Experimental Physics and
Industrial Control System

Michael Davidsaver via Tech-talk <tech-talk at aps.anl.gov> · Mon, 16 Nov 2020 10:38:01 -0800

This isn't an EPICS question.  Still, I think this is the sort
of problem which others on this list have had to confront.

Has anyone found a recipe for managing a shared data directory
over NFSv4?  Where multiple users within a group can create files
which can then be modified by other members of that group?

I think there will be two parts to this answer.  How to express
this as a NFSv4 ACL.  And which NFSv4 clients/servers can correctly
translate such an ACL to/from their native permissions model.

eg. Linux circa Debian 6 would only check NFSv4 ACLs against a
user's primary group.

The recipe I've used on NFSv3 with the posix ACL extension is:

> chgrp -R people /data
> chmod -R g+ws /data
> setfacl -d -m group::rwx /data

Which is:

1. Set group directory ownership to 'people'

2. Set the group set-id bit

So files and directories created will be owned by the 'people'
group instead of the user's primary group.

3. Add an ACL rule to override the UMASK

So files and directories created will be writable by other
members of the 'people' group.

This recipe can't be directly translated to the NFSv4 ACL model
which does not have the concept of set-id bits nor of umask.

https://man7.org/linux/man-pages/man1/nfs4_setfacl.1.html

Experimental Physics and Industrial Control System

Experimental Physics and
Industrial Control System