<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-GB" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hi Paul,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We use both Windows and Linux with our FS but only have NFSv4 ACLs enabled (we do also set “chmodAndSetAcl” on the fileset which makes chmod etc work whilst not breaking the ACL badly). We’ve only found 1 case where POSIX ACLs were needed,
and really that was some other IBM software that didn’t understand ACLs (which is now fixed). The groups exist in both AD and our internal LDAP where they have gidNumbers assigned. For our research projects we set the following as the default on the directory:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">$ mmgetacl some-project<o:p></o:p></p>
<p class="MsoNormal">#NFSv4 ACL<o:p></o:p></p>
<p class="MsoNormal">#owner:root<o:p></o:p></p>
<p class="MsoNormal">#group:gITS_BEAR_2019- some-project<o:p></o:p></p>
<p class="MsoNormal">special:owner@:rwxc:allow:FileInherit:DirInherit<o:p></o:p></p>
<p class="MsoNormal">(X)READ/LIST (X)WRITE/CREATE (X)APPEND/MKDIR (X)SYNCHRONIZE (X)READ_ACL (X)READ_ATTR (X)READ_NAMED<o:p></o:p></p>
<p class="MsoNormal">(X)DELETE (X)DELETE_CHILD (X)CHOWN (X)EXEC/SEARCH (X)WRITE_ACL (X)WRITE_ATTR (X)WRITE_NAMED<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">group:gITS_BEAR_2019- some-project:rwxc:allow:FileInherit:DirInherit<o:p></o:p></p>
<p class="MsoNormal">(X)READ/LIST (X)WRITE/CREATE (X)APPEND/MKDIR (X)SYNCHRONIZE (X)READ_ACL (X)READ_ATTR (X)READ_NAMED<o:p></o:p></p>
<p class="MsoNormal">(X)DELETE (X)DELETE_CHILD (X)CHOWN (X)EXEC/SEARCH (X)WRITE_ACL (X)WRITE_ATTR (X)WRITE_NAMED<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">special:everyone@:----:allow<o:p></o:p></p>
<p class="MsoNormal">(-)READ/LIST (-)WRITE/CREATE (-)APPEND/MKDIR (X)SYNCHRONIZE (X)READ_ACL (X)READ_ATTR (X)READ_NAMED<o:p></o:p></p>
<p class="MsoNormal">(-)DELETE (-)DELETE_CHILD (-)CHOWN (-)EXEC/SEARCH (-)WRITE_ACL (-)WRITE_ATTR (-)WRITE_NAMED<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">special:owner@:rwxc:allow<o:p></o:p></p>
<p class="MsoNormal">(X)READ/LIST (X)WRITE/CREATE (X)APPEND/MKDIR (X)SYNCHRONIZE (X)READ_ACL (X)READ_ATTR (X)READ_NAMED<o:p></o:p></p>
<p class="MsoNormal">(-)DELETE (X)DELETE_CHILD (X)CHOWN (X)EXEC/SEARCH (X)WRITE_ACL (X)WRITE_ATTR (X)WRITE_NAMED<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">special:group@:rwx-:allow<o:p></o:p></p>
<p class="MsoNormal">(X)READ/LIST (X)WRITE/CREATE (X)APPEND/MKDIR (X)SYNCHRONIZE (X)READ_ACL (X)READ_ATTR (X)READ_NAMED<o:p></o:p></p>
<p class="MsoNormal">(-)DELETE (X)DELETE_CHILD (-)CHOWN (X)EXEC/SEARCH (-)WRITE_ACL (-)WRITE_ATTR (-)WRITE_NAMED<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Simon<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black"><gpfsug-discuss-bounces@spectrumscale.org> on behalf of Paul Ward <p.ward@nhm.ac.uk><br>
<b>Reply to: </b>"gpfsug-discuss@spectrumscale.org" <gpfsug-discuss@spectrumscale.org><br>
<b>Date: </b>Tuesday, 15 October 2019 at 13:34<br>
<b>To: </b>"gpfsug-discuss@spectrumscale.org" <gpfsug-discuss@spectrumscale.org><br>
<b>Subject: </b>[gpfsug-discuss] default owner and group for POSIX ACLs</span><span style="font-size:12.0pt;color:black;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">We are in the process of changing the way GPFS assigns UID/GIDs from internal tdb to using AD RIDs with an offset that matches our linux systems.<o:p></o:p></p>
<p class="MsoNormal">We, therefore, need to change the ACLs for all the files in GPFS (up to 80 million).<o:p></o:p></p>
<p class="MsoNormal">We are running in mixed ACL mode, with some POSIX and some NFSv4 ACLs being applied.<o:p></o:p></p>
<p class="MsoNormal">(This system was set up 14 years ago and has changed roles over time)<o:p></o:p></p>
<p class="MsoNormal">We are running on linux, so need to have POSIX permissions enabled.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">What I want to know for those in a similar environment, what do you have as the POSIX owner and group, when NFSv4 ACLs are in use?<o:p></o:p></p>
<p class="MsoNormal">root:root<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">or do you have all files owned by a filesystem administrator account and group:<o:p></o:p></p>
<p class="MsoNormal"><ad service account>:<ad fileserver admin group><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">on our samba shares we have :<o:p></o:p></p>
<p class="MsoNormal">admin users = @<ad fileserver admin group>
<o:p></o:p></p>
<p class="MsoNormal">So don’t actually need the group defined in POSIX.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-GB">Kindest regards,</span><o:p></o:p></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-GB">Paul</span><o:p></o:p></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-GB"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-GB">Paul Ward</span><o:p></o:p></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-GB">TS Infrastructure Architect</span><o:p></o:p></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-GB">Natural History Museum</span><o:p></o:p></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-GB">T: 02079426450</span><o:p></o:p></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-GB">E: p.ward@nhm.ac.uk</span><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</body>
</html>