Why can't I set an ACL for AFS even though I'm in the right group?

Question

I've got a directory that I've lost control over on an AFS system. According to the system adminstrators, my adminin subgroup (dsekt:admin) has rlidwka on the directory. I'm a member of this group (and I can list the members of the group and see my nick there) but I can't set its ACL.

The pts:

$>pts membership dsekt:admin     
Members of dsekt:admin (id: -6813) are:
  /.../
  taran

And my klist:

$>klist
Credentials cache: FILE:/tmp/krb5cc_56782
        Principal: [e-mail]

Both dsekt:admin and the directory are on the NADA.KTH.SE node.

Answer 1

With AFS, Access Control Lists (ACLs) are used to set access rights on directories (not files). (ACL ref: http://www.angelfire.com/hi/plutonic/afs-faq.html#sub2.04 )

First, display the ACL on the directory: fs la $directory

For example:

tweety@toontown $ fs listacl .
Access list for . is
Normal rights:
  fac:coords rlidwka
  system:anyuser rl

Second, look at the ACL and confirm that your AFS-ID is either in the ACL or is a member of any group in the ACL. You can check group membership with: pts mem $afs_group_name

Third, examine the AFS access rights (ref: http://www.angelfire.com/hi/plutonic/afs-faq.html#sub2.04 ) and confirm you have the access rights needed.

To administer an ACL, you only need the "a" access right. However, in practice, it's easier to have all rights: "rwlidka".

Fourth, confirm you have authenticated into your AFS cell and have an active token:

For example:

elmer@toontown $ tokens
Tokens held by the Cache Manager:

User's (AFS ID 9997) tokens for [e-mail] [Expires Sep 15 06:50]
User's (AFS ID 5391) tokens for [e-mail] [Expires Sep 15 06:48]
   --End of list--

It is possible in AFS to authenticate into more than one cell.

Answer 2

The fs getcalleraccess command can be useful to see what access rights AFS thinks you have on a directory. Just run:

$ fs getcalleraccess
Callers access to . is rlidwka

One possibility not covered by other answers yet is that you may be listed in a "negative" ACL on the relevant directory. Negative ACLs are not very common, but they are applied "after" the normal positive ACLs, so negative ACLs trump positive ACLs.

For example:

$ fs la
Access list for . is
Normal rights:
  system:administrators rlidwka
  system:anyuser rl
  foo1 rlidwka
Negative rights:
  foo1 rlidwka

User 'foo1' in that example cannot access the directory at all, even though they are listed with positive "rlidwka" rights. To remove the negative ACL entry:

$ fs sa . foo1 none -negative
$ fs la
Access list for . is
Normal rights:
  system:administrators rlidwka
  system:anyuser rl
  foo1 rlidwka

Answer 3

I'm not very familiar with Andrew, but as a general rule, some permissions are stored in the parent dir, you may need permissions there too.