search for: nfs4_setfacl

On Fri, Apr 06, 2018 at 10:27:32AM -0700, Jeremy Allison via samba wrote: > On Fri, Apr 06, 2018 at 01:44:50PM +0530, Akash Jain wrote: > > Hi All > > > > I found there is one bug in the plugin. The name of the attribute for ACL as > > per strace output of nfs4_setfacl is system.nfs4_acl. > > The source code has defined it as > > #define NFS4ACL_XATTR_NAME      ( "system.nfs4acl" ) > > > > Note there is missing underscore. > > > > After this, the EOPNOTSUPP error is not observed. > > > > Hope this helps...

...-0700, Jeremy Allison via samba wrote: > > > On Fri, Apr 06, 2018 at 01:44:50PM +0530, Akash Jain wrote: > > > > Hi All > > > > > > > > I found there is one bug in the plugin. The name of the attribute for ACL as > > > > per strace output of nfs4_setfacl is system.nfs4_acl. > > > > The source code has defined it as > > > > #define NFS4ACL_XATTR_NAME      ( "system.nfs4acl" ) > > > > > > > > Note there is missing underscore. > > > > > > > > After this, the EOPNOTSUPP...

...eally struggling with nfs4 <--> windows acls. Scenario Samba4 share --> cifs --> win7. No problem Samba4 share --> nfs4 --> Linux. acls not inherited Neither is there inheritance vica versa. e.g. It is not possible to create files with group rw on a umask 0022 nfs4 share. nfs4_setfacl cannot override umask. Using POSIX or windows acls this works fine. I've approached the nfs4 devs and they've said that they'll look into it, but so far. Exporting nfs4 with -o noacl (in the hope that the windows acl would take effect) has no effect. 1. Is it possible to get Samba t...

Hi All I found there is one bug in the plugin. The name of the attribute for ACL as per strace output of nfs4_setfacl is *system.nfs4_acl.* The source code has defined it as #define NFS4ACL_XATTR_NAME ( "system.nfs4acl" ) Note there is missing underscore. After this, the EOPNOTSUPP error is not observed. Hope this helps Akash On Thu, Apr 5, 2018 at 11:43 PM, Jeremy Allison <jra at samba.org&...

...Windows machines accessing this folder and its sub folders to be properly restricted according to ACLs. The NFS4 server is running CentOS 5.7 and is NFS exporting an EXT4 folder. The Samba server is running CentOS 6.0, and Samba 3.5.4-68.el6_0.2. On the Samba server, I am able to use chmod, chown, nfs4_setfacl, ls, and nfs4_getfacl to set and retrieve file and folder permissions and ACLs in the NFS4 mounted folder, and it all seems to be working sanely. I have both servers using winbind. On a Windows 7 machine, I am able to browse to \\test-samba-server, and see all the Samba shared folders that I've...

...ok. Here's what we have, and what we'd like to do: Storage is a Netapp (cluster mode CDOT 8.2 I believe), it's NFS exported to our linux system. Linux system is CentOS 6 and can NFS mount the Netapp using version 4. NFSv3 doesn't support ACLs with Netapp, but NFSv4 does with the nfs4_setfacl and nfs4_getfacl commands. We'd like to share out the NFS mounted volume with samba, and retain the NFSv4 acl capability so that Windows users can set advanced permissions on the files. Is this possible? I've seen posts about the ZFS ability and the GPFS ability, but none of those a...

...> > On Fri, Apr 06, 2018 at 01:44:50PM +0530, Akash Jain wrote: > > > > > > Hi All > > > > > > > > > > > > I found there is one bug in the plugin. The name of the > attribute for ACL as > > > > > > per strace output of nfs4_setfacl is system.nfs4_acl. > > > > > > The source code has defined it as > > > > > > #define NFS4ACL_XATTR_NAME ( "system.nfs4acl" ) > > > > > > > > > > > > Note there is missing underscore. > > > > > &gt...

...r 06, 2018 at 10:27:32AM -0700, Jeremy Allison via samba wrote: > > On Fri, Apr 06, 2018 at 01:44:50PM +0530, Akash Jain wrote: > > > Hi All > > > > > > I found there is one bug in the plugin. The name of the attribute for ACL as > > > per strace output of nfs4_setfacl is system.nfs4_acl. > > > The source code has defined it as > > > #define NFS4ACL_XATTR_NAME      ( "system.nfs4acl" ) > > > > > > Note there is missing underscore. > > > > > > After this, the EOPNOTSUPP error is not observed. > &...

...samba wrote: > > > > On Fri, Apr 06, 2018 at 01:44:50PM +0530, Akash Jain wrote: > > > > > Hi All > > > > > > > > > > I found there is one bug in the plugin. The name of the attribute for ACL as > > > > > per strace output of nfs4_setfacl is system.nfs4_acl. > > > > > The source code has defined it as > > > > > #define NFS4ACL_XATTR_NAME      ( "system.nfs4acl" ) > > > > > > > > > > Note there is missing underscore. > > > > > > > > > &...

