Debian 10 Buster
Sponsored Link

NFS : NFS 4 ACL Tool2019/07/17
 
It's possible to set ACL on NFS(v4) filesystem to install NFS 4 ACL tool.
[1] Install NFS 4 ACL Tool on NFS clients that mounts NFS share with NFSv4.
root@node01:~#
apt -y install nfs4-acl-tools
[2] On this example, Configure on the environment like follows.
root@node01:~#
df -hT /mnt 

Filesystem                       Type  Size  Used Avail Use% Mounted on
dlp.srv.world:/var/lib/nfs/share nfs4   26G  1.1G   23G   5% /mnt
root@node01:~#
ll /mnt 

total 8
drwxr-xr-x 2 root root 4096 Jul 16 19:37 testdir
-rw-r--r-- 1 root root   10 Jul 16 19:37 test.txt
[3] Show ACL of a file or directory on NFSv4 filesystem.
root@node01:~#
nfs4_getfacl /mnt/test.txt 


A::OWNER@:rwatTcCy
A::GROUP@:rtcy
A::EVERYONE@:rtcy
root@node01:~#
nfs4_getfacl /mnt/testdir 


A::OWNER@:rwaDxtTcCy
A::GROUP@:rxtcy
A::EVERYONE@:rxtcy
# each entry means like follows

# ACE = Access Control Entry

# (ACE Type):(ACE Flags):(ACE Principal):(ACE Permissions)
Description
ACE Type  
A A = Allow : it means Allow accesses.
D D = Deny : it means Deny accesses.
ACE Flags  
d Directory-Inherit : New sub-directory inherits the same ACE.
f File-Inherit : New file inherits the same ACE but not inherit inheritance-flag.
n No-Propogate-Inherit : New sub-directory inherits the same ACE but not inherit inheritance-flag.
i Inherit-Only : New file/sub-directory inherits the same ACE but this directory does not have ACE.
ACE Principal  
(USER)@(NFSDomain) Common User
For [NFSDomain], it is just the Domain name that is specified for [Domain] value in [idmapd.conf].
(GROUP)@(NFSDomain) Common Group
For group, Specify [g] flag like this ⇒ A:g:GROUP@NFSDomain:rxtncy
OWNER@ Special Principal : Owner
GROUP@ Special Principal : Group
EVERYONE@ Special Principal : Everyone
ACE Permissions  
r Read data of files / List files in directory
w Write data to files / Create new files in directory
a Append data to files / Create new sub-directory
x Execute files / Change directory
d Delete files or directories
D Delete files or sub-directories under the directory
t Read attributes of files or directories
T Write attributes to files or directories
n Read named attributes of files or directories
N Write named attributes of files or directories
c Read ACL of files or directories
C Write ACL of files or directories
o Change ownership of files or directories
ACE Permissions Aliases For using nfs4_setfacl, possible to use Alias for ACE Permissions
R R = rntcy : Generic Read
W W = watTNcCy : Generic Write
X X = xtcy : Generic Execute

[4] Add or Delete ACE.
root@node01:~#
ll /mnt 

total 4
drwx------. 2 root root 26 Jul 20 19:12 testdir
-rwx------. 1 root root 10 Jul 20 19:11 test.txt
root@node01:~#
nfs4_getfacl /mnt/test.txt 


A::OWNER@:rwaxtTcCy
A::GROUP@:tcy
A::EVERYONE@:tcy
# add generic read/execute for [buster] user to [/mnt/test.txt] file

root@node01:~#
nfs4_setfacl -a A::buster@srv.world:rxtncy /mnt/test.txt
root@node01:~#
nfs4_getfacl /mnt/test.txt 


A::OWNER@:rwaxtTcCy
A::1000:rxtcy
A::GROUP@:tcy
A::EVERYONE@:tcy
# verify with [buster] user

buster@node01:~$
ll /mnt 

total 4
drwx------. 2 root root 26 Jul 21 10:12 testdir
-rwxr-x---. 1 root root 10 Jul 21 10:11 test.txt
buster@node01:~$
cat /mnt/test.txt

test file

# delete generic read/execute for [buster] user from [/mnt/test.txt] file

root@node01:~#
nfs4_setfacl -x A::1000:rxtcy /mnt/test.txt
root@node01:~#
nfs4_getfacl /mnt/test.txt 


A::OWNER@:rwaxtTcCy
A::GROUP@:tcy
A::EVERYONE@:tcy
[5] Edit ACL directly.
root@node01:~#
nfs4_setfacl -e /mnt/test.txt 


# run an editor on $EDITOR (if null, default is [vi] editor)
A::OWNER@:rwaxtTcCy
A::GROUP@:tcy
A::EVERYONE@:tcy
[6] Add ACE from a file.
# create ACL list

root@node01:~#
vi acl.txt 
A::buster@srv.world:RX
A::debian@srv.world:RWX
# add ACL from the file

root@node01:~#
nfs4_setfacl -A acl.txt /mnt/test.txt
root@node01:~#
nfs4_getfacl /mnt/test.txt 


A::OWNER@:rwaxtTcCy
A::1000:rxtcy
A::1001:rwaxtcy
A::GROUP@:tcy
A::EVERYONE@:tcy
[7] Replace current ACE to new ACE.
# create ACL list

root@node01:~#
vi acl.txt 
A::OWNER@:rwaxtTcCy
A::GROUP@:tcy
A::EVERYONE@:tcy
# replace ACL from the file

root@node01:~#
nfs4_setfacl -S acl.txt /mnt/test.txt
root@node01:~#
nfs4_getfacl /mnt/test.txt 


A::OWNER@:rwaxtTcCy
A::GROUP@:tcy
A::EVERYONE@:tcy
[8] Replace specific ACE to new ACE.
root@node01:~#
nfs4_getfacl /mnt/test.txt 


A::OWNER@:rwaxtTcCy
A::GROUP@:tcy
A::EVERYONE@:tcy
# replace EVERYONE's ACE to read/execute

root@node01:~#
nfs4_setfacl -m A::EVERYONE@:tcy A::EVERYONE@:RX /mnt/test.txt
root@node01:~#
nfs4_getfacl /mnt/test.txt 


A::OWNER@:rwaxtTcCy
A::GROUP@:rxtcy
A::EVERYONE@:rxtcy
Matched Content