<div class="socmaildefaultfont" dir="ltr" style="font-family:Arial, Helvetica, sans-serif;font-size:10.5pt" ><div dir="ltr" >An equally weird option is to install the GPFS GUI and use the /usr/lpp/mmfs/gui/cli/chacl command. It has all the capabilities you ask for. This CLI is internally used to do the test automation of the GUI's backend layer and not really supported, but it works just fine. Drawback is that this command exists only on nodes running the GUI.</div>
<div dir="ltr" > </div>
<div dir="ltr" ><div class="socmaildefaultfont" dir="ltr" style="font-family:Arial, Helvetica, sans-serif;font-size:10.5pt" ><div class="socmaildefaultfont" dir="ltr" style="font-family:Arial, Helvetica, sans-serif;font-size:10.5pt" ><div class="socmaildefaultfont" dir="ltr" style="font-family:Arial, Helvetica, sans-serif;font-size:10.5pt" ><div class="socmaildefaultfont" dir="ltr" style="font-family:Arial, Helvetica, sans-serif;font-size:10.5pt" ><div class="socmaildefaultfont" dir="ltr" style="font-family:Arial;font-size:10.5pt" ><div class="socmaildefaultfont" dir="ltr" style="font-family:Arial;font-size:10.5pt" ><div dir="ltr" ><font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2" ><font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2" ><font face="Arial" size="2" >Mit freundlichen Grüßen / Kind regards</font> </font> </font>
<p><font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2" ><font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2" ><img height="23" src="cid:15537580138880" width="605" ></font></font></p><font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2" > <font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2" > </font> </font>
<table border="0" cellpadding="0" cellspacing="0" > <tbody> <tr valign="top" > <td valign="middle" width="202" ><font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2" ><font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2" ><img align="bottom" alt="IBM Spectrum Scale" height="51" src="cid:15537580138881" width="201" > </font> </font>
<ul style="padding-left: 0pt; margin-left: 0px; list-style-type: none;" > <li><font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2" > </font></li> </ul> <font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2" > <font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2" > </font></font></td> <td valign="middle" width="31" > <ul style="padding-left: 0pt; margin-left: 0px; list-style-type: none;" > <li><font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2" ><font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2" ><font size="3" > </font></font></font></li> </ul> </td> <td valign="middle" width="464" > <ul style="padding-left: 0pt; margin-left: 0px; list-style-type: none;" > <li><font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2" ><font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2" ><b><font face="Arial" size="3" >Dr. Alexander Wolf-Reber</font></b><br> <font face="Arial" size="1" >Spectrum Scale Release Lead Architect<br> Department M069 / Spectrum Scale Software Development<br> <br> +49-7034-2745404<br> a.wolf-reber@de.ibm.com</font></font></font></li> </ul> </td> </tr> </tbody></table><font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2" > <font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2" > <img height="23" src="cid:15537580138882" width="605" > </font> </font>
<p><font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2" ><font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2" ><font color="#999999" face="Arial" size="1" >IBM Deutschland Research & Development GmbH / Vorsitzende des Aufsichtsrats: Matthias Hartmann / Geschäftsführung: Dirk Wittkopp<br>Sitz der Gesellschaft: Böblingen / Registergericht: Amtsgericht Stuttgart, HRB 243294</font></font></font></p><font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2" > <font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2" > </font></font></div></div></div></div></div></div></div></div>
<div dir="ltr" > </div>
<div dir="ltr" > </div>
<blockquote data-history-content-modified="1" data-history-expanded="1" dir="ltr" style="border-left:solid #aaaaaa 2px; margin-left:5px; padding-left:5px; direction:ltr; margin-right:0px" >----- Original message -----<br>From: Jonathan Buzzard <jonathan.buzzard@strath.ac.uk><br>Sent by: gpfsug-discuss-bounces@spectrumscale.org<br>To: gpfsug-discuss@spectrumscale.org<br>Cc:<br>Subject: Re: [gpfsug-discuss] Adding to an existing GPFS ACL<br>Date: Wed, Mar 27, 2019 11:58 PM<br>
