Lustre 1.6 Operations Manual

Note – ACL support is a system-range feature, meaning that all clients have ACL
enabled or not. You cannot specify which clients should enable ACL.
26.1.2 Using ACLs with Lustre
Lustre supports POSIX Access Control Lists (ACLs). An ACL consists of file entries
representing permissions based on standard POSIX file system object permissions
that define three classes of user (owner, group and other). Each class is associated
with a set of permissions [read (r), write (w) and execute (x)].
■
■
■
Owner class permissions define access privileges of the file owner.
Group class permissions define access privileges of the owning group.
Other class permissions define access privileges of all users not in the owner or
group class.
The ls -l command displays the owner, group, and other class permissions in the
first column of its output (for example, -rw-r- -- for a regular file with read and
write access for the owner class, read access for the group class, and no access for
others).
Minimal ACLs have three entries. Extended ACLs have more than the three entries.
Extended ACLs also contain a mask entry and may contain any number of named
user and named group entries.
Lustre ACL support depends on the MDS, which needs to be configured to enable
ACLs. Use --mountfsoptions to enable ACL support when creating your
configuration:
$ mkfs.lustre --fsname spfs --mountfsoptions=acl --mdt –mgs /dev/sda
Alternately, you can enable ACLs at run time by using the --acl option with
mkfs.lustre:
$ mount -t lustre -o acl /dev/sda /mnt/mdt
To check ACLs on the MDS:
$ lctl get_param -n mdc.home-MDT0000-mdc-*.connect_flags | grep acl
acl
To mount the client with no ACLs:
$ mount -t lustre -o noacl ibmds2@o2ib:/home /home
26-2 Lustre 1.6 Operations Manual • September 2008