2.1 KiB
NFS4 ACLs
!!! warning NFS4 ACLs are only respected if the mount is using sec=krb5 or higher!
Prerequisite: NFS4 ACL support needs to be enabled on the NFS server / Netapp SVM (existing mounts need to be re-mounted after the support is enabled!)
Install necessary tools:
dnf install nfs4-acl-tools
Get current ACLs of a share/directory:
nfs4_getfacl /mnt/nfs_share
Set an ACL (acls are best set on a system that has norootsquash and sec=sys access)
ACLs can be expressed in 2 different formats. "Simple" and "complex". If you use the "simple" format while setting the acl these get translated to the "complex" ones (case is important!).
- a RX gets translated to rxtncy
- a RWX gets translated to rwaDxtTnNcCy
# group: 35593
nfs4_setfacl -a A:dfg:35593:RWX /modules/test
# give a specific user write access to a directory
nfs4_setfacl -a A:df:your_user@psi.ch:RWX /mnt
Executing the command above twice will result in 2 identical entryies in the directories ACL.
To avoid this the complete ACL one could be set at once with the -s option.
While listing the files with ls the trailing + at the end of he permissions indicate that some acls apply to this file/directory
[~]# ls -la /test/
-rw-r--r--+ 1 root root 6 Jul 16 15:41 test.me
For more details about NFS4 ACLs see the nfs4_acl(5) manpage or in this PDF
Utilities
There are some utilities available to make working with NFS4 ACLs easier.
nfs4acl-readable can be used to convert the complex ACLs to a more human readable format.
[~]$ nfs4acl_readable
Usage:
nfs4acl-readable [--all] [--] /path/to/directory [/path/to/another ...]
nfs4_getfacl /path/to/directory | nfs4acl-readable --stdin [--all]
Options:
--stdin Read from stdin
--all Show all ACL entries with full details (default: simplified output)
--help Show this help message
More details on the usage can be found in the Readme.md.