GPFS: Administration and Programming Reference - IRA Home

Chapter 6. Managing GPFS access control lists and NFS
export
Management of GPFS access control lists (ACLs) and NFS export includes these topics:
v “Traditional GPFS ACL administration”
v “NFS V4 ACL administration” on page 48
v “NFS and GPFS” on page 52
Traditional GPFS ACL administration
Access control protects directories and files by providing a means of specifying who should be granted
access. Support for NFS V4 access control lists (ACLs) has been added to traditional ACL support. NFS
V4 ACLs are very different than the traditional ones. If you are using NFS V4 ACLs, see “NFS V4 ACL
administration” on page 48.
Both ACL types may coexist in a single GPFS file system.
Traditional GPFS ACLs are based on the POSIX model. Traditional GPFS access control lists (ACLs)
extend the base permissions, or standard file access modes, of read (r), write (w), and execute (x) beyond
the three categories of file owner, file group, and other users, to allow the definition of additional users and
user groups. In addition, GPFS introduces a fourth access mode, control (c), which can be used to govern
who can manage the ACL itself.
In this way, a traditional ACL can be created that looks like this:
#owner:jesmith
#group:team_A
user::rwxc
group::rwx-
other::--x-
mask::rwxc
user:alpha:r-xc
group:audit:r-x-
group:system:rwx-
In this ACL:
v The first two lines are comments showing the file’s owner, jesmith, and group name, team_A
v The next three lines contain the base permissions for the file. These three entries are the minimum
necessary for a GPFS ACL:
1. The permissions set for the file owner (user), jesmith
2. The permissions set for the owner’s group, team_A
3. The permissions set for other groups or users outside the owner’s group and not belonging to any
named entry
v The next line, with an entry type of mask, contains the maximum permissions allowed for any entries
other than the owner (the user entry) and those covered by other in the ACL.
v The last three lines contain additional entries for specific users and groups. These permissions are
limited by those specified in the mask entry, but you may specify any number of additional entries up to
a memory page (approximately 4 K) in size.
Traditional GPFS ACLs are fully compatible with the base operating system permission set. Any change to
the base permissions, using the chmod command, for example, modifies the corresponding GPFS ACL as
well. Similarly, any change to the GPFS ACL is reflected in the output of commands such as ls -l. Note
that the control (c) permission is GPFS specific. There is no comparable support in the base operating
system commands. As a result, the (c) permission is visible only with the GPFS ACL commands.
© Copyright IBM Corp. 1998, 2006 45