NFS ACL security descriptor

sinuhe · 10-31-2017, 01:43 PM

Is there a way to remove the security descriptor once added? Think "setfacl -b" if using POSIX(-proposed) FACLs.

Linux NFSv4 mount:

Code:

$ mkdir foo

NetApp:

Code:

host::> vserver security file-directory show -vserver bar -path /vol/share/foo

                Vserver: bar
              File Path: /vol/share/foo
      File Inode Number: 97
         Security Style: unix
        Effective Style: unix
         DOS Attributes: 10
 DOS Attributes in Text: ----D---
Expanded Dos Attributes: -
           UNIX User Id: 0
          UNIX Group Id: 66666
         UNIX Mode Bits: 2755
 UNIX Mode Bits in Text: rwxr-sr-x
                   ACLs: -

Edit foo with nfs4_editfacl and save (without changes):

Code:

host::> vserver security file-directory show -vserver bar -path /vol/share/foo

                Vserver: bar
              File Path: /vol/share/foo
      File Inode Number: 97
         Security Style: unix
        Effective Style: unix
         DOS Attributes: 10
 DOS Attributes in Text: ----D---
Expanded Dos Attributes: -
           UNIX User Id: 0
          UNIX Group Id: 66666
         UNIX Mode Bits: 2755
 UNIX Mode Bits in Text: rwxr-sr-x
                   ACLs: NFSV4 Security Descriptor
                         Control:0x8014
                         DACL - ACEs
                           ALLOW-OWNER@-0x1601ff
                           ALLOW-GROUP@-0x1200a9-IG
                           ALLOW-EVERYONE@-0x1200a9

Everything but one ACE can be removed, but the last ACE cannot.

Is there a way to identify with nfs4_getfacl, or another tool, whether an actual security descriptor exists? nfs4_getfacl seems unable to distinguish the above, but instead assumes the ACL with the descriptor is there or not.

sinuhe · 01-10-2018, 02:41 PM

It appears that the answer is no. NTFS file descriptors can be individually removed by applying a configuration file-based ACE removal, but this is not supported with NFS. The last (EVERYONE@) ACE always refuses to remove. Using 'nfs4_setfacl -X', mimicking the NTFS approach, fails with the same result. This is confirmed by NetApp support.

sinuhe · 01-10-2018, 02:42 PM

Unless there's a mixed mode configuration I'm unaware of, I'd say NFSv4 FACLs on NetApp is a botch with mixed mounts.