Folder shares over NFSv4 private to user groups

Question

I want to share a folder over NFSv4, available to some users, and I'm having permission issues.

I set up the folder permissions with setGID so new files are created with the folder group owner. But users are free to create files without permissions to the group (In fact, default users UMASK is 700, so this happens all the time).

I ended up trying to apply this solution using ACLs to enforce directory umask. I did, but it didn't work as expected. I read on the NFS wiki that regular ACLs won't work over NFSv4, and that I need to use nfs4 specific ACL tools.

But I'm having some trouble. I tried installing nfs4-acl-tools on the server and I get this:

# nfs4_getfacl /export/proyectos/
Operation to request attribute not supported.

Yes, the partition is mounted with ACL support.

/dev/mapper/mpath4-part1 /export/proyectos ocfs2 rw,relatime,_netdev,heartbeat=local,nointr,data=ordered,errors=remount-ro,usrquota,coherency=full,user_xattr,acl 0 0

And regular ACLs are working:

# getfacl /export/proyectos/
getfacl: Eliminando «/» inicial en nombres de ruta absolutos
# file: export/proyectos/
# owner: root
# group: root
# flags: --t
user::rwx
group::rwx
other::rwx
default:user::rwx
default:group::rwx
default:other::rwx

I straced the nfs4_getfacl as suggested on the mailing list and got this:

# strace nfs4_getfacl /export/proyectos
<stripped>
getxattr("/export/proyectos", "system.nfs4_acl", 0x0, 0) = -1 EOPNOTSUPP (Operation not supported)
<stripped>

Is nfs4_getfacl asking for the right flag? I thought that nfs4_acls were not implemented at all by any filesystem, and currently nfs4 were relying on some kind of nfs4acl-posixacl mapping. But I'm not sure anymore.

check out http://satish-linuxbug.blogspot.com/2009/02/nfs-with-acl-ignore-umask.html — Satish, Aug 27 '12 at 17:57
I'm not sure if that will work over nfs4. I've also asked in your blog. I didn't notice that the blog is yours, sorry. So, are you using nfs4? — Jorge Suárez de Lis, Aug 27 '12 at 18:01
What kernel version are you using also make sure you use latest version of nfs4-acl-tools — Satish, Aug 27 '12 at 19:30
http://www.centos.org/docs/5/html/5.4/Technical_Notes/nfs4-acl-tools.html — Satish, Aug 27 '12 at 19:32
I'm using nfs4-acl-tools 0.3.3-0ubuntu1 from Ubuntu 10.04. No new versions on ubuntu, just packaging improvements. Kernel 2.6.38-15-server backported from natty. — Jorge Suárez de Lis, Aug 28 '12 at 07:29
Last number is just packaging improvements, AFAIK. Latest stable has 0.3.3-1 with just slightly improved packaging things. Also, I can't just upgrade the entire server from Ubuntu 10.04 up to Ubuntu 12.04 right now. Maybe I can try, for science, on a virtual machine. — Jorge Suárez de Lis, Aug 29 '12 at 08:06

score 2 · Answer 1 · edited Apr 13 '17 at 12:14

2

You must use getfacl on the NFS server (because you query the local file-system), and use nfs4_getfacl when you are on the NFS client.

NFSv4 ACL and Linux ACL acl(5) are completely different standard ! The Linux NFS server will translate the ACL back and forth.

Read the post No acl on nfs mount in linux?.

edited Apr 13 '17 at 12:14

Community

1

answered Mar 10 '15 at 00:47

Franklin Piat

736
6
22

Folder shares over NFSv4 private to user groups

1 Answers1