Managing File Access Permissions by Using NFSv4.1 Access Control Lists (ACLs)

This section explains how to use Qumulo Core's implementation of NFSv4.1 with access control lists (ACLs) to manage access permissions for files.

The Qumulo Core implementation supports using AUTH_SYS credentials (also known as AUTH_UNIX), AUTH_NONE (which acts as AUTH_SYS but maps incoming UIDs and GIDs to nobody), and AUTH_KRB5, AUTH_KRB5P, or AUTH_KRB5I credentials. You can use the CLI tools in the nfs-acl-tools Linux package to allow or deny various operations.

For more information about NFSv4.1, see Enabling and Using NFSv4.1 on a Qumulo Cluster.

Using the NFSv4.1 CLI Commands to Manage ACLs

In most Linux distributions, the nfs-acl-tools package contains the NFSv4.1 commands that let you manage ACLs for files.

Showing the ACL of a File

To show the ACL of a file, run the nfs4_getfacl command. In the following example, we create the file my-file and then show the ACL for it.

touch /mnt/qumulo/my-file && \
  nfs4_getfacl /mnt/qumulo/my-file

The following is example output.

A::user1@domain.example.com:rwatTnNcy
A:g:group1@domain.example.com:rwatTnNcy
A::EVERYONE@:rtncy

The entries in the ACL have four parts separated by colons (:). For more information, see the nfs4_acl in the Linux documentation.

The ACL in this example corresponds to 664 mode: The owner (user1) and group (group1) of the file are allowed to read and write, while others (EVERYONE@) are allowed to only read. To check the current mode, run the stat command, for example:

stat -c %a /mnt/qumulo/my-file

The following is example output.

664

Editing the ACL of a File

To edit the ACL of a file (by using the text editor specified in the $EDITOR environment variable), run the nfs4_editfacl command (or the nfs4_setfacl command with the -e flag).

Setting the ACL of a File

To set the ACL of a file, you can use one of the following commands:

• Add a Single ACE: nfs4_setfacl -a <ace>
• Set an Entire ACL: nfs4_setfacl -s <acl>

Configuring Access Control Entries (ACEs) and Trustee Representation

There are four fields in the nfs4_acl syntax, separated by colons (:):

• The ACE type
• Additional ACE flags
• The trustee to which the ACE applies
• The access types to which the ACE applies

ACE Type

In the example of the file ACL, all three ACEs are set to A (allow).

• A: Allow
• D: Deny
• U: Audit
• L: Alarm

Additional ACE Flags

In the example of the file ACL, the second ACE has the flag g that shows that the ID in the following part represents a group (rather than a user).

The Trustee to Which the ACE Applies

You can use the following trustee representation formats.

You can use all trustee representations interchangeably, even within a single ACL. For example, the following ACL is possible for a file:

nfs4_getfacl /mnt/qumulo/my-file

The following is example output.

A::user1@domain.example.com:rwatTnNcy
A:g:group1@domain.example.com:rwatTnNcy
A::1234:rwatTnNcy
A:g:5678:rwatTnNcy
A::S-1-5-8-9:rwatTnNcy
A:g:S-1-5-32-544:rwatTnNcy
A::qumulo_local/localuser1:rwatTnNcy
A:g:qumulo_local/localgroup1:rwatTnNcy
A::EVERYONE@:rtncy

The Access Types to Which the ACE Applies

For example:

• r: Read
• t: Read attributes
• w: Write

The nfs4_setfacl command also lets you use the following shorthand:

• R: Generic read
• W: Generic write
• X: Execute permissions

Managing NFSv4.1 Permissions with ACLs and POSIX-Style Modes

You can manage NFSv4.1 access permissions by using ACLs, POSIX-style modes, or a combination of both.

• If you set an ACL on a file and then also set a mode on it, the restrictions that the mode expresses also apply to the ACL. These restrictions change or remove ACEs that apply to the owner, group, or other users.

• If you use the OWNER@ or GROUP@ identifiers in an ACL that allows read, write, or execute permissions, the identifiers appear in the owner or group bits of the mode when you read the file’s mode.

Using NFSv4.1 ACLs with SMB Access Control

NFSv4.1 ACLs are interoperable with SMB access controls. You can write and read by using both protocols. When you edit over NFS, the system represents SMB SIDs Kerberos principals.

Changing File Owners

When you change the owner of a file, the ACEs that refer to the owner change to the new owner, for example:

Example 1

nfs4_getfacl /mnt/qumulo/my-file

The following is example output.

A::user1@domain.example.com:rwatTnNcy
A:g:group1@domain.example.com:rwatTnNcy
A::EVERYONE@:rtncy

Example 2

sudo chown user2 /mnt/qumulo/my_file && \
  nfs4_getfacl /mnt/qumulo/my-file

The following is example output.

A::user2@domain.example.com:rwatTnNcy
A:g:group1@domain.example.com:rwatTnNcy
A::EVERYONE@:rtncy

Using Equivalent NFSv4.1 and Qumulo ACL Commands

The syntax for the nfs4_setfacl command is <type>:<flags>:<principal>:<permissions>, for example A:fd:GROUP@:rwaDdxtTnNcCoy. You can use equivalent NFS (nfs4_setfacl) and Qumulo (qq fs_modify_acl) CLI commands to set ACL permissions.

The following tables compare elements of NFS and Qumulo ACL permissions.

The following table gives examples of permissions and equivalent NFS and Qumulo CLI commands.

nfs4_setfacl \
  -a "A::OWNER@:R" \
  myfile.ext

qq fs_modify_acl \
  --path /myfile.ext \
  add_entry \
  -y Allowed \
  -t "File Owner" \
  -r 'Read' 'Read EA' 'Read attr' 'Read ACL' 'Synchronize'

nfs4_setfacl \
  -a "A::EVERYONE@:rtRX" \
  myfile.ext

qq fs_modify_acl \
  --path /myfile.ext \
  add_entry \
  -y Allowed \
  -t "EVERYONE" \
  -r 'Read' 'Read attr' 'Read EA' 'Read ACL' 'Synchronize' 'Execute/Traverse'

nfs4_setfacl \
  -a "A::GROUP@:rtwRWX" \
  myfile.ext

qq fs_modify_acl \
  --path /myfile.ext \
  add_entry \
  -y Allowed \
  -t "File Group Owner" \
  -r 'Read' 'Read attr' 'Write file' 'Read EA' 'Read ACL' 'Synchronize' 'Extend file' 'Write attr' 'Write EA' 'Write ACL' 'Execute/Traverse'

nfs4_setfacl \
  -a "A::GROUP@:rwaDdxtTnNcCoy" \
  myfile.ext

qq fs_modify_acl \
  --path /myfile.ext \
  add_entry \
  -y Allowed \
  -t "File Group Owner" \
  -r All

nfs4_setfacl \
  -a "D::OWNER@:wx" \
  myfile.ext

qq fs_modify_acl \
  --path /myfile.ext \
  add_entry \
  -y Denied \
  -t "File Owner" \
  -r 'Write file' 'Execute/Traverse'

nfs4_setfacl \
  -a "A:fd:GROUP@:rwaDdxtTnNcCoy" \
  mydirectory

qq fs_modify_acl \
  --path /mydirectory \
  add_entry \
  -y Allowed \
  -t "File Group Owner" \
  -r All \
  -f 'Container inherit' 'Object inherit'

Related Topics

• Creating and Managing an NFS Export
• Enabling and Using NFSv4.1
• Host Access Rules for NFS Exports