NFSv4 ACLs: Difference between revisions

From HPCWIKI
Jump to navigation Jump to search
(Fix: remove --- horizontal lines (7 removed))
 
(4 intermediate revisions by 2 users not shown)
Line 1: Line 1:
{{Status
|status=Draft
|owner=Knowledge Agent
|last_update=2026-07-16
|review=Pending
}}
{{TOC}}
== Overview ==
NFSv4 ACLs에 대한 기술 문서입니다.
=== Summary ===
* 무엇인가? - NFSv4 ACLs
* 왜 필요한가? - HPC 및 서버 환경에서 필수 개념
* 언제 사용하는가? - 서버 구성, 성능 튜닝, 문제 해결 시
== Purpose ==
이 문서가 존재하는 이유
* Goal: NFSv4 ACLs에 대한 기술 정보 제공
* Scope: NFSv4 ACLs의 개념, 사용법, 설정
* Non-goals: 다른 주제로의 확장
== Key Concepts ==
{| class="wikitable"
! Concept
! Description
! Related
|-
| NFSv4 ACLs
| HPC/서버 환경에서 중요한 기술 개념
| [[Linux]], [[Server]]
|}
== Detailed Explanation ==
NFSv4 ACLs (Access Control Lists) are mechanism to manipulate access controls on network-mounted filesystems to supplement traditional Unix permissions.<ref>https://www.osc.edu/book/export/html/4523</ref>
NFSv4 ACLs (Access Control Lists) are mechanism to manipulate access controls on network-mounted filesystems to supplement traditional Unix permissions.<ref>https://www.osc.edu/book/export/html/4523</ref>
== Commands ==
{| class="wikitable"
{| class="wikitable"
|+
|+
Line 11: Line 53:
* <code>-x</code> –  to '''remove''' the specified control. Note that this needs to match the rule ''exactly''. Usually, to remove a control, it is easier to invoke <code>nfs4_setfacl</code> with the <code>-e</code>switch, or to use <code>nfs4_getfacl</code>, then copy/paste the line you'd like to remove.
* <code>-x</code> –  to '''remove''' the specified control. Note that this needs to match the rule ''exactly''. Usually, to remove a control, it is easier to invoke <code>nfs4_setfacl</code> with the <code>-e</code>switch, or to use <code>nfs4_getfacl</code>, then copy/paste the line you'd like to remove.
* <code>-e</code> – This switch, instead of directly modifying the <abbr>ACL</abbr>, puts you into a file editor with the <abbr>ACL</abbr>, so that you can add/remove/modify all the entries at once. Note that it puts you into whichever editor is specified in your ''EDITOR'' environment variable (run <code>echo $EDITOR</code> to see what yours is set to), or <code>vi</code> if none is specified. (See [[Ubuntu tips and tricks#Set default text editor|how to change system default editor on Ubuntu]])
* <code>-e</code> – This switch, instead of directly modifying the <abbr>ACL</abbr>, puts you into a file editor with the <abbr>ACL</abbr>, so that you can add/remove/modify all the entries at once. Note that it puts you into whichever editor is specified in your ''EDITOR'' environment variable (run <code>echo $EDITOR</code> to see what yours is set to), or <code>vi</code> if none is specified. (See [[Ubuntu tips and tricks#Set default text editor|how to change system default editor on Ubuntu]])
<u>This option is also being used for [[troubleshooting]] incorrect ACLs Fixing permissions that have gotten out-of-whack</u>  
<u>This option is also being used for [[troubleshooting]] incorrect ACLs Fixing permissions that have gotten out-of-whack</u>  
* <code>–test</code> – This switch tells <code>nfs4_setfacl</code> to not actually modify the <abbr>ACL</abbr>, but print out what it would be once it applied the operation you specified.
* <code>–test</code> – This switch tells <code>nfs4_setfacl</code> to not actually modify the <abbr>ACL</abbr>, but print out what it would be once it applied the operation you specified.
|-
|-
Line 20: Line 60:
|
|
|}
|}
== Access Control Entry (ACE) ==
ACE structure format,   
ACE structure format,   
<big>[access type]:[flags]:[principal]:[permissions]</big>
<big>[access type]:[flags]:[principal]:[permissions]</big>
Where,




Where,
== Best Practices ==
{| class="wikitable"
|+
!ACE entry
!Description
|-
|access type
|The ''''A'''<nowiki/>' denotes "Allow"
''''D'''<nowiki/>' can denote a Deny ACE
|-
|flags
|
{| class="wikitable"
|d
|directory-inherit
|New subdirectories will have the same ACE
|-
|f
|file-inherit
|New files will have the same ACE minus the inheritence flags
|-
|n
|no-propogate inherit
|New subdirectories will inherit the ACE minus the inheritence flags
|-
|i
|inherit-only
|New files and subdirectories will have this ACE but the ACE for the directory with the flag is null
|}
|-
|principal
|
* A named user : Example: user@nfsdomain.org
* Special principals
** OWNER@
** GROUP@
** EVERYONE@
* A group, Note: When the principal is a group, you need to add a group flag, ''''g'''<nowiki/>', as shown in the below example
** A:g:group@osc.edu:rxtncy
|-
|permissions
|
{| class="wikitable"
|r
|read-data (files) / list-directory (directories)
|-
|w
|write-data (files) / create-file (directories)
|-
|a
|append-data (files) / create-subdirectory (directories)
|-
|x
|execute (files) / change-directory (directories)
|-
|d
|delete the file/directory
|-
|D
|delete-child : remove a file or subdirectory from the given directory (directories only)
|-
|t
|read the attributes of the file/directory
|-
|T
|write the attribute of the file/directory
|-
|n
|read the named attributes of the file/directory
|-
|N
|write the named attributes of the file/directory
|-
|c
|read the file/directory ACL
|-
|C
|write the file/directory ACL
|-
|o
|change ownership of the file/directory
|}
simlarly to POSIX Read/Write/Execute, aliases such as 'R', 'W', and 'X' represented as
{| class="wikitable"
!Alias
!Name
!Expansion
|-
|R
|Read
|rntcy
|-
|W
|Write
|watTNcCy (with D added to directory ACE's)
|-
|X
|Execute
|xtcy
|}
|}


