[gpfsug-discuss] Copying ACLs from outside sources

[Jonathan Buzzard]

On 09/10/13 18:31, Fosburgh,Jonathan wrote:
>
>
> On 10/3/13 4:23 AM, "Jonathan Buzzard" <jonathan at buzzard.me.uk> wrote:
>
>>
>>>
>>
>> I guess the first thing to do is confirm that you have functioning
>> CIFS's ACL's in your Samba GPFS file server. Specifically you would need
>> to have NFSv4 ACL's enabled in the file system and the gpfs VFS module
>> loaded in Samba. Note having mixed ACL modes did not work very well for
>> me, so best to turn off Posix ACL's and only do NFSv4 ACL's.
>>
> Thank you for the response. We have been able to make some headway on
> this, but I am still bumping up on some issues.  It looks as if, when an
> NFSv4 ACL is already present on the parent directory tree, copying acls
> via robocopy works. However, if there is a posix ACL present, then the
> ACLs are still not copied correctly.  I was interested in setting the ACL
> mode to nfs4 only (currently set to all), however, I have some
> reservations about this.
>

Like I said in my experience having both Posix and NFSv4 ACL's active at 
the same time did not work properly as you have found out. You have to 
pick one and stick with it. Clearly if you have an existing system with 
both ACL types on then you have problems.

> The NFS server is Red Hat, and I need to be able to server version 3 and
> version 4, plus we will have native GPFS clients and the CIFS clients.
> What are the ramifications, in this setup, of changing the ACL type? What
> would happen to any existing ACLs?

My guess is the Posix ACL's either get lost or are "converted" into 
NFSv4 ACL's. I would try this out on your "development/test" GPFS setup 
first and work out a strategy for moving forward.

The biggest problem is that the IBM provided tools for manipulating the 
GPFS ACL's from within Linux are awful.


JAB.

-- 
Jonathan A. Buzzard                 Email: jonathan (at) buzzard.me.uk
Fife, United Kingdom.