<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;
mso-fareast-language:EN-US;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1368598769;
mso-list-type:hybrid;
mso-list-template-ids:920534014 134807569 134807577 134807579 134807567 134807577 134807579 134807567 134807577 134807579;}
@list l0:level1
{mso-level-text:"%1\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hello,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We’ve been using nfs4_get/setfacl to manage nfs4 acls as an alternative to the mm commands for a few months. It mostly works pretty well – in particular it’s simple to set permissions with inheritance flags recursively on a directory structure
and it’s easy to add an ace for a user/group without affecting existing permissions.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We’ve noticed though that when permissions have been changed via SMB they get these DACL ACL flags set:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"># mmgetacl NewTest<o:p></o:p></p>
<p class="MsoNormal">#NFSv4 ACL<o:p></o:p></p>
<p class="MsoNormal">#owner:ICR\rhorton<o:p></o:p></p>
<p class="MsoNormal">#group:ICR\infotech<o:p></o:p></p>
<p class="MsoNormal">#ACL flags:<o:p></o:p></p>
<p class="MsoNormal"># DACL_PRESENT<o:p></o:p></p>
<p class="MsoNormal"># DACL_AUTO_INHERITED<o:p></o:p></p>
<p class="MsoNormal"># SACL_AUTO_INHERITED<o:p></o:p></p>
<p class="MsoNormal"># NULL_SACL<o:p></o:p></p>
<p class="MsoNormal">user:ICR\rhorton:r-x-:allow:FileInherit:DirInherit<o:p></o:p></p>
<p class="MsoNormal">(X)READ/LIST (-)WRITE/CREATE (-)APPEND/MKDIR (X)SYNCHRONIZE (X)READ_ACL (X)READ_ATTR (X)READ_NAMED<o:p></o:p></p>
<p class="MsoNormal">(-)DELETE (-)DELETE_CHILD (-)CHOWN (X)EXEC/SEARCH (-)WRITE_ACL (-)WRITE_ATTR (-)WRITE_NAMED<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">…which upsets nfs4_getfacl:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"># nfs4_getfacl NewTest<o:p></o:p></p>
<p class="MsoNormal"># file: NewTest<o:p></o:p></p>
<p class="MsoNormal">A::bin:C<o:p></o:p></p>
<p class="MsoNormal">Bad Ace Type:768<o:p></o:p></p>
<p class="MsoNormal">Error while printing ACE.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">It gets worse if someone does a nfs4_getfacl -R -a <new ace> as it sometimes ends up replacing the existing ACEs with one for a ‘bin’ user.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’m guessing that with ACL flags present the presented system.nfs4_acl extended attribute isn’t in a form that nfs4-acl-tools expects..?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">So…<o:p></o:p></p>
<ol style="margin-top:0cm" start="1" type="1">
<li class="MsoListParagraph" style="margin-left:0cm;mso-list:l0 level1 lfo1">What do the DACL flags actually do? Where are they stored? Is there a way to check for / modify them? I can see them referenced in
<a href="https://www.ibm.com/docs/en/storage-scale/5.1.9?topic=users-authorizing-file-protocol">
https://www.ibm.com/docs/en/storage-scale/5.1.9?topic=users-authorizing-file-protocol</a> but still not entirely clear. Is it possible to get the Samba gpfs module to not set them? I’m guessing not from
<a href="https://www.samba.org/samba/docs/current/man-html/vfs_gpfs.8.html">https://www.samba.org/samba/docs/current/man-html/vfs_gpfs.8.html</a><o:p></o:p></li><li class="MsoListParagraph" style="margin-left:0cm;mso-list:l0 level1 lfo1">Am I right in thinking this is a Scale bug? If so is it possible to get it fixed
<span style="font-family:"Segoe UI Emoji",sans-serif">😉</span> ?<o:p></o:p></li><li class="MsoListParagraph" style="margin-left:0cm;mso-list:l0 level1 lfo1">How do other people manage ACLs?<o:p></o:p></li></ol>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Background: It’s an ESS5000. Client access is via a remote mount to an HPC system, a large number of Windows/Mac/few Linux SMB clients and a handful of NFS (4) clients via CES. We’re on 5.1.9, although the cluster and fs versions are a
bit behind. -k is nfs4.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Any thoughts appreciated!<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal">Rob<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="line-height:13.5pt"><b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#616365;mso-ligatures:none;mso-fareast-language:EN-GB">Robert Horton</span></b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#616365;mso-ligatures:none;mso-fareast-language:EN-GB">
| Scientific Computing Infrastructure Lead<o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:13.5pt"><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#616365;mso-ligatures:none;mso-fareast-language:EN-GB">The Institute of Cancer Research | 237 Fulham Road, London, SW3 6JB<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-top:7.5pt;line-height:13.5pt"><b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#616365;mso-ligatures:none;mso-fareast-language:EN-GB">T</span></b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#616365;mso-ligatures:none;mso-fareast-language:EN-GB">
+44 (0) 20 7153 5350 | <b>E</b> <a href="mailto:robert.horton@icr.ac.uk"><span style="color:#616365;border:none windowtext 1.0pt;padding:0cm">robert.horton@icr.ac.uk</span></a> |
<b>W</b> <a href="http://www.icr.ac.uk/"><span style="color:#616365;border:none windowtext 1.0pt;padding:0cm">www.icr.ac.uk</span></a> |
<b>Twitter</b> <a href="https://twitter.com/ICR_London"><span style="color:#616365;border:none windowtext 1.0pt;padding:0cm">@ICR_London</span></a><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:13.5pt"><b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#616365;mso-ligatures:none;mso-fareast-language:EN-GB">Facebook</span></b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#616365;mso-ligatures:none;mso-fareast-language:EN-GB">
<a href="http://www.facebook.com/theinstituteofcancerresearch"><span style="color:#616365;border:none windowtext 1.0pt;padding:0cm">www.facebook.com/theinstituteofcancerresearch</span></a><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:7.5pt;margin-right:0cm;margin-bottom:18.75pt;margin-left:0cm">
<b><span style="font-size:10.0pt;font-family:"Times New Roman",serif;color:#616365;mso-ligatures:none;mso-fareast-language:EN-GB">Making the discoveries that defeat cancer<o:p></o:p></span></b></p>
<p class="MsoNormal"><a href="http://www.icr.ac.uk/"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;color:blue;mso-fareast-language:EN-GB;text-decoration:none"><img border="0" width="207" height="43" style="width:2.1562in;height:.4479in" id="Picture_x0020_1" src="cid:image001.gif@01DA68CD.ADBB0430" alt="ICR Logo"></span></a><span style="font-size:12.0pt;font-family:"Times New Roman",serif;color:#616365;mso-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p>The Institute of Cancer Research: Royal Cancer Hospital, a charitable Company Limited by Guarantee, Registered in England under Company No. 534147 with its Registered Office at 123 Old Brompton Road, London SW7 3RP.
</p>
<p>This e-mail message is confidential and for use by the addressee only. If the message is received by anyone other than the addressee, please return the message to the sender by replying to it and then delete the message from your computer and network.
</p>
</body>
</html>