How to manage file or directory permissions using NFSv4 ACLs - File Storage NAS

This topic describes how to configure NFSv4 access control lists (ACLs) and use the ACLs to control access to files and directories in an NFSv4 file system.

Prerequisites

An NFSv4 file system is mounted. For more information, see Mount an NFS file system on a Linux ECS instance.
NFS ACL is enabled for the file system. To enable it, go to the file system details page in the NAS console, click Access Control in the left-side navigation pane, and then turn on the NFS ACL toggle.

Background information

You can mount an NFSv4 file system on a Linux Elastic Compute Service (ECS) instance and install Linux-specific nfs4-acl-tools on the instance. After the tool is installed, you can use the standard nfs4_getfacl and nfs4_setfacl tools to configure NFSv4 ACLs.

Command description

Before you configure NFSv4 ACLs, we recommend that you get familiar with specific commands. The following table describes the commands.

Command	Description
`nfs4_getfacl <filename>`	Queries the ACL that applies to a specified file.
`nfs4_setfacl -a A::GROUP@:W <filename>`	Grant write permission to the group.
`nfs4_setfacl -a A::1000:W <filename>`	You can grant write permission to user 1000.
`nfs4_setfacl -a A:g:10001:W <filename>`	Grant write permission to user group 10001.
`nfs4_setfacl -e <filename>`	Modifies an ACL in interactive mode.
`nfs4_getfacl <filename> > saved_acl.txt`	Saves a list of permissions on a specified file as a TXT file.
`nfs4_setfacl -S saved_acl.txt <filename>`	You can restore ACL permissions from a text file.
`nfs4_setfacl -m A::1001:rwaxTNcCy A::1001:rxtcy file1`	Modifies the permission of an ACE that applies to the file1 file.
`nfs4_getfacl file1 \| nfs4_setfacl -S - file2`	Copies the ACL for the file1 file to the file2 file.
`nfs4_getfacl file1 \| grep @ \| nfs4_setfacl -S - file1`	Delete the non-retained ACEs from the file file1.
`nfs4_setfacl -R -a A:g:10001:rW dir`	Adds an ACE that grants the read and write permissions on the files and subdirectories in the dir directory to a group principal named 10001.
`find dir -type f -exec sh -c 'for ace in $(nfs4_getfacl \{} \| grep "^A.*\:1005\:"); do nfs4_setfacl -x $ace \{}; done' \;`	Delete all ACEs containing 1005 from all files in the dir directory tree.
`nfs4_setfacl -a A:fdg:10001:rW dir1`	Adds an ACE that grants the read and write permissions on new files and subdirectories in the dir1 directory to a group principal named 10001.
`nfs4_setfacl -a A:fg:10001:rx dir1`	Grant user group 10001 read and execute permissions on new files created in the dir1 directory.

Procedure

To control access to files and directories by configuring NFSv4 ACLs, perform the following steps.

Create users and groups.
In this example, the following users are created: player, admini, and anonym. The following groups are created: players and adminis. The player user is added to the players group and the admini user is added to the adminis group.
```
sudo useradd player
sudo groupadd players
sudo usermod -g players player
sudo useradd admini
sudo groupadd adminis
sudo usermod -g adminis admini
sudo useradd anonym
```

Install the required tools to configure NFSv4 ACLs.

If you have installed these tools, skip this step.

