1

I want to give Share permission to my cifs share but I guess unix only able to give file permission like: 

/usr/bin/chmod -R A+group@:full_set:fd:allow  pool/test

This is the bad way because I have couple of million file in some shares and the job took days! Every time I don't want to set every file in this directory.

At Windows side a file or folder has 2 different permission:
1- File permission.
2- Share permission.

If I use Share permission I don't need to set chmod every file or folder in directory, you need to just give a Share permission top of directory Ro or Rw than everything okay in few seconds.

Can I use the share permission on Solaris?

Improve this question

1 Answer 1

Reset to default
3

Yes, you can do that.

They are stored in a file for each share, you can access (ls) and modify (chmod) this file at the locations (assuming direct mount mapping)

/<pool>/<filesystem>/.zfs/shares/<share>

where <pool> and <filesystem> is the mounted path of your ZFS file system, and <share> is the name of your CIFS share. Example:

FS:   pool0/users/bob
Path: /pool0/users/bob/.zfs/shares/bobs_home

But be careful: the share permissions can only be set for the whole share, no sub-divisions are possible. Additionally, all file ACLs are still valid and will be evaluated. Think of it as another gate - once you are through the "share" security gate, you must still pass the "file" security gate to finally get access.

It depends on your goals:

  • If you want to give different users a fixed set of permissions at different times, your case may be better served by using groups instead of users in the file ACLs. You add or remove a user from a group and he immediately gains or loses access from all files where the group has been set. Of course, sometimes you still have to remove or add a group itself, but it will most likely be not that frequent. You retain all granularity.

  • If you want to have different "views" on the data without changing the files at all, even at the same time, share permissions might be what you want. You can create one or multiple shares (each with different share ACLs and names, referencing the same dataset) and quickly allow/deny users or groups to access what's behind. If users can also login locally, they can of curse circumvent these permissions.

Improve this answer
6
  • Thank you for answer but I could not figure out how its working.
    – Morphinz
    May 25, 2017 at 15:00
  • @Morphinz You just use chmod, for example to add a read/traverse permission for group sales: chmod A+group:sales:r-x---a-R-c--s:-------:allow /yourpool/yourfilesystem/.zfs/shares/yoursharename. Note that when accessing the path at .zfs (the hidden directory), your shell expansion does not work, so you have to type that in manually (afterwards it works as normal).
    – user121391
    May 29, 2017 at 7:11
  • I did that like you said but i use DC user instead group and it didn't work. I cant access my files from Windows. I should try again. I will write new comment when i try.
    – Morphinz
    May 29, 2017 at 7:29
  • @Morphinz Do your DC user permissions work on normal files? If yes, then try restarting the CIFS service on Solaris. If not, your problem lies on the auth part, have a look at idmap and its log messages.
    – user121391
    May 29, 2017 at 11:22
  • Yes DC user permissions works. And i can access my shares if i use standart permission set. When i give Share permission like you said, i can see permission set from windows side. I tried full set instead read only, i can confirm from windows side the share permission has been set but i don't have access into share. Its weird. What ever I'm leaving unix and i change my arch to Arch Linux. A new adventure is waiting for me. Thank you for your effort.
    – Morphinz
    May 30, 2017 at 21:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .