Data Domain: BoostFS Write Access Denied When Group Is Not the User's Primary Group

The following symptoms may be observed when directory ownership and group permissions do not align with the user's primary group configuration:

Write operations to a BoostFS-mounted storage unit fail with Permission denied errors.
Read operations continue to succeed.
File creation, file modification, and backup dump operations fail when writing to the storage unit.
Access functions as expected when the directory ownership is assigned to the user's primary group.
Access may fail after ownership is changed to a different shared or operational group.
BoostFS logs may report file creation failures or permission-denied errors.
Data Domain services, storage units, and filesystems remain healthy and operational.

Example ownership change:

Before:

exampleuser:exampleuser

After:

exampleuser:sharedgrp

This example is provided for illustration only. Usernames and group names will vary by customer environment.

BoostFS authorizes write access based on the ownership and permissions of the storage unit directory. During access validation, BoostFS uses the user's primary group when determining whether write permissions should be granted.

For example, assume a directory is owned by dbuser:opsgrp with permissions set to 775:

drwxrwxr-x dbuser opsgrp

If user backupops has a primary group of users but is only a secondary member of opsgrp, BoostFS may deny write access because the user's primary group does not match the directory's group ownership.

Example:

uid=769(backupops) gid=40(users) groups=40(users),354(opsgrp)

Although the user is a member of opsgrp, write operations can fail with a permission denied error because BoostFS evaluates access using the user's primary group during authorization.

This behavior differs from some NFS implementations, where mount-point permissions may be presented differently after mounting, allowing write access under the same ownership configuration.

This behavior is expected by design in BoostFS, Data Domain, and the FM authorization layer. BoostFS authorization checks rely on the user's primary group when validating write access to the storage unit.

One of the following workarounds can be implemented based on operational and security requirements.

Workaround 1: Grant Additional Permissions to the BoostFS Mount Point

If permitted by organizational security standards, update the mount-point permissions to allow write access for other users.

Example:

chmod 777 /DUMP_BOOSTFS

Verify the permissions:

ls -ld /DUMP_BOOSTFS

Example output:

drwxrwxrwx 3 dbuser opsgrp ...

This approach provides read, write, and execute access to all users and should be evaluated against security requirements before implementation.

Workaround 2: Change the User's Primary Group

Configure the affected account so that its primary group matches the group ownership assigned to the BoostFS directory.

Check the current group membership:

id backupops

Example output:

uid=769(backupops) gid=40(users) groups=40(users),354(opsgrp)

Change the primary group:

usermod -g opsgrp backupops

Verify the change:

id backupops

Example output:

uid=769(backupops) gid=354(opsgrp) groups=354(opsgrp),40(users)

After the primary group matches the BoostFS directory's group ownership, write operations should succeed.

Workaround 3: Change the Group Ownership of the BoostFS Directory

If changing the user's primary group is not acceptable, modify the BoostFS directory ownership to match the user's existing primary group.

Check the user's current primary group:

id backupops

Example output:

uid=769(backupops) gid=40(users)

Modify the directory ownership:

chown dbuser:users /DUMP_BOOSTFS

Or for a specific subdirectory:

chown dbuser:users /DUMP_BOOSTFS/dbdump

Verify the ownership:

ls -ld /DUMP_BOOSTFS

Example output:

drwxrwxr-x 3 dbuser users ...

Once the directory group ownership matches the user's primary group, write access should function as expected.

Validation Steps

After implementing any workaround, validate functionality using the following commands:

Verify user identity and groups:

id backupops

Verify directory permissions:

ls -ld /DUMP_BOOSTFS

Verify BoostFS mount status:

mount | grep boostfs

Perform a write test:

touch /DUMP_BOOSTFS/testfile

A successful file creation confirms that the required permissions have been applied correctly.

Data Domain: Troubleshooting BoostFS Connectivity, Mount, and Performance Issues

Data Domain: BoostFS Issues with Security Scanner Software or Apps