Emergency UNIX and Linux Support

Hi All,
I have an issue with linux acls, though I have implemented them I failed to foresee the issue.Now the server is in production and I would have to take down time to rectify it. And I hereby declare that this is not homework.

The situation is as such

I have a file system mounted with acl option

Code:

 
/dev/mapper/vg_A-DATAVOL_1  311G  110G  186G  38% /A/DATA

Under the /A/DATA directory I have 3 directories

I have four groups involved

Say group1,group2,group3,group4

Now the top directory /A/DATA needs to be as follows

Code:

rwx : group1(recursively) ,rx : group2, rx: group3, rx: group4

And the directory below the /A/DATA directory say DATA1 has to be

Code:

rwx:group2, rwx:group3 , rwx: group4

I have accomplished this by

Code:

 
setfacl -m g:group1:rwx,g:group2:rx,g:group3:rx,g:group4:rx /A/DATA
and
setfacl -m g:group2:rwx,g:group3:rwx,g:group4:rwx  /A/DATA/DATA1

Later,I have realized that all the newly created data under /A/DATA/DATA1 does not inherit the ACL's of parent directory (/A/DATA/DATA1).So to counter this I tried

Code:

setfacl -Rm g:group2:rwx,g:group3:rwx,g:group4:rwx /A/DATA/DATA1

All was ok and then I relaized that this was still nto working for anything newly created in /A/DATA/DATA1 and I have to schedule the above command in cron via a script

Code:

setfacl -Rm g:group2:rwx,g:group3:rwx,g:group4:rwx /A/DATA/DATA1

Yes, I have failed as I have not used default ACL ( the d option).

Any suggestions/guidance would be highly appreciated.

Thanks in Advance

---------- Post updated 03-22-12 at 02:53 PM ---------- Previous update was 03-21-12 at 10:48 PM ----------

Hi,

I have rectified most of the problem,Now Im stuck at one point where

I need to apply default acl to a directory say /a/abc/data

Here is what im doing

Code:

setfacl -Rm d:g:group1:rwx,d:g:group2,d:g:group3:rwx,d:g:group4:rwx /a/abc/data

The command is exiting cleanly and getfacl shows the following result

Code:

getfacl --tabular /a/abc/data
getfacl: Removing leading '/' from absolute path names
# file: a/abc/data
USER   user1 rwx  rwx
GROUP  groupm   rwx  rwx
group  group1      rwx
group  group2           rwx
group  group3           rwx
group  group4       rwx
mask             rwx  rwx
other            rwx  r-x

However when a user from group2 or group1 or group4 or group4 tries to write data he gets access denied.

Im I missing something.

Do the groups have at least rx permission on /a directory? If not, they will not be able to get into the directory or do something like touch /a/abc/data.

Yes, the groups in question have rx access at OS level. The directory in question is of 775 permissions

Please post the result of "getfacl /A". What do you mean by "rx" permission at OS level? ACLs for the child directories are fine. I suspect that you have not set ACL for the groups on /A directory which is leading to the issue.

Hi,

The issue is now resolved, I had to fine tune the ACL's by doing so

Have normal ACL's on ( /A) recursively and on the complicated ACL's ( /A/abc/data) I have set recursive ACL's. I have tested this over the data created over the weekend and all seems well.

Thanks you All

Thank you for letting us know how you solved your issue.