2009/3/19, J. Bruce Fields <bfields@xxxxxxxxxxxx>: > On Wed, Mar 18, 2009 at 06:42:10PM +0100, Alex Bremer wrote: >> However on a client >> using NFS4, these Posix-ACLs don't seem to get mapped to NFS4-ACLs. > > Actually, they do; what's happening (I believe--this is partly just > memory based on last time I looked at something like this) is more > subtle: the umask is being overridden by inheritance in the v2/v3 case, > and not in the v4 case. > > Posix default acls are supposed to override the umask. This is tricky > for NFS, since the umask isn't sent over the wire on file creation, > leaving the client and server no way to distinguish the create mode from > the umask. The v2/v3 client currently works around this by doing the > whole inheritance calculation on the client (reading the directory's > acl, then explicitly setting the new child's acl based on it). The v4 > client doesn't do that. So: So is there any way to make newly created files group writeable except for setting the umask of each user to 002? Setting the umask to 002 is not an option for us, but all files in the public area have to be group writeable. Is there maybe a mount option to set the umask or a server sided option which enforces the group writeable flag? I would expect that my use case is not that uncommon and that many companys have the exact same problem. Would the inheritance work if we used a fully NFS4-ACL compatible filesystem? Is there any for Linux? How do other people share public files with NFS4? If there is no other way than setting the users's umask to 002, this would practically limit the use of NFS4 to private shares like home directories. I can't tell my users to change the permissions after creating a file. Some of them do not even know what permissions are. > There are no nfsv4 acls on the filesystem at all, so everything is done > by mapping to and from the filesystem's posix acls. So I guess there is no NFS4-ACL compliant filesystem for linux either? :-( >> Another question: If I add the mount option "user_xattr" to the nfs4 >> exported filesystems, on the client side all permissions are shown as >> "nobody:nogroup". Why is that? > > That's bizarre. Neither server nor client nor idmapd should be using > user extended attributes at all. Are you sure you something else wasn't > changed at the same time? Oh, you are right. I just gave it another try and now it works. Don't know what happened. Last time I tried it, the only thing I changed was the user_xattr mount option and I got all owner:group entries as nobody:nogroup. I changed the flag back and it worked again. Now it even works with user_xattr on. Alex -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
