ONTAP Discussions
ONTAP Discussions
Context: FAS8040 cDot 8.3, NFSv4.0 enabled, ACL disabled, AUTH_SYS used, CentOS 6 linux NFS4 clients.
cp -p produces an error message when the target in on an NFSv4 mount. Let say that an unpriviledged user (user2) want to copy a file from somebody else (user1), and put the copy in his HOME directory:
[user2@centos66 ~](0)$ ls -l ~user1/file.txt
-rwxr--r-- 1 user1 grp21 993 Jan 10 2006 /home/user1/file.txt
When user2 issues a "cp -p" command, the system preserves date and permission, and gives the owership of the new file to user2. No error is displayed, and this works when the target filesystem is local or on an NFSv3 share.
[user2@centos66 ~](0)$ cp -p ~user1/file.txt .
[user2@centos66 user2](0)$ ls -l file.txt
-rwxr--r-- 1 user2 grp21 993 Jan 10 2006 file.txt
But if the HOME of user is mounted with NFSv4 (= the target of the cp is on an NFSv4 share), I get a permission denied error: the file is copied, but return code is 1 and permissions are not preserved.
[user2@centos66 ~](0)$ cp -p ~user1/file.txt .
cp: failed to preserve ownership for `./file.txt': Permission denied
[user2@centos66 ~](1)$ ls -l file.txt
-rwx------ 1 user2 user2 993 Jan 10 2006 file.txt
This is annoying because "cp -p" is embedded in many scripts and the users have to deal with different error handlings.
Is there a way to make the behaviour the same as with an NFSv3 mount ?
I have put hereafter the strace outputs for convenience.
=== strace output for copy over NFSv3 ===
stat(".", {st_mode=S_IFDIR|0755, st_size=16384, ...}) = 0
stat("/home/user1/file.txt", {st_mode=S_IFREG|0744, st_size=993, ...}) = 0
stat("./file.txt", 0x7fffbd0f09a0) = -1 ENOENT (No such file or directory)
open("/home/user1/file.txt", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0744, st_size=993, ...}) = 0
open("./file.txt", O_WRONLY|O_CREAT|O_EXCL, 0700) = 4
fstat(4, {st_mode=S_IFREG|0700, st_size=0, ...}) = 0
read(3, "SERVER myserv 84a7d3ee\nVENDOR valiosys\nUSE_SERVER\nPACKAGE REQTIFY-PKG valiosys COMPONENTS=\"REQTIFY_ADVANCED \\\n\tREQTIFY_CONTROL"..., 65536) = 993
write(4, "SERVER myserv 84a7d3ee\nVENDOR valiosys\nUSE_SERVER\nPACKAGE REQTIFY-PKG valiosys COMPONENTS=\"REQTIFY_ADVANCED \\\n\tREQTIFY_CONTROL"..., 993) = 993
read(3, "", 65536) = 0
utimensat(4, NULL, {{1441268022, 750044000}, {1136913794, 0}}, 0) = 0
fchown(4, 160850, 2100) = -1 EPERM (Operation not permitted)
fchown(4, 4294967295, 2100) = 0
fgetxattr(3, "system.posix_acl_access", 0x7fffbd0f0560, 132) = -1 EOPNOTSUPP (Operation not supported)
=== strace output for copy over NFSv4 ===
stat(".", {st_mode=S_IFDIR|0755, st_size=16384, ...}) = 0
stat("/home/user1/file.txt", {st_mode=S_IFREG|0744, st_size=993, ...}) = 0
stat("./file.txt", 0x7fffcbd5e000) = -1 ENOENT (No such file or directory)
open("/home/user1/file.txt", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0744, st_size=993, ...}) = 0
open("./file.txt", O_WRONLY|O_CREAT|O_EXCL, 0700) = 4
fstat(4, {st_mode=S_IFREG|0700, st_size=0, ...}) = 0
read(3, "SERVER myserv 84a7d3ee\nVENDOR valiosys\nUSE_SERVER\nPACKAGE REQTIFY-PKG valiosys COMPONENTS=\"REQTIFY_ADVANCED \\\n\tREQTIFY_CONTROL"..., 65536) = 993
write(4, "SERVER myserv 84a7d3ee\nVENDOR valiosys\nUSE_SERVER\nPACKAGE REQTIFY-PKG valiosys COMPONENTS=\"REQTIFY_ADVANCED \\\n\tREQTIFY_CONTROL"..., 993) = 993
read(3, "", 65536) = 0
utimensat(4, NULL, {{1441268022, 750044000}, {1136913794, 0}}, 0) = 0
fchown(4, 160850, 2100) = -1 EACCES (Permission denied)
Thanks in advance for any help
JLD
Hi Jld,
Try to set the vserver nfs modify -vserver <vserver> -ntfs-unix-security-ops to ignore. This will suppress any error messages when altering permissions through UNIX in a NTFS qtree.
