OneFS Access Control Lists Overview

Lieven Lin Oct 14, 2026

As we know, when users access OneFS cluster data via different protocols, the final permission enforcement happens on the OneFS file system. In OneFS, this is achieved by the Access Control Lists (ACLs) implementation, which provides granular permission control on directories and files. In this article, we will look at the basics of OneFS ACLs.

OneFS ACL

OneFS provides a single namespace for multiprotocol access and has its own internal ACL representation to perform access control. The internal ACL is presented as protocol-specific views of permissions so that NFS exports display POSIX mode bits for NFSv3 and ACL for NFSv4 and SMB.

When connecting to an PowerScale cluster with SSH, you can manage not only POSIX mode bits but also ACLs with standard UNIX tools such as chmod commands. In addition, you can edit ACL policies through the web administration interface to configure OneFS permissions management for networks that mix Windows and UNIX systems.

The OneFS ACL design is derived from Windows NTFS ACL. As such, many of its concept definitions and operations are similar to the Windows NTFS ACL, such as ACE permissions and inheritance.

OneFS synthetic ACL and real ACL

To deliver cross-protocol file access seamlessly, OneFS stores an internal representation of a file-system object’s permissions. The internal representation can contain information from the POSIX mode bits or the ACL.

OneFS has two types of ACLs to fulfill different scenarios:

OneFS synthetic ACL: Under the default ACL policy, if no inheritable ACL entries exist on a parent directory – such as when a file or directory is created through a NFS or SSH session on OneFS within the parent directory – the directory will only contain POSIX mode bits permission. OneFS uses the internal representation to generate a OneFS synthetic ACL, which is an in-memory structure that approximates the POSIX mode bits of a file or directory for an SMB or NFSv4 client.
OneFS real ACL: Under the default ACL policy, when a file or directory is created through SMB or when the synthetic ACL of a file or directory is modified through an NFSv4 or SMB client, the OneFS real ACL is initialized and stored on disk. The OneFS real ACL can also be initialized using the OneFS enhanced chmod command tool with the +a, -a, or =a option to modify the ACL.

OneFS access control entries

In contrast to the Windows DACL and NFSv4 ACL, the OneFS ACL access control entry (ACE) adds an additional identity type. OneFS ACEs contain the following information:

Identity name: The name of a user or group
ACE type: The type of the ACE (allow or deny)
ACE permissions and inheritance flags: A list of permissions and inheritance flags separated with commas

OneFS ACE permissions

Similar to the Windows permission level, OneFS divides permissions into the following three types:

Standard ACE permissions: These apply to any object in the file system
Generic ACE permissions: These map to a bundle of specific permissions
Constant ACE permissions: These are specific permissions for file-system objects

The standard ACE permissions that can appear for a file-system object are shown in the following table:

ACE permission	Applies to	Description
std_delete	Directory or file	The right to delete the object
std_read_dac	Directory or file	The right to read the security descriptor, not including the SACL
std_write_dac	Directory or file	The right to modify the DACL in the object's security descriptor
std_write_owner	Directory or file	The right to change the owner in the object's security descriptor
std_synchronize	Directory or file	The right to use the object as a thread synchronization primitive
std_required	Directory or file	Maps to std_delete, std_read_dac, std_write_dac, and std_write_owner

The generic ACE permissions that can appear for a file system object are shown in the following table:

ACE permission	Applies to	Description
generic_all	Directory or file	Read, write, and execute access. Maps to file_gen_all or dir_gen_all.
generic_read	Directory or file	Read access. Maps to file_gen_read or dir_gen_read.
generic_write	Directory or file	Write access. Maps to file_gen_write or dir_gen_write.
generic_exec	Directory or file	Execute access. Maps to file_gen_execute or dir_gen_execute.
dir_gen_all	Directory	Maps to dir_gen_read, dir_gen_write, dir_gen_execute, delete_child, and std_write_owner.
dir_gen_read	Directory	Maps to list, dir_read_attr, dir_read_ext_attr, std_read_dac, and std_synchronize.
dir_gen_write	Directory	Maps to add_file, add_subdir, dir_write_attr, dir_write_ext_attr, std_read_dac, and std_synchronize.
dir_gen_execute	Directory	Maps to traverse, std_read_dac, and std_synchronize.
file_gen_all	File	Maps to file_gen_read, file_gen_write, file_gen_execute, delete_child, and std_write_owner.
file_gen_read	File	Maps to file_read, file_read_attr, file_read_ext_attr, std_read_dac, and std_synchronize.
file_gen_write	File	Maps to file_write, file_write_attr, file_write_ext_attr, append, std_read_dac, and std_synchronize.
file_gen_execute	File	Maps to execute, std_read_dac, and std_synchronize.

The constant ACE permissions that can appear for a file-system object are shown in the following table:

ACE permission	Applies to	Description
modify	File	Maps to file_write, append, file_write_ext_attr, file_write_attr, delete_child, std_delete, std_write_dac, and std_write_owner
file_read	File	The right to read file data
file_write	File	The right to write file data
append	File	The right to append to a file
execute	File	The right to execute a file
file_read_attr	File	The right to read file attributes
file_write_attr	File	The right to write file attributes
file_read_ext_attr	File	The right to read extended file attributes
file_write_ext_attr	File	The right to write extended file attributes
delete_child	Directory or file	The right to delete children, including read-only files within a directory; this is currently not used for a file, but can still be set for Windows compatibility
list	Directory	List entries
add_file	Directory	The right to create a file in the directory
add_subdir	Directory	The right to create a subdirectory
traverse	Directory	The right to traverse the directory
dir_read_attr	Directory	The right to read directory attributes
dir_write_attr	Directory	The right to write directory attributes
dir_read_ext_attr	Directory	The right to read extended directory attributes
dir_write_ext_attr	Directory	The right to write extended directory attributes

OneFS ACL inheritance

Inheritance allows permissions to be layered or overridden as needed in an object hierarchy and allows for simplified permissions management. The semantics of OneFS ACL inheritance are the same as Windows ACL inheritance and will feel familiar to someone versed in Windows NTFS ACL inheritance. The following table shows the ACE inheritance flags defined in OneFS:

ACE inheritance flag	Set on directory or file	Description
object_inherit	Directory only	Indicates an ACE applies to the current directory and files within the directory
container_inherit	Directory only	Indicates an ACE applies to the current directory and subdirectories within the directory
inherit_only	Directory only	Indicates an ACE applies to subdirectories only, files only, or both within the directory.
no_prop_inherit	Directory only	Indicates an ACE applies to the current directory or only the first-level contents of the directory, not the second-level or subsequent contents
inherited_ace	File or directory	Indicates an ACE is inherited from the parent directory

Author: Lieven Lin

Tags: