GPFS: Administration and Programming Reference - IRA Home

GPFS exceptions and limitations to NFS V4 ACLs
GPFS has the following exceptions and limitations to the NFS V4 ACLs:
1. Alarm type ACL entries are not supported.
2. Audit type ACL entries are not supported.
3. Inherit entries (FileInherit and DirInherit) are always propagated to all child subdirectories. The NFS
V4 ACE4_NO_PROPAGATE_INHERIT_ACE flag is not supported.
4. Although the NFS V4 ACL specification provides separate controls for WRITE and APPEND, GPFS
will not differentiate between the two. Either both must be specified, or neither can be.
5. Similar to WRITE and APPEND, NFS V4 allows for separate ADD_FILE and ADD_SUBDIRECTORY
controls. In most cases, GPFS will allow these controls to be specified independently. In the special
case where the file system object is a directory and one of its ACL entries specifies both FileInherit
and DirInherit flags, GPFS cannot support setting ADD_FILE without ADD_SUBDIRECTORY (or the
other way around). When this is intended, we suggest creating separate FileInherit and DirInherit
entries.
6. Some types of access for which NFS V4 defines controls do not currently exist in GPFS. For these,
ACL entries will be accepted and saved, but since there is no corresponding operation they will have
no effect. These include READ_NAMED, WRITE_NAMED, and SYNCHRONIZE.
7. AIX requires that READ_ACL and WRITE_ACL always be granted to the object owner. Although this
contradicts NFS Version 4 Protocol, it is viewed that this is an area where users would otherwise
erroneously leave an ACL that only privileged users could change. Since ACLs are themselves file
attributes, READ_ATTR and WRITE_ATTR are similarly granted to the owner. Since it would not
make sense to then prevent the owner from accessing the ACL from a non-AIX node, GPFS has
implemented this exception everywhere.
8. AIX does not support the use of special name values other than owner@, group@, and everyone@.
Therefore, these are the only valid special name for use in GPFS NFS V4 ACLs as well.
9. NFS V4 allows ACL entries that grant users (or groups) permission to change the owner or owning
group of the file (for example, with the chown command). For security reasons, GPFS now restricts
this so that non-privileged users may only chown such a file to themselves (becoming the owner) or
to a group that they are a member of.
10. GPFS does not support NFS V4 exporting GPFS file systems from Linux nodes. NFS V3 is
acceptable.
For more information about GPFS ACLs and NFS export, see Managing GPFS access control lists and
NFS export in General Parallel File System: Administration and Programming Reference.
372 GPFS: Administration and Programming Reference