<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hello all,<o:p></o:p></p>
<p class="MsoNormal">Sort of on this topic has anyone have a transfer tool like rsync or mmxcp that transfers the NFSv4 ACL’s correctly?<o:p></o:p></p>
<p class="MsoNormal">Thanks<o:p></o:p></p>
<p class="MsoNormal">Matt<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">gpfsug-discuss <gpfsug-discuss-bounces@gpfsug.org> on behalf of Anh Dao <adao@ibm.com><br>
<b>Date: </b>Wednesday, September 7, 2022 at 3:48 PM<br>
<b>To: </b>gpfsug-discuss@gpfsug.org <gpfsug-discuss@gpfsug.org><br>
<b>Subject: </b>Re: [gpfsug-discuss] NF4 ACLs (Joshua Taylor)<o:p></o:p></span></p>
</div>
<p class="MsoNormal">In-Reply-To: <a href="mailto:CAGhSTwiMcszfSE0JmqAmooLE9yBGbd_v1tHsJAWuan1Rk4CRAA@mail.gmail.com">
CAGhSTwiMcszfSE0JmqAmooLE9yBGbd_v1tHsJAWuan1Rk4CRAA@mail.gmail.com</a><br>
<br>
In Linux, chown has the following note:<br>
man 2 chown<br>
“Only a privileged process (Linux: one with the CAP_CHOWN capability) may change the owner of a file.<o:p></o:p></p>
<p class="MsoNormal"> The owner of a file may change the group of the file to any group of which that owner is a member.<o:p></o:p></p>
<p class="MsoNormal"> A privileged process (Linux: with CAP_CHOWN) may change the group arbitrarily.”<br>
<br>
Scale now adds NFSv4 ACLs, and the CHOWN permission is basically an additional restriction on top of what Linux does. Since Scale is only invoked after Linux has perform its checks (chown_ok
<a href="https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgit.kernel.org%2Fpub%2Fscm%2Flinux%2Fkernel%2Fgit%2Fstable%2Flinux.git%2Ftree%2Ffs%2Fattr.c%3Fh%3Dv5.19.7&data=05%7C01%7Cmweil%40wustl.edu%7Cb25ddd2794eb41a6f86708da911247d5%7C4ccca3b571cd4e6d974b4d9beb96c6d6%7C0%7C0%7C637981804950298764%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=EIItawyb55fEtyeHgOR2Tk4x9Ooja4cCHJbqVFdDJzQ%3D&reserved=0">
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/fs/attr.c?h=v5.19.7</a>), it cannot overcome the restrictions in place in the Linux VFS.<br>
<br>
Regarding the wrapper mentioned, the admin (root) is certainly able to implement such setuid wrapper, but they should be very careful on the security aspects of doing so. This seems risky for Scale to implement such program.<br>
<br>
Regards,<br>
Anh Dao<br>
IBM Spectrum Scale<br>
Software Developer<br>
adao@ibm.com<br>
<br>
<br>
<o:p></o:p></p>
</div>
</body>
</html>