Hi all, I have been unable to find clear information on this so apologies if this is a poor question for this mailing list. I have an NFS fileserver exporting to a client system where a web service manages files on behalf of logged-in users. In order to do this, the service must be able to manipulate ownership of files and directories, but it is undesirable to run the web service as root. The web service is given the `CAP_CHOWN` capability through `setcap(8)`. This works fine on a local filesystem but does not work under NFS. I have replicated this on a test server mounting as either NFS v3 or v4. To test, I make a copy of `/bin/chown` and give it the `CAP_CHOWN` capability. On a local filesystem, I can then, as myself, change the ownership of a file to some other user. On the NFS-mounted filesystem, I get `Operation not permitted`. I have tried this on v3 and v4 to the same result. (On v4.1 I receive “Invalid argument” whether as an unprivileged user or as root—I have not looked further into this as I suspect it’s irrelevant to my current problem.) In looking into ACLs to see if they may provide the answer, I came across the NFSv4 ACE permission of `o` for ownership. This seemed to me to be exactly what I needed. Unfortunately, while this permission appears to be accepted, it is not applied and has no effect: subsequent calls to `nfs4_getfacl` show no change, and ownership changes are still disallowed. I have tried enabling ACLs and user extended attributes on the exported filesystem, but they appear to have no effect. I understand that NFSv4 ACLs are not fully supported in Linux due to the inoperability with POSIX ACLs, however, a Linux-NFS wiki page on ACLs (http://wiki.linux-nfs.org/wiki/index.php/ACLs) describing the existing mapping of NFSv4 ACLs to POSIX ACLs states that while the mapping is imperfect, “it accepts most NFSv4 ACLs” and states the only exceptions have to do with explicit denies. I have looked briefly at the `richacls` project, but that’s not provided by either of the OS distributions I may use (Ubuntu or CentOS), and I don’t know either of the following: 1. Should it be possible for a user to be able to change the ownership of a file or directory over NFS, using Linux `CAP_CHOWN`? 2. Should the NFSv4 ACL “ownership” permission be settable in my environment? There are two fileservers. On one, the exported filesystem is ZFS; on the other (where I am doing most of my testing), the exported filesystem is ext4. At this stage I am open to using either NFS v3 or v4, and have tried both. A possible workaround is to have the software call an SUID copy of `chown` that is only available to the user ID of the web service, but this is less desirable. Any tips, information or guidance on this would be greatly appreciated. Thanks, Drew. ---- Drew Leske Senior Software Developer Développeur de logiciel principal drew.leske@xxxxxxxxxxxxxxxx -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
