<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="text-align:left; direction:ltr;">
<div><br>
</div>
<div><br>
</div>
<div>On Sat, 2019-04-06 at 23:50 +0200, Michal Zacek wrote:</div>
<blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex">
<div dir="ltr">
<pre>Hello,</pre>
<pre><br></pre>
<pre>we decided to convert NFS4 acl to POSIX (we need share same data </pre>
<pre>between SMB, NFS and GPFS clients), so I created script to convert </pre>
<pre>NFS4 to posix ACL. It is very simple, first I do "chmod -R 770 DIR" and </pre>
<pre>then "setfacl -R ..... DIR". I was surprised that conversion to posix </pre>
<pre>acl has taken more then 2TB of metadata space.There is about one hundred<br>million files at GPFS filesystem. Is this expected behavior?</pre>
<pre><br></pre>
<pre>Thanks,</pre>
<pre>Michal</pre>
<pre><br></pre>
<pre>Example of NFS4 acl:</pre>
<pre><br></pre>
<pre>#NFSv4 ACL</pre>
<pre>#owner:root</pre>
<pre>#group:root</pre>
<pre>special:owner@:rwx-:allow</pre>
<pre> (X)READ/LIST (X)WRITE/CREATE (X)APPEND/MKDIR (X)SYNCHRONIZE </pre>
<pre>(X)READ_ACL (X)READ_ATTR (X)READ_NAMED</pre>
<pre> (-)DELETE (X)DELETE_CHILD (-)CHOWN (X)EXEC/SEARCH </pre>
<pre>(-)WRITE_ACL (X)WRITE_ATTR (X)WRITE_NAMED</pre>
<pre><br></pre>
<pre>special:group@:----:allow</pre>
<pre> (-)READ/LIST (-)WRITE/CREATE (-)APPEND/MKDIR (X)SYNCHRONIZE </pre>
<pre>(X)READ_ACL (X)READ_ATTR (X)READ_NAMED</pre>
<pre> (-)DELETE (-)DELETE_CHILD (-)CHOWN (-)EXEC/SEARCH </pre>
<pre>(-)WRITE_ACL (X)WRITE_ATTR (-)WRITE_NAMED</pre>
<pre><br></pre>
<pre>special:everyone@:----:allow</pre>
<pre> (-)READ/LIST (-)WRITE/CREATE (-)APPEND/MKDIR (X)SYNCHRONIZE </pre>
<pre>(X)READ_ACL (X)READ_ATTR (X)READ_NAMED</pre>
<pre> (-)DELETE (-)DELETE_CHILD (-)CHOWN (-)EXEC/SEARCH </pre>
<pre>(-)WRITE_ACL (X)WRITE_ATTR (-)WRITE_NAMED</pre>
<pre><br></pre>
<pre>group:ag_cud_96_lab:rwx-:allow:FileInherit:DirInherit</pre>
<pre> (X)READ/LIST (X)WRITE/CREATE (X)APPEND/MKDIR (X)SYNCHRONIZE </pre>
<pre>(X)READ_ACL (X)READ_ATTR (X)READ_NAMED</pre>
<pre> (-)DELETE (X)DELETE_CHILD (-)CHOWN (X)EXEC/SEARCH </pre>
<pre>(-)WRITE_ACL (X)WRITE_ATTR (X)WRITE_NAMED</pre>
<pre><br></pre>
<pre>group:ag_cud_96_lab_ro:r-x-:allow:FileInherit:DirInherit</pre>
<pre> (X)READ/LIST (-)WRITE/CREATE (-)APPEND/MKDIR (X)SYNCHRONIZE </pre>
<pre>(X)READ_ACL (X)READ_ATTR (X)READ_NAMED</pre>
<pre> (-)DELETE (-)DELETE_CHILD (-)CHOWN (X)EXEC/SEARCH </pre>
<pre>(-)WRITE_ACL (X)WRITE_ATTR (-)WRITE_NAMED</pre>
<pre><br></pre>
<pre><br></pre>
<pre>converted to posix acl:</pre>
<pre><br></pre>
<pre># owner: root</pre>
<pre># group: root</pre>
<pre>user::rwx</pre>
<pre>group::rwx</pre>
<pre>mask::rwx</pre>
<pre>other::---</pre>
<pre>default:user::rwx</pre>
<pre>default:group::rwx</pre>
<pre>default:mask::rwx</pre>
<pre>default:other::---</pre>
<pre>group:ag_cud_96_lab:rwx</pre>
<pre>default:group:ag_cud_96_lab:rwx</pre>
<pre>group:ag_cud_96_lab_ro:r-x</pre>
<pre>default:group:ag_cud_96_lab_ro:r-x</pre>
<pre><br></pre>
<pre><br></pre>
<pre><br></pre>
</div>
<pre>_______________________________________________</pre>
<pre>gpfsug-discuss mailing list</pre>
<pre>gpfsug-discuss at spectrumscale.org</pre>
