAckerman Aug 18 '16 at 1:15
  • @MikasaAckerman So test the minimum number. The maximum won't help you. – Gilles 'SO- stop being evil' Aug 18 '16 at 1:18
  • We also need to inform user the reason why it failed like ACL was too long for OS to handle. I have another following question, does the ACL size differ on different Architecture like the one above is x86 , will the same hold for ppc? – MikasaAckerman Aug 18 '16 at 1:21
  • @MikasaAckerman It's a filesystem or filesystem driver limitation. I don't think that any of the code for this is architecture-dependent. – Gilles 'SO- stop being evil' Aug 18 '16 at 1:27
  • @MikasaAckerman You can't know whether a failure is due to the ACL being too long. The ACL shares space with other extended attributes, there isn't a fixed maximum number of entries on most filesystem types. Furthermore figuring out what the limit is is difficult since it depends on the filesystem type, on the filesystem version or attributes, and on the kernel version. You can bet that there will always be combinations that you don't support. – Gilles 'SO- stop being evil' Aug 18 '16 at 1:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.