<div><font face="Default Monospace,Courier New,Courier,monospace" size="2" >On 27/03/2019 15:59, Buterbaugh, Kevin L wrote:<br><br>[SNIP]<br><br>> So am I missing something?<br><br>Nope you are not missing anything. Setting NFSv4 ACL's on GPFS on<br>*LINUX* has always been a steaming pile of Brontosaurus droppings.<br><br>I have been on about since 2011... Search the mailing list archives.<br><br>> Is there an easier solution than writing a<br>> script which recurses over the fileset, gets the existing ACL with<br>> mmgetacl and outputs that to a file, edits that file to add in the new<br>> group, and passes that as input to mmputacl? That seems very cumbersome<br>> and error prone, especially if I’m the one writing the script!<br>><br><br>The best option is to get yourself a pSeries machine, install AIX and<br>GPFS and use the native AIX ACL command to set the ACL's. This works<br>because AIX has a mechanism for passing NFSv4 ACL's through it's VFS<br>interface. The RichACL kernel patches for Linux to give it the same<br>functionality went nowhere. Noting that the XFS and JFS file systems,<br>internally have NFSv4 ACL support.<br><br>The next best option is to export it as an NSFv4 file system and use a<br>Linux/FreeBSD machine to set the ACL's (a Mac might even work). Expect<br>performance to not be great.<br><br>The next best option is to do an SMB export, mount it on Linux and use<br>setcifsacl or map it on Windows and use cacls command. Some<br>experimentation on working out exactly how NFSv4 ACLS get mapped to<br>Windows ACLS would be advisable before a mass apply though. I don't<br>think it is possible to set all NFSv4 ACL options using this method.<br><br>Probably the best option, but which is not publicly available is to use<br>my modified version of the Linux nfs4_setacl command :-)<br><br>You just modify nfs4_acl_for_path.c and nfs4_set_acl.c so they<br>read/write the GPFS ACL struct and convert between the GPFS<br>representation and the internal data structure used by the<br>nfs4-acl-tools to hold NFSv4 ACL's.<br><br>However I have not put it any where public because the GPFS API<br>documentation is incomplete when it comes to ACL's. Consequently I can't<br>be sure it is safe so I am not releasing it. I have two questions that I<br>would like answering before I make it public. I will ask them for the<br>third time, in hopes someone at IBM is actually listening.<br><br> 1. What's the purpose of a special flag to indicate that it is smbd<br> setting the ACL? Does this tie in with the undocumented "mmchfs -k<br> samba" feature?<br><br> 2. There is a whole bunch of stuff in the documentation about v4.1<br> ACL's. How does one trigger that. All I seem to be able to do is<br> get POSIX and v4 ACL's. Do you get v4.1 ACL's if you set the file<br> system to "Samba" ACL's or am I missing something.<br><br>The other option is to write a script. Personally I would use<br>Perl/Python rather than a shell script as it would be easier to read the<br>result of mmgetacl into a buffer, append the extra bits and write it out<br>again with mmputacl. It is horribly slow however if you have millions of<br>files to iterate over. Trust me back in 2011 I had Perl scripts for<br>setting ACL's.<br><br>The final option though not quick would be for IBM to actually implement<br>a mmsetfacl command. Surely it would not be too hard to take the code<br>from AIX and modify the bits that set ACL's to use the GPFS API.<br>Alternatively take the FreeBSD ACL commands and use them as a starting<br>point. However I would not hold your breath for IBM if you expect them<br>to fix the situation.<br><br><br>JAB.<br><br>--<br>Jonathan A. Buzzard Tel: +44141-5483420<br>HPC System Administrator, ARCHIE-WeSt.<br>University of Strathclyde, John Anderson Building, Glasgow. G4 0NG<br>_______________________________________________<br>gpfsug-discuss mailing list<br>gpfsug-discuss at spectrumscale.org<br><a href="http://gpfsug.org/mailman/listinfo/gpfsug-discuss" target="_blank">http://gpfsug.org/mailman/listinfo/gpfsug-discuss</a></font><br> </div></blockquote>
<div dir="ltr" > </div></div>
<BR>