Differences

This shows you the differences between two versions of the page.

--- nfsv4_acls [2010/04/20 17:18] – Everything went into STABLE. EdwardTomaszNapierala
+++ nfsv4_acls [2021/03/30 08:27] (current) – Remove plaintext email, link to HomePage instead KubilayKocak
@@ Line 1: / Line 1: @@
-The aim of this project was to add native NFSv4 ACLs implementation - user/admin tools, userland libraries and kernel support for both UFS and ZFS - to the %%FreeBSD%% operating system, along with regression tests and documentation.  Code is already in HEAD; the [[Perforce]] branch used to develop it was "%%//%%depot/projects/soc2008/trasz_nfs4acl/...".  List of changes is here: http://perforce.freebsd.org/changeList.cgi?FSPC=//depot/projects/soc2008/trasz%5fnfs4acl/...
+The aim of this project was to add native NFSv4 ACLs implementation - user/admin tools, userland libraries and kernel support for both UFS and ZFS - to the %%FreeBSD%% operating system, along with regression tests and documentation.  Code is already in stock %%FreeBSD%%; the Perforce branch used to develop it was "%%//%%depot/projects/soc2008/trasz_nfs4acl/...".
+If you have any questions or suggestions regarding NFSv4 ACL support, feel free to contact me: EdwardTomaszNapierala
 ===== Current state =====
-Libc and some of the kernel changes were released as part of %%FreeBSD%% 8.0.  Userland utilities, regression tests, support for NFSv4 ACLs in ZFS and UFS were MFCd to %%FreeBSD%% 8 and will appear in %%FreeBSD%% 8.1.
+Libc and some of the kernel changes were released as part of %%FreeBSD%% 8.0.  Userland utilities, regression tests, support for NFSv4 ACLs in ZFS and UFS were released in %%FreeBSD%% 8.1.  In %%FreeBSD%% 9.0 the semantics was changed to match PSARC/2010/029 (http://arc.opensolaris.org/caselog/PSARC/2010/029/20100126_mark.shellenbaum ).
 ===== API =====
@@ Line 18: / Line 20: @@
 . Because of #3, Darwin developers reused acl_{get,set}_tag_type to set ACL entry type, i.e. "allow" or "deny" etc.
-In %%FreeBSD%%, there is another set of routines, acl_{get,set}_entry_type_np (e.g. acl_set_entry_type_np(aclp, ACL_EXTENDED_ALLOW%%))%%.
+In %%FreeBSD%%, there is another set of routines, acl_{get,set}_entry_type_np (e.g. acl_set_entry_type_np(aclp, ACL_ENTRY_TYPE_ALLOW%%))%%.
 One curious detail of this implementation - fortunately not visible to the API users - is the "branding": libc needs to keep track of what "brand" ACL is, whether it's NFSv4, POSIX.1e or unknown.  It works automatically - for example, during acl_get_file(3) ACL gets branded according to the "type" argument; during acl_set_permset ACL, if its brand is unknown, it gets branded as NFSv4 if any of the NFSv4 permissions that are not valid for POSIX.1e ACL are set etc.  Branding information is used for printing out the ACL (acl_to_text(3%%))%%, veryfying acl_set_whatever arguments (checking against setting bits that are valid only for NFSv4 in ACL branded as POSIX.1e) etc.  Application may check the brand of the ACL given using acl_get_brand_np(3).
@@ Line 46: / Line 48: @@
          everyone@:rwxp---A-W-Co-:------:deny
          everyone@:------a-R-c--s:------:allow
 [trasz@traszkan:/tmp]$ getfacl -v blah
 # file: blah
 # owner: trasz
@@ Line 89: / Line 91: @@
          everyone@:rwxp---A-W-Co-:------:deny
          everyone@:------a-R-c--s:------:allow
 [trasz@traszkan:/tmp]$ setfacl -x everyone@:rwxp---A-W-Co-:------:deny blah
 [trasz@traszkan:/tmp]$ getfacl blah
 # file: blah
 # owner: trasz
@@ Line 99: / Line 101: @@
             group@:--------------:------:allow
          everyone@:------a-R-c--s:------:allow
 [trasz@traszkan:/tmp]$ chmod 644 blah
 [trasz@traszkan:/tmp]$ getfacl blah
 # file: blah
 # owner: trasz
@@ Line 115: / Line 117: @@
          everyone@:-wxp---A-W-Co-:------:deny
          everyone@:r-----a-R-c--s:------:allow
 [trasz@traszkan:/tmp]$
 </code>
@@ Line 146: / Line 148: @@
 Instead of adding support for the new API to Samba and possibly other software, I decided to write a wrapper that implements %%SunOS%%-compatible API (acl(3)/facl(3%%))%% using %%FreeBSD%% system calls.  It is available in the %%FreeBSD%% Ports Collection, as sysutils/libsunacl.  Code can be found at http://sourceforge.net/projects/libsunacl/.  Porting should be simple - in application you want to make work, change "%%<%%sys/acl.h>" into "%%<%%sunacl.h>"; then link with libsunacl.
+===== FAQ =====
+Q: Inheritance doesn't work the way I expect; access is denied while it shouldn't be.
+A: Set "aclmode=passthrough" and "aclinherit=passthrough" ZFS properties.  For UFS, you're out of luck, I'm afraid; there is no way to change the behaviour there.