<pre><a href="https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fgpfsug.org%2Fmailman%2Flistinfo%2Fgpfsug-discuss&amp;data=02%7C01%7Cp.childs%40qmul.ac.uk%7Ce1059833f7ed448b027608d6bad9ffec%7C569df091b01340e386eebd9cb9e25814%7C0%7C1%7C636901842833614488&amp;sdata=ROQ3LKmLZ06pI%2FTfdKZ9oPJx5a2xCUINqBnlIfEKF2Q%3D&amp;reserved=0">https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fgpfsug.org%2Fmailman%2Flistinfo%2Fgpfsug-discuss&amp;data=02%7C01%7Cp.childs%40qmul.ac.uk%7Ce1059833f7ed448b027608d6bad9ffec%7C569df091b01340e386eebd9cb9e25814%7C0%7C1%7C636901842833614488&amp;sdata=ROQ3LKmLZ06pI%2FTfdKZ9oPJx5a2xCUINqBnlIfEKF2Q%3D&amp;reserved=0</a></pre>
<pre><br></pre>
<pre><br></pre>
</blockquote>
<pre><div style="font-family: Ubuntu; font-size: 14.666666984558105px;">I've been trying to get my head round acls, with the plan to implement Cluster Export Services SMB rather than roll your own SMB.</div><div style="font-family: Ubuntu; font-size: 14.666666984558105px;"><br></div><div style="font-family: Ubuntu; font-size: 14.666666984558105px;">I'm not sure that plan is going to work Michal, although it might if your not using the Cluster Export Services version of SMB.</div><div style="font-family: Ubuntu; font-size: 14.666666984558105px;"><br></div><div style="font-family: Ubuntu; font-size: 14.666666984558105px;">Put simply if your running Cluster export services SMB you need to set ACLs in Spectrum Scale to "nfs4" we currently have it set to "all" and it won't let you export the shares until you change it, currently I'm still testing, and have had to write a change to go the other way.</div><div style="font-family: Ubuntu; font-size: 14.666666984558105px;"><br></div><div style="font-family: Ubuntu; font-size: 14.666666984558105px;">If you using linux kernel nfs4 that uses posix, however CES nfs uses ganasha which uses nfs4 acl correctly. </div><div style="font-family: Ubuntu; font-size: 14.666666984558105px;"><br></div><div style="font-family: Ubuntu; font-size: 14.666666984558105px;">It gets slightly more annoying as nfs4-setfacl does not work with Spectrum Scale and you have to use mmputacl which has no recursive flag, I even found a ibm article from a few years ago saying the best way to set acls is to use find, and a temporary file..... The other workaround they suggest is to update acls from windows or nfs to get the right.</div><div style="font-family: Ubuntu; font-size: 14.666666984558105px;"><br></div><div style="font-family: Ubuntu; font-size: 14.666666984558105px;">One thing I think may happen if you do as you've suggested is that you will break any acls under Samba badly. I think the other reason that command is taking up more space than expected is that your giving files acls that never had them to start with.</div><div style="font-family: Ubuntu; font-size: 14.666666984558105px;"><br></div><div style="font-family: Ubuntu; font-size: 14.666666984558105px;">I would love someone to say that I'm wrong, as changing our acl setting is going to be a pain. as while we don't make a lot of use of them we make enough that having to use nfs4 acls all the time is going to be a pain.</div><div style="font-family: Ubuntu; font-size: 14.666666984558105px;"><br></div></pre>
<div><span>
<pre>-- <br></pre>
<div style="width: 71ch;">Peter Childs</div>
<div style="width: 71ch;">ITS Research Storage</div>
<div style="width: 71ch;">Queen Mary, University of London</div>
<div style="width: 71ch;"><br>
</div>
</span></div>
</body>
</html>