From 46eaa637e919e152ee3eb221a70d8dcc901eeeb8 Mon Sep 17 00:00:00 2001 From: ebner Date: Thu, 17 Jul 2025 11:45:15 +0200 Subject: [PATCH] add guide for nfs4 acl configuration --- _toc.yml | 1 + admin-guide/configuration/nfs4_acls.md | 33 ++++++++++++++++++++++++++ 2 files changed, 34 insertions(+) create mode 100644 admin-guide/configuration/nfs4_acls.md diff --git a/_toc.yml b/_toc.yml index 71492cf4..6368d5b4 100644 --- a/_toc.yml +++ b/_toc.yml @@ -134,6 +134,7 @@ chapters: - file: admin-guide/configuration/monitoring/journal_remote - file: admin-guide/configuration/monitoring/syslog_forwarding - file: admin-guide/configuration/monitoring/central_logging_elastic + - file: admin-guide/configuration/nfs4_acls - file: admin-guide/custom_repositories - file: admin-guide/troubleshooting diff --git a/admin-guide/configuration/nfs4_acls.md b/admin-guide/configuration/nfs4_acls.md new file mode 100644 index 00000000..bf14ae13 --- /dev/null +++ b/admin-guide/configuration/nfs4_acls.md @@ -0,0 +1,33 @@ +# NFS4 ACLs + +**IMPORTANT: NFS4 ACLs are only respected if the mount ist using sec=krb5 or higher!** + +Prerequisite: NFS4 ACL support needs to be enabled on the NFS server / Netapp SVM +(existing mounts need to be re-mounted after the support is enabled!) + +Install necessary tools: +```bash +dnf install nfs4-acl-tools +``` + +Get current ACLs of a share/directory: +```bash +nfs4_getfacl /mnt/nfs_share +``` + + +Set an ACL +(acls are best set on a system that has norootsquash and sec=sys access) +```bash +# group: 35593 +nfs4_setfacl -a A:dfg:35593:RWX /modules/test +``` +Executing the command above twice will result in 2 identical entryies in the directories ACL. +*To avoid this the complete ACL one could be set at once with the `-s` option.* + + +While listing the files with `ls` the trailing `+` at the end of he permissions indicate that some acls apply to this file/directory +```bash +[~]# ls -la /test/ +-rw-r--r--+ 1 root root 6 Jul 16 15:41 test.me +```