<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size: 11pt; color: rgb(0, 0, 0);"><b>From:</b> gpfsug-discuss <gpfsug-discuss-bounces@gpfsug.org> on behalf of Christof Schmitt <christof.schmitt@us.ibm.com><br>
<b>Sent:</b> 14 September 2023 18:02<br>
<b>To:</b> gpfsug-discuss@gpfsug.org <gpfsug-discuss@gpfsug.org><br>
<b>Subject:</b> Re: [gpfsug-discuss] Unexpected permissions with ACLs</font>
<div class="elementToProof"> <span style="">> following:</span></div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText elementToProof">> <br>
> special:group@:rwx-:allow:DirInherit:InheritOnly<br>
> (X)READ/LIST (X)WRITE/CREATE (X)APPEND/MKDIR (X)SYNCHRONIZE<br>
> (X)READ_ACL (X)READ_ATTR (X)READ_NAMED<br>
> (-)DELETE (X)DELETE_CHILD (X)CHOWN (X)EXEC/SEARCH<br>
> (X)WRITE_ACL (X)WRITE_ATTR (X)WRITE_NAMED<br>
> <br>
> According to the manual, the DirInherit:InheritOnly should guarantee<br>
> that the entry applies only to the new subdirectories but now it is<br>
> also affecting new files in the main dir.<br>
> Is this an expected behavior? <br>
<br>
>From an ACL perspective, yes. "InheritOnly" indicates that this entry<br>
does not grant any permissions on the directory. It is only copied<br>
as an entry to new files or subdirectories created in this directory.<br>
So if this is the only ACL entry, there are indeed no permissions on<br>
this directory.<br>
<br>
You can remove the "InheritOnly" bit, then this would also grant<br>
permission on the directory. Or you can add another ACL entry that<br>
grants permissions on the directory.<br>
<br>
</div>
<div class="PlainText elementToProof"><br>
</div>
<div class="PlainText elementToProof">I may have not been clear enough, but that ACE has only been added to the previous 3 ACEs, so the complete one for the directory is the following:</div>
<div class="PlainText elementToProof"><br>
</div>
<div class="PlainText elementToProof ContentPasted0">#NFSv4 ACL
<div class="ContentPasted0">#owner:root</div>
<div class="ContentPasted0">#group:p15875</div>
<div class="ContentPasted0">special:owner@:rwxc:allow</div>
<div class="ContentPasted0"> (X)READ/LIST (X)WRITE/CREATE (X)APPEND/MKDIR (X)SYNCHRONIZE (X)READ_ACL (X)READ_ATTR (X)READ_NAMED</div>
<div class="ContentPasted0"> (-)DELETE (X)DELETE_CHILD (X)CHOWN (X)EXEC/SEARCH (X)WRITE_ACL (X)WRITE_ATTR (X)WRITE_NAMED</div>
<div><br class="ContentPasted0">
</div>
<div class="ContentPasted0">special:group@:rwx-:allow</div>
<div class="ContentPasted0"> (X)READ/LIST (X)WRITE/CREATE (X)APPEND/MKDIR (X)SYNCHRONIZE (X)READ_ACL (X)READ_ATTR (X)READ_NAMED</div>
<div class="ContentPasted0"> (-)DELETE (X)DELETE_CHILD (X)CHOWN (X)EXEC/SEARCH (X)WRITE_ACL (X)WRITE_ATTR (X)WRITE_NAMED</div>
<div><br class="ContentPasted0">
</div>
<div class="ContentPasted0">special:everyone@:----:allow</div>
<div class="ContentPasted0"> (-)READ/LIST (-)WRITE/CREATE (-)APPEND/MKDIR (X)SYNCHRONIZE (X)READ_ACL (X)READ_ATTR (X)READ_NAMED</div>
<div class="ContentPasted0"> (-)DELETE (-)DELETE_CHILD (-)CHOWN (-)EXEC/SEARCH (-)WRITE_ACL (-)WRITE_ATTR (-)WRITE_NAMED</div>
<div><br class="ContentPasted0">
</div>
<div class="ContentPasted0">special:owner@:rwx-:allow:DirInherit:InheritOnly</div>
<div class="ContentPasted0"> (X)READ/LIST (X)WRITE/CREATE (X)APPEND/MKDIR (X)SYNCHRONIZE (X)READ_ACL (X)READ_ATTR (X)READ_NAMED</div>
<div class="ContentPasted0"> (-)DELETE (X)DELETE_CHILD (X)CHOWN (X)EXEC/SEARCH (X)WRITE_ACL (X)WRITE_ATTR (X)WRITE_NAMED</div>
<br>
</div>
<div class="PlainText elementToProof ContentPasted0">So I would expect that the first 3 would still produce a 644 mode on the file. Am I wrong?</div>
<div class="PlainText elementToProof ContentPasted0">Cheers,</div>
<div class="PlainText elementToProof ContentPasted0">Ivano</div>
</span></font></div>
</body>
</html>