HeatherM1

updated

18 years ago

H

HeatherM1

1 Rookie

•

24 Posts

0

3419

February 3rd, 2009 12:00

Access policy for ACL for NFS

What access policy should I configure to allow ACLs to be set for NFS shares?

We are currently using the default policy NATIVE but that doesn't seem to allow ACLs...

The documentation seems to point to MIXED but I'm concerned that this may not be the best option since we are not using CIFS at all.

Can someone shed some light on which policy I should use?

Celerra 5.6
  • Rainer_EMC

    6 Operator

    •

    8645 Posts

    1752

    1

    Posted February 4th, 2009 10:00

    Hi Heather,

    yes you should use MIXED even if you dont have CIFS clients.

    I think the reason is that with MIXED the ACLs and UNIX mode bits are "synchronized" so that if you look at them with regular non-ACL aware Unix utils they still make some sense.

    Take a look at the attached doc for some basic instruction on how to get going with NFSv4 and ACLs on Celerra.
    The details are in the Celerra manuals referenced there - if you dont already have them the easiest way is just to grab the complete Celerra Doc CD from Powerlink.

    regards
    Rainer

    1 Attachment

  • Rainer_EMC

    6 Operator

    •

    8645 Posts

    1752

    0

    Posted February 4th, 2009 03:00

    what Unix client OS and NFS version are you using ?
  • HeatherM1

    1 Rookie

    •

    24 Posts

    1752

    0

    Posted February 4th, 2009 07:00

    NFSv4

    Solaris 10
  • HeatherM1

    1 Rookie

    •

    24 Posts

    1752

    0

    Posted February 4th, 2009 13:00

    Tested using accesspolicy=MIXED and that seems to work without issue.

    Thanks for the doc!
  • Rainer_EMC

    6 Operator

    •

    8645 Posts

    1752

    0

    Posted February 5th, 2009 15:00

    Hi Heather,

    you're very welcome. glad it worked.

    Rainer
  • shiela_rb

    14 Posts

    1752

    0

    Posted March 12th, 2010 22:00

    Hi,

    Im also be setting up the mixed environment in celerra. Im just confused.

    Correct me if im wrong. Im just want to clarify that when you say mixed policy, whatever changes i made in permissions in cifs it will be synchronized in nfs?

    For exmaple, if the user has an r-w-x permissions and then later on i will change that into read only, it will automatically synchronize to unix permissions?

    When the user acces the nfs share,  his/her permissions to that file will be read only?

    Thanks!

    Regards,

    shiela

  • shiela_rb

    14 Posts

    1752

    0

    Posted March 13th, 2010 01:00

    Hi All,

    How can i convert a filesystem with native policy into mixed policy?

    The filesytem is already in production and mounted as cifs share.

    Thanks in advance.

    Regards,

    shiela

  • Rainer_EMC

    6 Operator

    •

    8645 Posts

    1752

    0

    Posted March 15th, 2010 16:00

    there is a utility to convert permission between access policy thats mentioned in the Celerra CIFS multi-protocol manual

    however - multi-protocol is a complex thing that also relies on user mapping and the mixed access policy doesnt always give you the results you think

    thats not really a Celerra fault - its just not possible to fully "map" Windows ACLs to the simplistic Unix user-group-owner permissions

    I would strongly suggest to get some EMC professional service help or at least setup some test file systems or try with a Celerra Simulator before jumping in and changing production setups and data

    Rainer

  • jliu2

    1 Rookie

    •

    82 Posts

    1752

    0

    Posted May 26th, 2010 14:00

    sorry to bring up this old topic but

    I seem to be having issues with implementing NFS V4 on Solaris 10

    whenever I try to do a chown on a file/dir that's on the NFS mountpoint

    I get permission denied, even as root

    I looked at the log on the datamover and it says unable to map owner=(username)

    there seems to be a user mapping issue, LDAP is not configured for our UNIX environment, users/groups are managed via IDM

    any suggestions?

    thanks