Lustre 1.6 Operations Manual

Lustre ACL support is a system-wide feature; either all clients enable ACLs or none
do. Activating ACLs is controlled by MDS mount options acl / noacl
(enable/disableACLs). Client-side mount options acl/noacl are ignored. You do
not need to change the client configuration, and the “acl” string will not appear in
the client /etc/mtab. The client acl mount option is no longer needed. If a client is
mounted with that option, then this message appears in the MDS syslog:
...MDS requires ACL support but client does not
The message is harmless but indicates a configuration issue, which should be
corrected.
If ACLs are not enabled on the MDS, then any attempts to reference an ACL on a
client return an Operation not supported error.
26.1.3 Examples
These examples are taken directly from the POSIX paper referenced above. ACLs on
a Lustre filesystem work exactly like ACLs on any Linux filesystem. They are
manipulated with the standard tools in the standard manner. Below, we create a
directory and allow a specific user access.
[root@client lustre]# umask 027
[root@client lustre]# mkdir rain
[root@client lustre]# ls -ld rain
drwxr-x--- 2 root root 4096 Feb 20 06:50 rain
[root@client lustre]# getfacl rain
# file: rain
# owner: root
# group: root
user::rwx
group::r-x
other::---
[root@client lustre]# setfacl -m user:chirag:rwx rain
[root@client lustre]# ls -ld rain
drwxrwx---+ 2 root root 4096 Feb 20 06:50 rain
[root@client lustre]# getfacl --omit-heade rain
user::rwx
user:chirag:rwx
group::r-x
mask::rwx
other::---
Chapter 26 Lustre Security 26-3