The Problem: CentOS does not seem to look at secondary groups when using ACL's on a folder or file
Scenario: CentOS 6 basic install, uses LDAP accounts to authenticate users. I am trying to setup fairly complex permissions on some folders. I have ensured that the file system is mounted with ACL support and determined that LDAP users are able to log in correctly.
Steps to Reproduce:
As a test I have a simple folder structure. The folder
test1 is owned by root and has 770 permissions, I have added another group to that folder
setfacl -m g:testgroup:rwx test1/ The getfacl output for the folder looks like this:
getfacl: Removing leading '/' from absolute path names # file: share/test1/ # owner: root # group: root user::rwx group::rwx group:testgroup:rwx mask::rwx other::---
andrew belongs to the domain group and testgroup as shown by
groups andrew. The group domain is the users primary group. If the user andrew tries to read anything located in test1 a permission denied error was shown. If however the users primary group is changed to testgroup the user can then interact with the contents of the folder.
Can anybody tell me what is going on here and if there is a way to get the expected behaviour?
EDIT This appears to be a problem related to LDAP. I just tested using local user accounts and everything works as expected.