openSUSE Leap 16
Sponsored Link

NFS : NFS 4 ACL Tool2025/10/20
 

It's possible to set ACL on NFS(v4) filesystem to install NFS 4 ACL tool.
Usage is mostly the same with POSIX ACL Tool.

[1] Install NFS 4 ACL Tool on NFS clients that mounts NFS share with NFSv4.
node01:~ #
zypper -n install nfs4-acl-tools
[2] On this example, it shows usage examples on the environment like follows.
node01:~ #
df -hT /mnt 

Filesystem                   Type  Size  Used Avail Use% Mounted on
dlp.srv.world:/home/nfsshare nfs4   28G  2.7G   25G  10% /mnt
node01:~ #
ll /mnt 

total 4
drwx------. 1 root root  0 Oct 20 09:35 testdir
-rw-------. 1 root root 20 Oct 20 09:35 testfile.txt
[3] Show ACL of a file or directory on NFSv4 filesystem.
node01:~ #
nfs4_getfacl /mnt/testfile.txt 

# file: /mnt/testfile.txt
A::OWNER@:rwatTcCy
A::GROUP@:tcy
A::EVERYONE@:tcy
node01:~ #
nfs4_getfacl /mnt/testdir 

# file: /mnt/testdir
A::OWNER@:rwaDxtTcCy
A::GROUP@:tcy
A::EVERYONE@:tcy
# each entry means like follows
# ACE = Access Control Entry
# (ACE Type):(ACE Flags):(ACE Principal):(ACE Permissions)
Description
ACE Type  
A A = Allow : it means Allow accesses.
D D = Deny : it means Deny accesses.
ACE Flags  
d Directory-Inherit : New sub-directory inherits the same ACE.
f File-Inherit : New file inherits the same ACE but not inherit inheritance-flag.
n No-Propogate-Inherit : New sub-directory inherits the same ACE but not inherit inheritance-flag.
i Inherit-Only : New file/sub-directory inherits the same ACE but this directory does not have ACE.
ACE Principal  
(USER)@(NFSDomain) Common User
For [NFSDomain], it is just the Domain name that is specified for [Domain] value in [idmapd.conf].
(GROUP)@(NFSDomain) Common Group
For group, Specify [g] flag like this ⇒ A:g:GROUP@NFSDomain:rxtncy
OWNER@ Special Principal : Owner
GROUP@ Special Principal : Group
EVERYONE@ Special Principal : Everyone
ACE Permissions  
r Read data of files / List files in directory
w Write data to files / Create new files in directory
a Append data to files / Create new sub-directory
x Execute files / Change directory
d Delete files or directories
D Delete files or sub-directories under the directory
t Read attributes of files or directories
T Write attributes to files or directories
n Read named attributes of files or directories
N Write named attributes of files or directories
c Read ACL of files or directories
C Write ACL of files or directories
o Change ownership of files or directories
ACE Permissions Aliases For using nfs4_setfacl, possible to use Alias for ACE Permissions
R R = rntcy : Generic Read
W W = watTNcCy : Generic Write
X X = xtcy : Generic Execute

[4] Add or Delete ACE.
node01:~ #
ll /mnt 

total 4
drwx------. 1 root root  0 Oct 20 09:35 testdir
-rw-------. 1 root root 20 Oct 20 09:35 testfile.txt
node01:~ #
nfs4_getfacl /mnt/testfile.txt 

# file: /mnt/testfile.txt
A::OWNER@:rwatTcCy
A::GROUP@:tcy
A::EVERYONE@:tcy
# add generic read/execute for [suse] user to [/mnt/testfile.txt] file

node01:~ #
USERID=$(grep '^suse:' /etc/passwd | cut -d':' -f3)

node01:~ #
nfs4_setfacl -a A::${USERID}:rxtncy /mnt/testfile.txt
node01:~ #
nfs4_getfacl /mnt/testfile.txt 

# file: /mnt/testfile.txt
D::OWNER@:x
A::OWNER@:rwatTcCy
A::1000:rxtcy
A::GROUP@:tcy
A::EVERYONE@:tcy
# verify with [suse] user

suse@node01:~>
ll /mnt 

total 4
drwx------. 1 root root  0 Oct 20 09:35 testdir
-rw-r-x---+ 1 root root 20 Oct 20 09:35 testfile.txt
suse@node01:~>
cat /mnt/testfile.txt

test file

# delete generic read/execute for [suse] user from [/mnt/testfile.txt] file

node01:~ #
nfs4_setfacl -x A::1000:rxtcy /mnt/testfile.txt
node01:~ #
nfs4_getfacl /mnt/testfile.txt 

# file: /mnt/testfile.txt
A::OWNER@:rwatTcCy
A::GROUP@:tcy
A::EVERYONE@:tcy
[5] Edit ACL directly.
node01:~ #
nfs4_setfacl -e /mnt/testfile.txt 


# $EDITOR is run and enter to ACL editing
# default $EDITOR on SUSE is [vim], if $EDITOR=null, default is set to [vi]
## Editing NFSv4 ACL for file: /mnt/testfile.txt
A::OWNER@:rwatTcCy
A::GROUP@:tcy
A::EVERYONE@:tcy
[6] Add ACE from a file.
# create ACL list

node01:~ #
vi acl.txt 
A::1000:RX
A::1001:RWX
# add ACL from the file

node01:~ #
nfs4_setfacl -A acl.txt /mnt/testfile.txt
node01:~ #
nfs4_getfacl /mnt/testfile.txt 

# file: /mnt/testfile.txt
D::OWNER@:x
A::OWNER@:rwatTcCy
A::1000:rxtcy
A::1001:rwaxtcy
A::GROUP@:tcy
A::EVERYONE@:tcy
[7] Replace current ACE to new ACE.
# create ACL list

node01:~ #
vi acl.txt 
A::OWNER@:rwaxtTcCy
A::GROUP@:tcy
A::EVERYONE@:tcy
# replace ACL from the file

node01:~ #
nfs4_setfacl -S acl.txt /mnt/testfile.txt
node01:~ #
nfs4_getfacl /mnt/testfile.txt 

# file: /mnt/testfile.txt
A::OWNER@:rwaxtTcCy
A::GROUP@:tcy
A::EVERYONE@:tcy
[8] Replace specific ACE to new ACE.
node01:~ #
nfs4_getfacl /mnt/testfile.txt 

# file: /mnt/testfile.txt
A::OWNER@:rwaxtTcCy
A::GROUP@:tcy
A::EVERYONE@:tcy
# replace EVERYONE's ACE to read/execute

node01:~ #
nfs4_setfacl -m A::EVERYONE@:tcy A::EVERYONE@:RX /mnt/testfile.txt
node01:~ #
nfs4_getfacl /mnt/testfile.txt 

# file: /mnt/testfile.txt
A::OWNER@:rwaxtTcCy
A::GROUP@:rxtcy
A::EVERYONE@:rxtcy
Matched Content