# CentOS/RHEL/Alibaba Cloud Linux
sudo yum -y install nfs4-acl-tools

# Ubuntu/Debian
sudo apt-get -y install nfs4-acl-tools

Obtain the IDs of the players and adminis groups.
Open the /etc/group file. The IDs of the players and adminis groups are displayed.
```
players:x:19064:player
adminis:x:19065:admini
```
Configure NFSv4 ACLs to control access to files and directories.
Run the following commands to complete the operations: Create a directory named dir0. Add ACEs that grant the read-only permissions on all files in the dir0 directory to the players group, grant the read, write, and execute permissions to the adminis group, and do not grant permissions to other users.
```
sudo umask 777
sudo mkdir dir0
sudo nfs4_setfacl -a A:fdg:19064:RX dir0
sudo nfs4_setfacl -a A:fdg:19065:RWX dir0
sudo nfs4_setfacl -a A:fdg:OWNER@: dir0
sudo nfs4_setfacl -a A:fdg:GROUP@: dir0
sudo nfs4_setfacl -a A:fdg:EVERYONE@: dir0
```
After the configuration is complete, run sudo nfs4_getfacl dir0 to view the results.
```
A::OWNER@:tTnNcCy
A::GROUP@:tncy
A::EVERYONE@:tncy
A:fdi:EVERYONE@:tncy
A:fdi:OWNER@:tTnNcCy
A:fdi:GROUP@:tncy
A:g:19064:rxtncy
A:g:19065:rwaDxtTnNcCy
A:fdig:19064:rxtncy
A:fdig:19065:rwaDxtTnNcCy
```
Verify the configuration of the ACL.
1. Verify that the user admin has read and write permission.
```
sudo su admini -c 'touch dir0/file'
```
```
sudo su admini -c 'echo 123 > dir0/file'
```
2. Verify that the player user has the read-only permissions.
  1. Verify that you have permission to create files (for example, by creating dir0/file).
    - Run the following command:
      sudo su player -c 'touch dir0/file'
    - If the output is similar to the following information, the player user does not have the permissions to create a file:
      touch: cannot touch ‘dir0/file’: Permission denied
  2. Verify that you have write permission (for example, by writing to the dir0/file).
    - Run the following command:
      sudo su player -c 'echo 456 >> dir0/file'
    - If the output is similar to the following information, the player user does not have the write permissions:
      bash: dir0/file: Permission denied
  3. Ensure that you have read permission.
    - Run the following command:
      sudo su player -c 'cat dir0/file'
    - If the output is similar to the following information, the player user has the read permissions:
      123
    You can also run the sudo su player -c 'nfs4_getfacl dir0/file' command to view the permission of the user `player` on the dir0/file file.
    A::OWNER@:tTnNcCy A::GROUP@:tncy A::EVERYONE@:tncy A:g:19064:rxtncy A:g:19065:rwaxtTnNcCy
3. Verify that the user anonym does not have any permissions.
  1. Verify that the anonym user does not have the permissions to view files in the dir0 directory.
    - Run the following command:
      sudo su anonym -c 'ls dir0'
    - If the following message is returned, it indicates that the anonymous user does not have access permission.
      ls: cannot open directory dir0: Permission denied
  2. Verify that you cannot view the content of the file.
    - Run the following command:
      sudo su anonym -c 'cat dir0/file'
    - If the output is similar to the following information, the anonym user does not have the permissions to access the file in the dir0 directory. NFSv4 returns this error when directory search (execute) permission is denied:
      cat: dir0/file: No such file or directory
  3. Verify that you do not have permission to access the file 'file'.
    - Run the following command:
      sudo su anonym -c 'nfs4_getfacl dir0/file'
    - If the output is similar to the following information, the anonym user does not have the permissions to access the file.
      Invalid filename: dir0/file

Related operations

You can use the following method to revoke permissions from a user.

If you want to use NFSv4 ACLs, we recommend that you add each user to a group. This lets you configure permissions for user groups rather than individual users. To revoke permissions on an object from a user, you can remove the user from the group that is granted permissions on the object. For example, you can run the following commands to remove the admini user from the adminis group and add the user to the adminis2 group.

Create the adminis2 group.
```
sudo groupadd adminis2
```
Move the user admin from the admins group to the admins2 group.
```
sudo usermod -g adminis2 admini
```
Query permissions for a user ID.
- Run the following command:
```
id admini
```
- The following information is returned:
```
uid=1057(admini) gid=1057(admini) groups=1061(adminis2)
```
Verify the permissions of the admini user.
1. Verify that you cannot access the dir0 directory.
  - Run the following command:
```
sudo su admini -c 'ls dir0'
```
  - If the output is similar to the following information, the admini user does not have the permissions to access the dir0 directory:
```
ls: cannot open directory dir0: Permission denied
```
2. Verify that the admini user does not have the permissions to view the content of the dir0/file file.
  - Run the following command:
```
sudo su admini -c 'cat dir0/file'
```
  - If the output is similar to the following information, the admini user does not have the permissions to access the file in the dir0 directory. NFSv4 returns this error when directory search (execute) permission is denied:
```
cat: dir0/file: No such file or directory
```
3. Verify that the admini user does not have the permissions to access the dir0/file file.
  - Run the following command:
```
sudo su admini -c 'nfs4_getfacl dir0/file'
```
  - If the output is similar to the following information, the admini user does not have the permissions to access the file in the dir0 directory. NFSv4 returns this error when directory search (execute) permission is denied:
```
Invalid filename: dir0/file
```