[gpfsug-discuss] mmchfs -k nfs4 impacts?

[Losen, Stephen C (scl)]

Hi Jonathan,
We are running SS 5.0.5.7 and a POSIX default ACL is converted to nfs4 ACEs with the FileInherit:DirInherit:InheritOnly flags. The corresponding active POSIX ACL is converted to nfs4 ACEs with no inheritance flags. So the two POSIX ACLs result in a single, rather large nfs4 ACL.

Steve Losen
Research Computing
University of Virginia
scl at virginia.edu   434-924-0640

On 8/30/22, 4:48 AM, "gpfsug-discuss on behalf of Jonathan Buzzard" <gpfsug-discuss-bounces at gpfsug.org on behalf of jonathan.buzzard at strath.ac.uk> wrote:

    On 29/08/2022 22:18, Losen, Stephen C (scl) wrote:
    > 
    > Hi Jonathan, Thanks for your reply. I didn't see "-k samba" in the
    > docs. 

    You won't it's "undocumented" in the manual page but documented right at 
    the top of the mmchfs Korn shell script as being an option, but not 
    description as to what it actually does.

    My best guess is that it makes the NFSv4.1 ACL's behave more like NTFS 
    ACL's. Especially in combination with the no directory traversal option. 
    I seem to recall that option is documented too, but it is rather self 
    explanatory.

    I think these where all put in for the old SONAS storage system that IBM 
    used to sell to make it more "MS Windows" like. This was all before 
    there was such things as "protocol" nodes of course.

    > I'll look some more. Also I didn't mention that we also need
    > NFSv4 access and native GPFS, this will not be SMB-only. It will
    > actually be mostly GPFS native. I don't think existing ACLs will be
    > adversely affected.

     From recollection think again. At best the existing POSIX ACL's will 
    get converted to NFSv4 ACL's. From recollection things go screwy when 
    you have default POSIX ACL's because they don't map to NFSv4 and then 
    you create new files now what. Of course this might have changed or I 
    might have got it wrong as this was experimentation I did over a decade 
    ago on probably GPFS 3.0 or 3.1

    I would strongly recommend creating a test GPFS filesystem adding some 
    POSIX ACL's in then converting it to NFSv4 only and checking out how the 
    ACL's work with the creation of new files.

    > In a test filesystem with "-k all" I set some
    > POSIX ACLs and converted the filesystem to "-k nfs4" and the result
    > looked reasonable.  Plus I ran mmgetacl -k nfs4 on numerous
    > files/dirs with POSIX ACLs in our production filesystem and the
    > results looked promising.
    > 
    > Glad to know that switching the filesystem to -k nfs4 won't be a huge
    > performance hit.
    > 

    I have taken the approach since my experimentation in circa 2010 that 
    you can do everything you can do with POSIX ACL's with NFSv4 ACLS so why 
    bother with the former. Just stick to the latter and you won't have 
    problems down the line switching to NFSv4 ACL's.


    JAB.

    --  Jonathan A. Buzzard                         Tel: +44141-5483420
    HPC System Administrator, ARCHIE-WeSt.
    University of Strathclyde, John Anderson Building, Glasgow. G4 0NG

    _______________________________________________
    gpfsug-discuss mailing list
    gpfsug-discuss at gpfsug.org
    http://gpfsug.org/mailman/listinfo/gpfsug-discuss_gpfsug.org