Access policy for ACL for NFS

Question

What access policy should I configure to allow ACLs to be set for NFS shares?

We are currently using the default policy NATIVE but that doesn't seem to allow ACLs...

The documentation seems to point to MIXED but I'm concerned that this may not be the best option since we are not using CIFS at all.

Can someone shed some light on which policy I should use?

Celerra 5.6

Rainer_EMC · Accepted Answer

Hi Heather,yes you should use MIXED even if you dont have CIFS clients. I think the reason is that with MIXED the ACLs and UNIX mode bits are 'synchronized' so that if you look at them with regular non-ACL aware Unix utils they still make some sense.Take a look at the attached doc for some basic instruction on how to get going with NFSv4 and ACLs on Celerra.The details are in the Celerra manuals referenced there - if you dont already have them the easiest way is just to grab the complete Celerra Doc CD from Powerlink.regardsRainer

Rainer_EMC · Answer

what Unix client OS and NFS version are you using ?

HeatherM1 · Answer

NFSv4 Solaris 10

HeatherM1 · Answer

Tested using accesspolicy=MIXED and that seems to work without issue.Thanks for the doc!

Rainer_EMC · Answer

Hi Heather,you're very welcome. glad it worked.Rainer

shiela_rb · Answer

Hi,

Im also be setting up the mixed environment in celerra. Im just confused.

Correct me if im wrong. Im just want to clarify that when you say mixed policy, whatever changes i made in permissions in cifs it will be synchronized in nfs?

For exmaple, if the user has an r-w-x permissions and then later on i will change that into read only, it will automatically synchronize to unix permissions?

When the user acces the nfs share, his/her permissions to that file will be read only?

Thanks!

Regards,

shiela

shiela_rb · Answer

Hi All, How can i convert a filesystem with native policy into mixed policy? The filesytem is already in production and mounted as cifs share. Thanks in advance. Regards, shiela

Rainer_EMC · Answer

there is a utility to convert permission between access policy thats mentioned in the Celerra CIFS multi-protocol manual

however - multi-protocol is a complex thing that also relies on user mapping and the mixed access policy doesnt always give you the results you think

thats not really a Celerra fault - its just not possible to fully "map" Windows ACLs to the simplistic Unix user-group-owner permissions

I would strongly suggest to get some EMC professional service help or at least setup some test file systems or try with a Celerra Simulator before jumping in and changing production setups and data

Rainer

jliu2 · Answer

sorry to bring up this old topic but

I seem to be having issues with implementing NFS V4 on Solaris 10

whenever I try to do a chown on a file/dir that's on the NFS mountpoint

I get permission denied, even as root

I looked at the log on the datamover and it says unable to map owner=(username)

there seems to be a user mapping issue, LDAP is not configured for our UNIX environment, users/groups are managed via IDM

any suggestions?

thanks

Celerra

Access policy for ACL for NFS

Was this post helpful?