NFS4 ACLs¶

Warning

NFS4 ACLs are only respected if the mount is using sec=krb5 or higher!

Prerequisite: NFS4 ACL support needs to be enabled on the NFS server / Netapp SVM (existing mounts need to be re-mounted after the support is enabled!)

Install necessary tools:

dnf install nfs4-acl-tools

Get current ACLs of a share/directory:

nfs4_getfacl /mnt/nfs_share

Set an ACL (acls are best set on a system that has norootsquash and sec=sys access)

ACLs can be expressed in 2 different formats. "Simple" and "complex". If you use the "simple" format while setting the acl these get translated to the "complex" ones (case is important!). - a RX gets translated to rxtncy - a RWX gets translated to rwaDxtTnNcCy

# group: 35593
nfs4_setfacl -a A:dfg:35593:RWX /modules/test

# give a specific user write access to a directory
nfs4_setfacl -a A:df:your_user@psi.ch:RWX /mnt

Executing the command above twice will result in 2 identical entryies in the directories ACL. To avoid this the complete ACL one could be set at once with the -s option.

While listing the files with ls the trailing + at the end of he permissions indicate that some acls apply to this file/directory

[~]# ls -la /test/
-rw-r--r--+ 1 root root          6 Jul 16 15:41 test.me

For more details about NFS4 ACLs see the nfs4_acl(5) manpage or in this PDF

Utilities¶

There are some utilities available to make working with NFS4 ACLs easier.

nfs4acl-readable can be used to convert the complex ACLs to a more human readable format.

[~]$ nfs4acl_readable 

Usage:
    nfs4acl-readable [--all] [--] /path/to/directory [/path/to/another ...]
    nfs4_getfacl /path/to/directory | nfs4acl-readable --stdin [--all]

Options:
    --stdin    Read from stdin
    --all      Show all ACL entries with full details (default: simplified output)
    --help     Show this help message

More details on the usage can be found in the Readme.md.