`<div class="gmail_quote">On Sat, May 11, 2013 at 10:35 PM, Paul B. Henson <span dir="ltr"><<a href="mailto:henson@acm.org" target="_blank">henson@acm.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On Sat, May 11, 2013 at 09:12:43AM +0200, Natxo Asenjo wrote:<br>
<br>
> I have straced the cp -r command with discard and restricted aclmode<br>
> settings (see attachments).<br>
<br>
</div>open("/net/zfstank.ipa.asenjo.nx/tank/testshare/bin/<a href="http://parsetable.pl" target="_blank">parsetable.pl</a>",<br>
O_WRONLY|O_CREAT|O_EXCL, 0664) = 4<br>
<br>
Yeah, you're getting bit by the NFS exclusive open issue. Basically, NFS<br>
up to v4 overloads the mode bits to store a verifier to check on whether<br>
the exclusive part of the open succeeded, and then does a separate<br>
setattr afterwards to set the actual mode. So what happens is the<br>
initial open results in a file with the right inherited ACL, and the<br>
subsequent setattr results in the same change as an explicit chmod,<br>
typically breaking the ACL. This is fixed in the NFS v4.1 spec, but<br>
that's not really in use yet. Theoretically it should be possible to<br>
keep some state on the server side and work around this issue, but I've<br>
never had the time to dig into it.<br>
<br></blockquote><div><br>ok, thanks for your explanation. I had indeed seen all those 0664 that pointed in that direction.<br><br>I see the illumos nfs 4.1 project is a bti 'inactive' ;-), but it'll come one day I guess.<br>
<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Does the linux nfs client complain at all when you do the copy with<br>
aclmode=restricted? The client would get a success for the open, but the<br>
following setattr op would fail, and I wasn't sure how the nfs client<br>
would deal with that. From the strace output it looks like the<br>
underlying nfs setattr failure isn't passed back up to the userland<br>
code, it looks like the open just succeeds as normal. Cool.<br>
<br></blockquote><div><br>no, it does when moving a file though :<br><br>$ mv testmove /net/zfstank.ipa.asenjo.nx/tank/testshare/<br>mv: preserving permissions for `/net/zfstank.ipa.asenjo.nx/tank/testshare/testmove': Operation not permitted<br>
<br>but that is not really a showstopper. The file gets copied and the permissions are applied:<br><br>$ nfs4_getfacl /net/zfstank.ipa.asenjo.nx/tank/testshare/testmove <br>A::EVERYONE@:rwadxtTnNcCoy<br><br>I had not noticed it until yesterday because I am used to copying first and removing later (lost some files once because of a hardware failure and got used to doing that since then).<br>
<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
I'm glad somebody's finding aclmode=restricted useful :).<br>
</blockquote></div><br>I'm surprised that not more people are using this! Thanks for implementing it.<br><br>-- <br>groet,<br>natxo<br>
`