* Re: NFSv4 ACLs [not found] ` <20120420185553.GB32622@samba2> @ 2012-04-20 21:26 ` J. Bruce Fields 2012-04-20 21:59 ` Jeremy Allison 0 siblings, 1 reply; 7+ messages in thread From: J. Bruce Fields @ 2012-04-20 21:26 UTC (permalink / raw) To: Jeremy Allison; +Cc: Ondrej Valousek, samba-technical, linux-nfs On Fri, Apr 20, 2012 at 11:55:53AM -0700, Jeremy Allison wrote: > On Fri, Apr 20, 2012 at 12:04:02PM +0200, Ondrej Valousek wrote: > > Hi List, > > > > I know this has been asked many times, but I will ask one more time: > > I would like to export NFSv4 mounted filesystem with Samba and would > > like to be able to use windows "security tab" in explorer to modify > > these ACLs. > > Do I have any chance with Samba on RHEL-5/6? > > Does Linux have local API's to manipulate mounted NFSv4 ACLs ? > > Samba has VFS modules to cope with mapping Windows ACLs onto > NFSv4 ACLs but currently they only work on AIX, Linux with IBM's > gpfs and Solaris right now. > > If you can point me a docs showing the library APIs for Linux > to allow programatic manipulation of NFSv4 ACLs then I can > make it work on Linux too. It's a bit idiosyncratic, but should be easy enough to handle if you want, I think: on the linux client, on an nfs4 filesystem, the "system.nfs4_acl" xattr contains the xdr-encoded ACL as it came in on the wire (network-byte-order and all). See the definition of fattr4_acl in rfc 3530. --b. ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: NFSv4 ACLs 2012-04-20 21:26 ` NFSv4 ACLs J. Bruce Fields @ 2012-04-20 21:59 ` Jeremy Allison 2012-04-20 22:08 ` J. Bruce Fields 0 siblings, 1 reply; 7+ messages in thread From: Jeremy Allison @ 2012-04-20 21:59 UTC (permalink / raw) To: J. Bruce Fields Cc: Jeremy Allison, Ondrej Valousek, samba-technical, linux-nfs On Fri, Apr 20, 2012 at 05:26:27PM -0400, J. Bruce Fields wrote: > On Fri, Apr 20, 2012 at 11:55:53AM -0700, Jeremy Allison wrote: > > On Fri, Apr 20, 2012 at 12:04:02PM +0200, Ondrej Valousek wrote: > > > Hi List, > > > > > > I know this has been asked many times, but I will ask one more time: > > > I would like to export NFSv4 mounted filesystem with Samba and would > > > like to be able to use windows "security tab" in explorer to modify > > > these ACLs. > > > Do I have any chance with Samba on RHEL-5/6? > > > > Does Linux have local API's to manipulate mounted NFSv4 ACLs ? > > > > Samba has VFS modules to cope with mapping Windows ACLs onto > > NFSv4 ACLs but currently they only work on AIX, Linux with IBM's > > gpfs and Solaris right now. > > > > If you can point me a docs showing the library APIs for Linux > > to allow programatic manipulation of NFSv4 ACLs then I can > > make it work on Linux too. > > It's a bit idiosyncratic, but should be easy enough to handle if you > want, I think: on the linux client, on an nfs4 filesystem, the > "system.nfs4_acl" xattr contains the xdr-encoded ACL as it came in on > the wire (network-byte-order and all). See the definition of fattr4_acl > in rfc 3530. I'm sorry, but that *really* *really* sucks. There needs to be an API on the Linux side that implements both RichACLs and NFSv4 ACLs (as they're the same thing essentially). Both GPFS and ZFS have defined API's to get and set ACLs. Just sticking them on a "system.nfs4_acl" xattr is a cop-out of monstrous proportions (and the kind of crap that we have to pull :-). Jeremy. ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: NFSv4 ACLs 2012-04-20 21:59 ` Jeremy Allison @ 2012-04-20 22:08 ` J. Bruce Fields 2012-04-21 1:34 ` simo 0 siblings, 1 reply; 7+ messages in thread From: J. Bruce Fields @ 2012-04-20 22:08 UTC (permalink / raw) To: Jeremy Allison; +Cc: Ondrej Valousek, samba-technical, linux-nfs On Fri, Apr 20, 2012 at 02:59:45PM -0700, Jeremy Allison wrote: > On Fri, Apr 20, 2012 at 05:26:27PM -0400, J. Bruce Fields wrote: > > On Fri, Apr 20, 2012 at 11:55:53AM -0700, Jeremy Allison wrote: > > > On Fri, Apr 20, 2012 at 12:04:02PM +0200, Ondrej Valousek wrote: > > > > Hi List, > > > > > > > > I know this has been asked many times, but I will ask one more time: > > > > I would like to export NFSv4 mounted filesystem with Samba and would > > > > like to be able to use windows "security tab" in explorer to modify > > > > these ACLs. > > > > Do I have any chance with Samba on RHEL-5/6? > > > > > > Does Linux have local API's to manipulate mounted NFSv4 ACLs ? > > > > > > Samba has VFS modules to cope with mapping Windows ACLs onto > > > NFSv4 ACLs but currently they only work on AIX, Linux with IBM's > > > gpfs and Solaris right now. > > > > > > If you can point me a docs showing the library APIs for Linux > > > to allow programatic manipulation of NFSv4 ACLs then I can > > > make it work on Linux too. > > > > It's a bit idiosyncratic, but should be easy enough to handle if you > > want, I think: on the linux client, on an nfs4 filesystem, the > > "system.nfs4_acl" xattr contains the xdr-encoded ACL as it came in on > > the wire (network-byte-order and all). See the definition of fattr4_acl > > in rfc 3530. > > I'm sorry, but that *really* *really* sucks. There needs to > be an API on the Linux side that implements both RichACLs > and NFSv4 ACLs (as they're the same thing essentially). Yes, that's the eventual plan. The richacl patches still need a little more work, and alas there's noone working on them currently as far as I know. So if you wanted something that would work now, you could use system.nfs4_acl now and later replace that by something that tried richacls and then fell back. The xdr isn't hard to parse or create--the main problem would be figuring out what to do with the names.... (By the way, is reexporting nfs with samba really going to work well anyway?) --b. ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: NFSv4 ACLs 2012-04-20 22:08 ` J. Bruce Fields @ 2012-04-21 1:34 ` simo 2012-04-21 11:34 ` steve 0 siblings, 1 reply; 7+ messages in thread From: simo @ 2012-04-21 1:34 UTC (permalink / raw) To: J. Bruce Fields Cc: Jeremy Allison, linux-nfs, samba-technical, Ondrej Valousek On Fri, 2012-04-20 at 18:08 -0400, J. Bruce Fields wrote: > On Fri, Apr 20, 2012 at 02:59:45PM -0700, Jeremy Allison wrote: > > On Fri, Apr 20, 2012 at 05:26:27PM -0400, J. Bruce Fields wrote: > > > On Fri, Apr 20, 2012 at 11:55:53AM -0700, Jeremy Allison wrote: > > > > On Fri, Apr 20, 2012 at 12:04:02PM +0200, Ondrej Valousek wrote: > > > > > Hi List, > > > > > > > > > > I know this has been asked many times, but I will ask one more time: > > > > > I would like to export NFSv4 mounted filesystem with Samba and would > > > > > like to be able to use windows "security tab" in explorer to modify > > > > > these ACLs. > > > > > Do I have any chance with Samba on RHEL-5/6? > > > > > > > > Does Linux have local API's to manipulate mounted NFSv4 ACLs ? > > > > > > > > Samba has VFS modules to cope with mapping Windows ACLs onto > > > > NFSv4 ACLs but currently they only