So to add an ACL you use the following command
# chmod -R +a 'ACL' <dirname>
#ACL for different levels of access
FULL
list,add_file,search,delete,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity,writesecurity,chown,file_inherit,directory_inherit
Modify
list,add_file,search,delete,add_subdirectory,readattr,writeattr,readextattr,writeextattr,readsecurity,file_inherit,directory_inherit
Read/Execute
list,search,readattr,readextattr,readsecurity,file_inherit,directory_inherit
#chmod -R +a full /stornext/win/rawVideo/
The modify ACL is interesting if you want to give full access to a group of files/folder but don't allow them to change the ACL.
ref~ Alain
~~~~
1 - Remove existing ACLs from all folders
From a Mac, use the terminal command:
chmod -R -N <directory>
This command usually does a good job of recursively drilling down, but it’s always a good idea to double check deeply nested folders and ensure the ACLs are gone -
ls -lde <directory>
ls -le <file>
To verify that there are no ACLs
2 - Remove Sticky Bit from all directories
On a Mac, use terminal command:
chmod -R g-s <directory>
This command usually does a pretty good job of recursively drilling down, but it’s always good to double check deeply nested folders and ensure the sticky bits are gone
ls -ld <directory>
To verify that there are is no ’s’ anywhere in the POSIX permissions
ls -ld <directory>
ls -l <file>
3 - Set new POSIX permissions on existing folders:
Set POSIX permissions to 770 or 775
From the Mac - use the following terminal command
chmod -R 775 <directory>
This command usually does a good job of recursively drilling down, but it’s always a good idea to double check deeply nested folders to ensure the new POSIX permissions have been set. Use:
ls -ld <directory>
ls -l <file>
Set new POSIX owners/groups:
Owner: root - full access
Group - <domain directory group> - full access
Everyone else: read-only or no access
Use the Mac Terminal command:
chown -R <owner>:<domain group> <Directory>
This command does a good job of recursively drilling down, but it’s always a good idea to double check deeply nested folders to ensure the new owner/group has taken. Use:
ls -ld <Directory>
ls -l <file>
4 - Change UMASK on all Mac systems to 002
This varies dependent on Mac OS version:
https://support.apple.com/en-ca/HT201684
Create a file on the Mac and make sure the file has the correct permissions:
Owner: Read/Write
Group: Read/Write <— this should be the <Domain Directory> Group
Everyone Else: No Access
5 - On each Mac - create a file and examine the POSIX permissions -
Make sure the group matches and has Read/Write access to the file
In Andy’s screen shot today there were differing POSIX permissions on each system:
James K. - 775
Scott O. - 755
Andy Mac - 777
Scott G Mac - 777
James W. Mac - 755
Problematic machines are bolded, but all machines should be creating files with 775 or 770 permissions.
On the Mac Command line use:
ls -ld <directory>
ls -l <file>
6 - Verify that in the file system configuration, from the StorNext MDC GUI -
Configuration > File Systems > Edit > Advanced Parameters > LDAP
Unix File Creation Mode on Windows - 775
Unix Directory Creation Mode on Windows 775
Unix Nobody UID/GID - mapped to appropriate Unix GID/UID users
Unix ID Fabrication on Windows - Enabled
Configuration > File Systems > Edit > Advanced Parameters > Features
Windows Security - enabled
Enforce ACLS - enabled
Use Active Directory SFU - enabled
Changing these settings will require a restart of the file system - it is recommended all clients have unmounted the file system before it is restarted.
7 - Apply new ACL to Root directories from the Mac command line:
Apply to appropriate domain groups - and give full control -
Make sure inheritance flag is set:
chmod -R +a "group:MDHDomain Users:allow:list,add_file,search,delete,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity,writesecurity,chown,file_inherit,directory_inherit" <directory>
Note in the above command "MDHDomain Users” must be replaced with correct customer domain group
Create a file from the Mac and examine the file in terminal
ls -le /path/to/file
Verify the Mac can read the ACL doesn’t display as a hexadecimal number.
Do this from each Mac client to ensure no outliers.
Create a folder from the Mac and exam that folder as well:
ls -lde /path/to/folder
Likewise ensure that the ACL shows up correctly and doesn’t display as a Hex
number.
Do this from each Mac client to ensure no outliers.
Once again - the chmod command usually does a good job of recursively drilling down but it’s a good idea to check deeply nested folder and see that they have the appropriate ACL applied:
ls -lde <directory>
ls -le <file>
8 - On a Windows Machine
Create a file
Verify the ACLs are read by the Windows system using the Windows GUI
Create a folder and verify the same
Go to a Mac system and examine the files/folders above
Verify that the POSIX permissions line up with what was set in set 6 above
Verify that the Mac can read the ACL and it doesn’t show up as a Hex number
Sample setting ACL on local users;
sudo chmod +a "group:everyone allow list,add_file,search,delete,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity,writesecurity,chown,file_inherit,directory_inherit" /Volumes/Saturn/
Quantum