ZFS ACL Inheritance: umask and canonical ACEs
chris at stankevitz.com
Wed Apr 12 19:39:47 UTC 2017
On 4/12/17 11:07 AM, Chris Stankevitz wrote:
2. How do I tell ZFS/ACL that I do not want owner@, group@, or
> everything@ ACEs created unless explicitly requested by setfacl? I do
> not want "extra" ACEs to appear on files I create within a particular
> directory -- even these "canonical" ACEs.
From sys/kern/subr_acl_nfsv4.c acl_nfs4_compute_inherited_acl_psarc
(which I'm guessing is called when a file is created):
_acl_append(aclp, ACL_USER_OBJ, user_allow ...
_acl_append(aclp, ACL_GROUP_OBJ, group_allow ...
_acl_append(aclp, ACL_EVERYONE, everyone_allow ...
So it looks like I must have an @owner, @group, and @everyone at
creation. On Windows if you have a directory containing just one
to-be-inherited ACE -- when you create a file within that directory,
that new file also contains just one ACE. Apparently on FreeBSD/ZFS you
get some more "special" ACEs that appear whether you want them or not.
My Windows users (via Samba) are not used to these "bonus ACEs"
appearing when they create files.
More information about the freebsd-fs