work on AIX, Linux with IBM's > > > > gpfs and Solaris right now. > > > > > > > > If you can point me a docs showing the library APIs for Linux > > > > to allow programatic manipulation of NFSv4 ACLs then I can > > > > make it work on Linux too. > > > > > > It's a bit idiosyncratic, but should be easy enough to handle if you > > > want, I think: on the linux client, on an nfs4 filesystem, the > > > "system.nfs4_acl" xattr contains the xdr-encoded ACL as it came in on > > > the wire (network-byte-order and all). See the definition of fattr4_acl > > > in rfc 3530. > > > > I'm sorry, but that *really* *really* sucks. There needs to > > be an API on the Linux side that implements both RichACLs > > and NFSv4 ACLs (as they're the same thing essentially). > > Yes, that's the eventual plan. > > The richacl patches still need a little more work, and alas there's > noone working on them currently as far as I know. > > So if you wanted something that would work now, you could use > system.nfs4_acl now and later replace that by something that tried > richacls and then fell back. > > The xdr isn't hard to parse or create--the main problem would be > figuring out what to do with the names.... Samba does handle id mapping in general and name mapping shouldn't be too hard to add, SIDs would be easier for us though :-) > (By the way, is reexporting nfs with samba really going to work well > anyway?) Not really, it is generally unsupported, except for read only shares. It will work in most of the simple cases for writing .. until it breaks :) Simo. -- Simo Sorce Samba Team GPL Compliance Officer <simo@samba.org> Principal Software Engineer at Red Hat, Inc. <simo@redhat.com> ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: NFSv4 ACLs 2012-04-21 1:34 ` simo @ 2012-04-21 11:34 ` steve 2012-04-21 23:57 ` Andrew Bartlett 0 siblings, 1 reply; 7+ messages in thread From: steve @ 2012-04-21 11:34 UTC (permalink / raw) To: simo Cc: J. Bruce Fields, Jeremy Allison, linux-nfs, samba-technical, Ondrej Valousek On 21/04/12 03:34, simo wrote: > On Fri, 2012-04-20 at 18:08 -0400, J. Bruce Fields wrote: >> On Fri, Apr 20, 2012 at 02:59:45PM -0700, Jeremy Allison wrote: >>> On Fri, Apr 20, 2012 at 05:26:27PM -0400, J. Bruce Fields wrote: >>>> On Fri, Apr 20, 2012 at 11:55:53AM -0700, Jeremy Allison wrote: >>>>> On Fri, Apr 20, 2012 at 12:04:02PM +0200, Ondrej Valousek wrote: >>>>>> Hi List, >>>>>> > >> (By the way, is reexporting nfs with samba really going to work well >> anyway?) > > Not really, it is generally unsupported, except for read only shares. It > will work in most of the simple cases for writing .. until it breaks :) > Hi That's worrying. We been rw'ing nfs/samba for years. Maybe we're the only ones. nfs3 for our Linux clients and samba for the rest. Same shared data. Only Posix acl's though. Maybe that's the simple bit? Cheers, Steve ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: NFSv4 ACLs 2012-04-21 11:34 ` steve @ 2012-04-21 23:57 ` Andrew Bartlett 2012-04-23 14:49 ` steve 0 siblings, 1 reply; 7+ messages in thread From: Andrew Bartlett @ 2012-04-21 23:57 UTC (permalink / raw) To: steve; +Cc: simo, linux-nfs, samba-technical, Jeremy Allison, Ondrej Valousek On Sat, 2012-04-21 at 13:34 +0200, steve wrote: > On 21/04/12 03:34, simo wrote: > > On Fri, 2012-04-20 at 18:08 -0400, J. Bruce Fields wrote: > >> On Fri, Apr 20, 2012 at 02:59:45PM -0700, Jeremy Allison wrote: > >>> On Fri, Apr 20, 2012 at 05:26:27PM -0400, J. Bruce Fields wrote: > >>>> On Fri, Apr 20, 2012 at 11:55:53AM -0700, Jeremy Allison wrote: > >>>>> On Fri, Apr 20, 2012 at 12:04:02PM +0200, Ondrej Valousek wrote: > >>>>>> Hi List, > >>>>>> > > > > >> (By the way, is reexporting nfs with samba really going to work well > >> anyway?) > > > > Not really, it is generally unsupported, except for read only shares. It > > will work in most of the simple cases for writing .. until it breaks :) > > > > Hi > That's worrying. > > We been rw'ing nfs/samba for years. Maybe we're the only ones. nfs3 for > our Linux clients and samba for the rest. Same shared data. Only Posix > acl's though. Maybe that's the simple bit? > Cheers, > Steve Are Samba and NFSd running on the same server, exporting the same data? That is what is expected to work. See 'kernel oplocks' (the default of which will change for 4.0) to allow NFS and Samba to break each other's oplocks. What Simo cautions about is where an NFS server (say a NAS server) exports to some direct NFS clients, and then a 'proxy' Samba server is an NFS client and a Samba server for Windows clients. This 'proxy' setup is considered dangerous. Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: NFSv4 ACLs 2012-04-21 23:57 ` Andrew Bartlett @ 2012-04-23 14:49 ` steve 0 siblings, 0 replies; 7+ messages in thread From: steve @ 2012-04-23 14:49 UTC (permalink / raw) To: Andrew Bartlett Cc: simo, linux-nfs, samba-technical, Jeremy Allison, Ondrej Valousek On 22/04/12 01:57, Andrew Bartlett wrote: > On Sat, 2012-04-21 at 13:34 +0200, steve wrote: >> On 21/04/12 03:34, simo wrote: >>> On Fri, 2012-04-20 at 18:08 -0400, J. Bruce Fields wrote: >>>> On Fri, Apr 20, 2012 at 02:59:45PM -0700, Jeremy Allison wrote: >>>>> On Fri, Apr 20, 2012 at 05:26:27PM -0400, J. Bruce Fields wrote: >>>>>> On Fri, Apr 20, 2012 at 11:55:53AM -0700, Jeremy Allison wrote: >>>>>>> On Fri, Apr 20, 2012 at 12:04:02PM +0200, Ondrej Valousek wrote: >>>>>>>> Hi List, >>>>>>>> >> >>> >>>> (By the way, is reexporting nfs with samba really going to work well >>>> anyway?) >>> >>> Not really, it is generally unsupported, except for read only shares. It >>> will work in most of the simple cases for writing .. until it breaks :) >>> >> >> Hi >> That's worrying. >> >> We been rw'ing nfs/samba for years. Maybe we're the only ones. nfs3 for >> our Linux clients and samba for the rest. Same shared data. Only Posix >> acl's though. Maybe that's the simple bit? >> Cheers, >> Steve > > Are Samba and NFSd running on the same server, exporting the same data? > That is what is expected to work. See 'kernel oplocks' (the default of > which will change for 4.0) to allow NFS and Samba to break each other's > oplocks. > s3 and nfs work fine (maybe others are doing it too?) We are testing Samba4 and nfs now and yes same data, same box. As yet, we've not been able to break it no matter what we throw at it. When will the oplocks default change? Will it affect us? Cheers, Steve ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2012-04-23 14:48 UTC | newest] Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- [not found] <4F913492.8000402@s3group.cz> [not found] ` <20120420185553.GB32622@samba2> 2012-04-20 21:26 ` NFSv4 ACLs J. Bruce Fields 2012-04-20 21:59 ` Jeremy Allison 2012-04-20 22:08 ` J. Bruce Fields 2012-04-21 1:34 ` simo 2012-04-21 11:34 ` steve 2012-04-21 23:57 ` Andrew Bartlett 2012-04-23 14:49 ` steve
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.