Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

NFSv3 of course doesn't support ZFS ACL's, but what will happen if I have the following setup?:

+-----------------------------------------+            +-------------+
|           FreeBSD ZFS serv1             |    NFSv3   | Linux serv2 |
| user1:      read/write to /zfs/project1 | <--------- | user1       |
| user2: deny read/write to /zfs/project1 |            | user2       |
+-----------------------------------------+            +-------------+

ZFS ACL's have been set on serv1 and serv2 mounts over NFSv3.

Question

I assume uers1 will be able to read/write as that is what NFSv3 world normally do.

But will user2 be denied?

share|improve this question
    
I'd try it and see. Easy to test. –  ewwhite Nov 19 '12 at 14:15
add comment

1 Answer

up vote 3 down vote accepted

Ben Rockwood (solaris guru) blogged about this in greater detail: NFS ZFS ACL's. The part that pertains to your question is a few sections down.

In short, it won't work. You need to upgrade to NFSv4 (eh), or use POSIX ACL's on a different FS (boo!).

I say "eh" about NFSv4 b/c I tried to figure it out a few times & failed. It seems to require a very homogenous environment centered around LDAP & Kerberos, which is actually great from a security standpoint, but a bummer if you just want to test stuff & don't have all those things. Hopefully you'll have better luck.

share|improve this answer
    
what doesn't work? I know I can't manage ACL's over NFSv3, but the permissions have already been set on the server. Will user2 be denied or given access? –  Sandra Nov 19 '12 at 15:01
1  
user2 will be denied, possibly even user1, depending on what the POSIX permissions are. All serv2 will see are the POSIX permissions; it will not see the ZFS ACL's at all. –  churnd Nov 19 '12 at 16:23
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.