...1996-2018 by Andrew Tridgell, Wayne Davison, and others. Web site: http://rsync.samba.org/ Capabilities: ??? 64-bit files, 64-bit inums, 64-bit timestamps, 64-bit long ints, ??? socketpairs, hardlinks, symlinks, IPv6, batchfiles, inplace, ??? append, ACLs, xattrs, iconv, symtimes, prealloc ... # nfs4_setfacl -a A::root at localhost:rwaxtcy /tmp/nfs_test_mountpoint/test_file # nfs4_setfacl -a A::testuser at localhost:rwaxtcy /tmp/nfs_test_mountpoint/test_file # nfs4_getfacl /tmp/nfs_test_mountpoint/test_file # file: /tmp/nfs_test_mountpoint/test_file D::OWNER@:x A::OWNER@:rwatTcCy A::0:rwaxtcy?? <...

...esystems in question with NFSv3 + ACLs - due to NFS referrals, automatic mounting of sub-filesystems, etc., I really need it to use NFSv4. >> >> Any advice? > > How are the NFSv4 ACL exposed to Linux command-line > tools ? Are there such ? Yeah, CentOS 7 has nfs4_getfacl and nfs4_setfacl. Will send example output. == This e-mail may contain SEAKR Engineering (SEAKR) Confidential and Proprietary Information. If this message is not intended for you, you are strictly prohibited from using this message, its contents or attachments in any way. If you have received this message in erro...

Thank you. Basically our problem are not the ACLs or their support per se, but that we have to manage a huge number of individual ACLS (several hundred users in more than hundred projects) in multi-petabyte filesystem and still have to keep overview and control. Our problem is more the management side. Effectively we are looking for a tool that helps us manage these permissions and we

...t; Are you sure you are accessing the nfs mounted share on the server and > not the share itself? Yes. > If you are setting the acl from windows on the parent directory, it > will not translate correctly across nfs4 unless you have set the acl > yourself using the (highly intuitive) nfs4_setfacl. I will not start and try out the third permission system after Windows ACLs and Unix permissions. Unless there would be a way to automate this. But nevermind, I got my Samba pam_mount working. Will report in the next mail. > At least several hours of trying later and failing before we went...

...files getting rid of access denied error. I still do not see the exactly mapped ACEs in the Security Descriptor of a file in Windows Explorer but I will debug that little further and then come back with questions. I see only 1 entry of Everyone on Windows client side if there are added ACEs using nfs4_setfacl. Let me know if that works for you as expected. Thanks Akash On Mon, Apr 9, 2018 at 10:26 PM, Ralph Böhme <slow at samba.org> wrote: > On Mon, Apr 09, 2018 at 10:11:45PM +0530, Akash Jain wrote: > > There are not more than 4 ACEs on the root directory but we see naces = > 5...

...gram to do getxattr on the path where we have mounted NFS share, it works fine. Even if we do chdir to directory and then do getxattr it works fine. If we do getxattr on just the root directory of the mount point, it works well. So from underlying mount point, there is no issue. * nfs4_getfacl and nfs4_setfacl commands perfectly work fine on the local mount point. * In the plugin itself, if I change the path to actual directory instead of ".", it still fails with same error. Can someone help me understand, why following call may fail when the path is locally mounted NFS share and not a VFS pa...

...hem > as you are doing. > Rowland, My understanding is that there are 3 different permission systems: - basic UNIX octal permissions (rwx for owner, group, others) - POSIX ACLs (managed by getfacl/setfacl): http://linux.die.net/man/5/acl - Windows/ZFS/NFSv4 ACLs (managed by nfs4_getfacl/nfs4_setfacl) My understanding is that Samba handles mapping between Windows ACLs and POSIX ACLs, is this not correct? http://www.linuxtopia.org/online_books/network_administration_guides/samba_reference_guide/23_AccessControls_25.html When configuring the ACLs on my share, I have used setfacl exclusively fo...

Hai..   I need to have my home dirs shared over some of my servers. I did setup a nfs4 kerberos base Debian jessie, samba 4.1.17 and sernet samba 4.1.3 on these servers.   This works, i can mount without problems.   But because verything is created with the windows user tools, the owner/Group is root. Like this   Server:   ls -al drwxrwx---+  2 root  root 4096 Sep  4 13:17

> However, I have two objections at first glance: > a) if you remove AD access for an AD user, this user can't mount samba > shares, because he won't get authenticated correctly (on the Samba file > server sharing the homes), no? Looks correct to me what your saying, But how are you removing ad access from an AD user? > b) if you use NFS, and I tried that, and a user

...t we have, and what we'd like to do: > > Storage is a Netapp (cluster mode CDOT 8.2 I believe), it's NFS exported to our linux system. > > Linux system is CentOS 6 and can NFS mount the Netapp using version 4. NFSv3 doesn't support ACLs with Netapp, but NFSv4 does with the nfs4_setfacl and nfs4_getfacl commands. > > We'd like to share out the NFS mounted volume with samba, and retain the NFSv4 acl capability so that Windows users can set advanced permissions on the files. > > > Is this possible? > > I've seen posts about the ZFS ability and th...

...its password on ssh access ) Are you sure you are accessing the nfs mounted share on the server and not the share itself? If you are setting the acl from windows on the parent directory, it will not translate correctly across nfs4 unless you have set the acl yourself using the (highly intuitive) nfs4_setfacl. At least several hours of trying later and failing before we went cifs where the acls just work. HTH