Root Directory Acl - Oracle ZFS Storage Appliance Administration Manual

When using SMB to create a file in a directory with a trivial ACL, all ACL entries are inherited.
As a result, the following behavior occurs:
Inheritance bits display differently when viewed in SMB or NFS. When viewing the ACL
■
directory in SMB, inheritance bits are displayed. In NFS, inheritance bits are not displayed.
When a file is created in a directory using SMB, its ACL entries are shown as inherited;
■
however, when viewed through NFS, the directory has no inheritable ACL entries.
If the ACL is changed so that it is no longer trivial, e.g., by adding an access control entry
■
(ACE), this behavior does not occur.
If the ACL is modified using SMB, the resulting ACL will have the previously synthetic
■
inheritance bits turned into real inheritance bits.
Related Topics
"Project Properties" on page 376
■

Root Directory ACL

Fine-grained access on files and directories is managed via Access Control Lists. An ACL
describes what permissions are granted, if any, to specific users or groups. The appliance
supports NFSv4-style ACLs, also accessible over SMB. POSIX draft ACLs (used by NFSv3)
are not supported. Some trivial ACLs can be represented over NFSv3, but making complicated
ACL changes may result in undefined behavior when accessed over NFSv3.
Like root directory access, this property only affects the root directory of the filesystem. ACLs
can be controlled through in-band protocol management, but the BUI provides a way to set the
ACL just for the root directory of the filesystem. There is no way to set the root directory ACL
through the CLI. You can use in-band management tools if the BUI is not an option. Changing
this ACL does not affect existing files and directories in the filesystem. Depending on the
ACL inheritance behavior, these settings may or may not be inherited by newly created files
and directories. However, all ACL entries are inherited when SMB is used to create a file in a
directory with a trivial ACL.
An ACL is composed of any number of ACEs (access control entries). Each ACE describes
a type/target, a mode, a set of permissions, and inheritance flags. ACEs are applied in order,
starting at the beginning of the ACL, to determine whether a given action should be permitted.
For information on in-band configuration ACLs through data protocols, consult the appropriate
client documentation. The BUI interface for managing ACLs and the effect on the root directory
are described here.
Access Control Lists for Filesystems
Shares and Projects 419