1

using NFS in solaris result in (sort of) acl creation.

by "sort of" I mean a peculiar command will reveal acl existence

Solaris # mkdir T2
Solaris # getfacl T2

# file: T2
# owner: root
# group: root
user::rwx
group::r-x              #effective:r-x
mask:rwx
other:r-x
Solaris # ls -V
total 3
drwxr-xr-x+  2 root     root           2 Mar  8 08:35 T2
           group:foobar:rwxp-DaARWcCos:fd-----:allow
            group:admin:rwxp-DaARWcCos:fd-----:allow
                 owner@:rwxp-DaARWcCos:-------:allow
                 group@:r-x---a-R-c--s:-------:allow
              everyone@:r-x---a-R-c--s:-------:allow

as you can see, getfacl reveal nothing, but ls -V show extended right.

I have check that being member of foobar allow me to create dir and files.

  • with extended right / ACL (e.g. a + in ls -l ) on solaris
  • without extended right / ACL on suse (11.4)

The current dir is based on a zfs nfs exported filesystem.

now the questions:

  • where are those ACL set ?
  • how to set them in suse environment ?
4

As per man ls in solaris

-V

The same as -l, except that compact ACL information is displayed after the -l output.

The -V option is only applicable to file systems that support NFSv4 ACLs, such as the Solaris ZFS file system.

This lead us to nfsv4 acl on suse.

Listing access right is done by nfs4-getfacl (as per online documentation) or nfs4_getfacl (actual file installed from nfs4-acl-tools package).

extract from man nfs4_getacl

   The output format for an NFSv4 file ACL, e.g., is:

          A::OWNER@:rwatTnNcCy
          A::alice@nfsdomain.org:rxtncy
          A::bob@nfsdomain.org:rwadtTnNcCy
          A:g:GROUP@:rtncy
          D:g:GROUP@:waxTC
          A::EVERYONE@:rtncy
          D::EVERYONE@:waxTC

This differ from solaris version.

It is unclear if solaris nfs4 acl can be translated to suse nfs4 acl.

  • nfs4_getfacl does accurately present the ACL as defined in ZFS. At least with Ubuntu 16.04 nfs client, Solaris 11.3 NFS server, and the mount being NFS v4. – Tim Kennedy Mar 8 '17 at 15:00
  • I can't test it right now. Ultimatly I will drop solaris, so should I use ZFS +NFSv4+NFS4 ACL or (xfs or ext4)+NFSv3+Posix ACL ? – Archemar Mar 8 '17 at 15:09
  • If you can meet your needs with POSIX permission sets, then that's certainly an option. If you need more fine-grained permissions, then keep using NFS v4 with v4 style ACLs. I've put some examples below. – Tim Kennedy Mar 8 '17 at 15:26
2

Here's how the appear on Solaris w/ZFS, Linux w/ NFSv4, and Linux w/ NFSv3:

Solaris 11.3 ZFS Filesystem:

bash-[509]$ ls -Vd /ssd/TIVO
drwxrwxr-x+ 12 tim      users         15 Feb 23 17:34 /ssd/TIVO/
               user:tim:rwxpdDaARWcCos:fd-----:allow
                 owner@:rwxp-DaARWcCos:-------:allow
                 group@:rwxp-DaARWc--s:-------:allow
              everyone@:r-x---a-R-c--s:-------:allow

Linux client with NFS v4 mount of Solaris 11.3 ZFS/NFS filesystem:

bash:~$ lsb_release -d
Description:    Ubuntu 16.04 LTS

bash:~$ mount | grep TIVO
tank:/ssd/TIVO on /ssd/TIVO type nfs4 (rw,relatime,vers=4.0,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp,port=0,timeo=600,retrans=2,sec=sys,clientaddr=192.168.0.100,local_lock=none,addr=192.168.2.1)

bash:~$ nfs4_getfacl /ssd/TIVO
A:fd:tim@tank:rwaDdxtTnNcCoy
A::OWNER@:rwaDxtTnNcCoy
A:g:GROUP@:rwaDxtTnNcy
A::EVERYONE@:rxtncy

Linux client with NFS v3 mount of Solaris 11.3 ZFS/NFS filesystem:

bash:/ssd# lsb_release -d
Description:    Ubuntu 16.04.2 LTS

bash:/ssd# mount | grep TIVO
tank:/ssd/TIVO on /ssd/TIVO type nfs (rw,relatime,vers=3,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,mountaddr=192.168.2.1,mountvers=3,mountport=59133,mountproto=tcp,local_lock=none,addr=192.168.2.1)

bash:/ssd# getfacl /ssd/TIVO
getfacl: Removing leading '/' from absolute path names
# file: ssd/TIVO
# owner: tim
# group: users
user::rwx
group::rwx
other::r-x

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.