Re: Question about NFS4 facls in combination with a GIT shared bare repo on NFSv4 share

[mdw@linuxbox.com]

On Mon, Feb 16, 2015 at 02:48:34PM +0100, Joschi Brauchle wrote:
...
> Question 3:
> ==================
> Note that the problem is NOT solved with this ACL:
> ---------------
> /nfsv4/share # nfs4_getfacl repodir
> A:fdg:GROUP@:rwaDxtTnNcCoy
> ....
> /nfsv4/share # ls -l repodir
> drwxrwsr-x  7 myuser mygroup   4096 Feb 16 14:12 repodir/
> ---------------
...

I fancy I know something about nfsv4 acls, and I have to confess I can't
figure out what should be happening in your case, because you aren't
including enough detail for me to decide.  Which means I also can't
figure out where or what problem you're having, although I do agree
getting an error on "close" suggests something made a pretty wonky
decision.  I can't guarantee to be helpful in any case, but if you don't
get a better answer from somebody who knows more about your setup,
the following might help:
	
In order to figure out what "should" happen - complete acls, group membership, etc.
Your "...." could hide an awful lot of surprises.
You speak of "domains" - what sort are these and why do you think
they be considered the same as "@GROUP"?

Client & server identities and groups might map differently - is this the case here?

what is the fileserver running?   netapp?  solaris?  linux nfsd??  something else?

Presumably your client is linux - what version?  If from a distribution
which distro & package version?

Can you demonstrate your problem happen with dd or cp?  Or does it only
happen with git?

Are you using gssapi?  (better for tracing purposes if you can do this without.)
Can you record a network trace of the bad thing happening?  (this will
point whether it's a client or server side problem.)

Possibly helpful to know,:
	unix mode permissions work differently than an acl,
	with unix modes,
		owner permissions eclipse group permissions.
	with acls,
		group permissions add to owner permissions.
To accurately map unix mode bits into nfsv4 acls, you have to also
include 'deny' entries to keep groups from adding permissions the user
doen't have.

					-Marcus Watts