== Examples ==
* 최신 버전 사용 권장
* 공식 문서 참고
* 테스트 환경에서 먼저 검증


=== Check ACL on file or folder ===
<syntaxhighlight lang="bash">
$nfs4_getfacl file or folder
</syntaxhighlight>


=== using an acl file ===
== References ==
<syntaxhighlight lang="bash">
One can also specify the acl to be used in a single file, then apply that acl to avoid duplicate entries and keep the acl entries consistent.


$ cat << EOF > ~/group_acl.txt
* [https://wiki.hpcmate.com NFSv4 ACLs]
A:fdg:clntstf@example.com:rxtncy
A::OWNER@:rwaDxtTnNcCy
A:g:GROUP@:tcy
A::EVERYONE@:rxtncy
EOF
$ nfs4_setfacl -R -S ~/group_acl.txt ~/share_group


</syntaxhighlight>


=== using single cli command ===
== Related Pages ==
<syntaxhighlight lang="bash">
1. Give auser read permissions to the file file1:


nfs4_setfacl -a "A::auser@example.com:R" file1
* [[Linux]]
* [[Server]]
* [[Hardware]]
* [[Network]]


2. Allow the webserver running as user userweb to access your personal web directory (webhome), and all files underneath. You can use the find command and its -exec command to run a command on a set of files
find ~/webhome -type d -exec nfs4_setfacl -a "A::userweb@example.com</span>:RX" {} \;


That command gives RX (i.e. read and execute) permissions to all directories (the –type d option to find) under the ~webhome directory.
[[Category:Linux]]
find ~/webhome -type f -exec nfs4_setfacl -a "A::userweb@example.com</span>:R" {} \;
== Knowledge Graph ==


The second command gives userweb read (R) access to any non-directory file (–type f) in ~webhome. Note, you may want to do this if you want certain files to be accessible via the web, e.g. behind a password, but not to local EECS users. Very useful for making answers to quizzes, etc. password protected.
Related


3. Give your research group named research1, read access to your project directory project1:
→ [[NFS]]
find project1 -type d -exec nfs4_setfacl -a "A:g:research1@example.com</span>:RX" {} \;f
→ [[Network]]
find project1 -type f -exec nfs4_setfacl -a "A:g:research1@example.com</span>:R" {} \;
→ [[Storage]]
</syntaxhighlight>


== References ==
[[Category:Configuration]]
<references />

Latest revision as of 11:29, 17 July 2026

Template:Status

Template:TOC

Overview

NFSv4 ACLs에 대한 기술 문서입니다.

Summary

  • 무엇인가? - NFSv4 ACLs
  • 왜 필요한가? - HPC 및 서버 환경에서 필수 개념
  • 언제 사용하는가? - 서버 구성, 성능 튜닝, 문제 해결 시


Purpose

이 문서가 존재하는 이유

  • Goal: NFSv4 ACLs에 대한 기술 정보 제공
  • Scope: NFSv4 ACLs의 개념, 사용법, 설정
  • Non-goals: 다른 주제로의 확장


Key Concepts

Concept Description Related
NFSv4 ACLs HPC/서버 환경에서 중요한 기술 개념 Linux, Server


Detailed Explanation

NFSv4 ACLs (Access Control Lists) are mechanism to manipulate access controls on network-mounted filesystems to supplement traditional Unix permissions.[1]

nfs4_setfacl to add, remove, or modify the ACL
  • -a – to add the specified Access Control Entry (ACE - defined below). Basically, this adds a new rule.
  • -x – to remove the specified control. Note that this needs to match the rule exactly. Usually, to remove a control, it is easier to invoke nfs4_setfacl with the -eswitch, or to use nfs4_getfacl, then copy/paste the line you'd like to remove.
  • -e – This switch, instead of directly modifying the ACL, puts you into a file editor with the ACL, so that you can add/remove/modify all the entries at once. Note that it puts you into whichever editor is specified in your EDITOR environment variable (run echo $EDITOR to see what yours is set to), or vi if none is specified. (See how to change system default editor on Ubuntu)

This option is also being used for troubleshooting incorrect ACLs Fixing permissions that have gotten out-of-whack

  • –test – This switch tells nfs4_setfacl to not actually modify the ACL, but print out what it would be once it applied the operation you specified.
nfs4_getfacl prints out the ACL of the file or directory

ACE structure format, [access type]:[flags]:[principal]:[permissions] Where,


Best Practices

  • 최신 버전 사용 권장
  • 공식 문서 참고
  • 테스트 환경에서 먼저 검증


References


Related Pages

Knowledge Graph

Related

→ NFS → Network → Storage

  1. ↑ https://www.osc.edu/book/export/html/4523
Retrieved from "http://wiki.hpcmate.com/index.php?title=NFSv4_ACLs&oldid=3385"