Attachment uploads are currently disabled. This is a temporary situation and will resume as normal in the coming days.
UNSOLVED
chmod command w/ object_inherit,container_inherit not setting inheritance
We've got a number of shares, and the team assigned to manage them for the various end user groups messed up and gave a few users full rights to the very top of the share that they shouldn't have.
If I attempt to use Windows Explorer to remove these users, it will break inheritance on the share because of modifying the root of the share. Windows suggests doing it locally, which of course on Isilon means the chmod command.
Before messing about with a share that hundreds of users are using, I created a test share (aptly named "test") and began experimenting with the chmod command on that share to educate myself.
I found an oddity running this chmod command:
chmod +a user DSP\\testuser allow dir_gen_all,object_inherit,container_inherit /ifs/Isilon/smb/test
This should propagate down the share's dir tree as inheritance, but it doesn't. Yet if I look in the root security properties of the share in explorer, it says that testuser permissions have "This folder, subfolders and files" selected, but yet no rights have propagated down to the subfolders.
The -R switch is recursive but doesn't work how I want, that recursively sets all rights explicitly..not what I need.
Lastly, in the OneFS admin page, ACL policy, I enabled "Make ACL's inheritable" but that didn't work either; I think that only applies to the POSIX bits. So I re-disabled that which was it's default state.
I've been through the man page dozens of times, this is very odd.
DELL-Sam L
Community Manager
•
8095 Posts
•
34547 Points
688
0
Posted June 23rd, 2022 11:00
Hello lpphiggp,
Are you needing to change SMB or NFS share permission’s?
DELL-Sam L
Community Manager
•
8095 Posts
•
34547 Points
686
0
Posted June 23rd, 2022 14:00
Hello lpphiggp,
After you modify the ACL did you run the PermissionRepair job? This is located on page 144 of this link.
Hi Sam,
Never occurred to me. I thought that was to repair upper level permissions /ifs in a really bad scenario.
Since I've never run it I wasn't aware the other options would only then appear, such as which directories to choose. I'll give that a shot and update the page, thanks. Might not be for a few days now however, I had to move on to other projects in the interim.
Just one question as to how to apply: I assume I would set the root of the share as the Template File or Directory, and then the same again for the Path, since I need the inheritance to flow on down from the root of the share to it's subfolders?DELL-Sam L
Community Manager
•
8095 Posts
•
34547 Points
671
0
Posted June 24th, 2022 15:00
Hello lpphiggp,
that is correct.
That didn't give expected results:
First I ran: "chmod +a user DSP\\testuser allow dir_gen_all,object_inherit,container_inherit /ifs/Isilon/smb/test"
Then checked the share, and sure enough, testusers appeared in the root of the test share with full control, but the inheritance didn't work, the user does not appear in the 2 subfolders whatsoever.I set both paths the same (/ifs/Isilon/smb/test) and ran the permission job.
But instead of seeing testuser as inherited, it gave him rights to everything explicitly. So it's more like a copy permission. I'm just trying to get inheritance to work the way it should, so maybe I also have to go to ACL policy settings and enable the below setting in addition to the permissions repair? (Neither work by themselves)
Thanks
ACLs Created On Directories By the chmod CommandMake ACLs inheritable <--------------------- ?Do not make ACLs inheritableDELL-Sam L
Community Manager
•
8095 Posts
•
34547 Points
588
0
Posted June 28th, 2022 11:00
Hello lpphiggp,
It is best to open a support case for this so that we can pull some logs to see what is going on.
DELL-Sam L
Community Manager
•
8095 Posts
•
34547 Points
692
0
Posted June 23rd, 2022 07:00
Hello lpphiggp,
What is your current Onefs version? Here are the links to a couple of kb’s that maybe of assistance.
https://dell.to/3QIdZZL
https://dell.to/3yfW1H9