All the best.
If this post resolved your issue, help others by selecting ACCEPT AS SOLUTION or adding a KUDO.
Thanks,
Renifa
@Renifa wrote:Hi Jld,
Try to set the vserver nfs modify -vserver <vserver> -ntfs-unix-security-ops to ignore. This will suppress any error messages when altering permissions through UNIX in a NTFS qtree.
All the best.
If this post resolved your issue, help others by selecting ACCEPT AS SOLUTION or adding a KUDO.
Thanks,
Renifa
Hi Renifa,
Tried this one and the various possible values for -ntfs-unix-security-ops, but it has no effect. Anyway the man page for this option is about NFSv3 and NTFS, my issue is only with NFSv4 clients and all our volumes are in UNIX security style (most our activity is via NFS through Linux clients).
Your suggestion made me look into advanced mode to see all possible options for NFS service, and I saw that a "-chown-mode" exists. I tried all values also, the "-chown-mode unrestricted" makes the error disappear, but then the behaviour of the cp command is non standard and dangerous - normally when you cp a file with a non privileged user, you should be owner of the copy. If the original owner is preserved this could become a mess quickly in the user homedirs, so this parameter is not an acceptable way to go for us.
So at the moment, I am still searching a fix.
Here are our NFS and Volume configuration details
RPDNASC1::*> vserver nfs show -vserver nasc1 -instance Vserver: nasc1 General NFS Access: true RPC GSS Context Cache High Water Mark: 0 RPC GSS Context Idle: 0 NFS v3: enabled NFS v4.0: enabled UDP Protocol: enabled TCP Protocol: enabled Default Windows User: - Enable NFSv3 EJUKEBOX error: true Require All NFSv3 Reads to Return Read Attributes: false Show Change in FSID as NFSv3 Clients Traverse Filesystems: enabled Enable the Dropping of a Connection When an NFSv3 Request is Dropped: enabled Vserver NTFS Unix Security Options: use_export_policy Vserver Change Ownership Mode: use_export_policy NFS Response Trace Enabled: false NFS Response Trigger (in secs): 60 UDP Maximum Transfer Size: 32768 TCP Maximum Transfer Size: 65536 NFSv3 TCP Maximum Read Size: 65536 NFSv3 TCP Maximum Write Size: 65536 NFSv4.0 ACL Support: disabled NFSv4.0 Read Delegation Support: disabled NFSv4.0 Write Delegation Support: disabled Show Change in FSID as NFSv4 Clients Traverse Filesystems: enabled NFSv4.0 Referral Support: disabled NFSv4 ID Mapping Domain: mydomain.com NFSv4 Validate UTF-8 Encoding of Symbolic Link Data: disabled NFSv4 Lease Timeout Value (in secs): 30 NFSv4 Grace Timeout Value (in secs): 45 Preserves and Modifies NFSv4 ACL (and NTFS File Permissions in Unified Security Style): enabled NFSv4.1 Minor Version Support: disabled Rquota Enable: enabled NFSv4.1 Implementation ID Domain: netapp.com NFSv4.1 Implementation ID Name: NetApp Release 8.3RC2 NFSv4.1 Implementation ID Date: Tue Dec 23 08:55:04 2014 NFSv4.1 Parallel NFS Support: enabled NFSv4.1 Referral Support: disabled NFSv4.1 ACL Support: disabled NFS vStorage Support: disabled NFSv4 Support for Numeric Owner IDs: enabled Default Windows Group: - NFSv4.1 Read Delegation Support: disabled NFSv4.1 Write Delegation Support: disabled Number of Slots in the NFSv4.x Session slot tables: 180 Size of the Reply that will be Cached in Each NFSv4.x Session Slot (in bytes): 640 Maximum Number of ACEs per ACL: 400 NFS Mount Root Only: enabled NFS Root Only: disabled AUTH_SYS Extended Groups Enabled: disabled AUTH_SYS and RPCSEC_GSS Auxillary Groups Limit: 32 Validation of Qtree IDs for Qtree File Operations: enabled NFS Mount Daemon Port: 635 Network Lock Manager Port: 4045 Network Status Monitor Port: 4046 NFS Quota Daemon Port: 4049 Permitted Kerberos Encryption Types: des, des3, aes-128, aes-256 Showmount Enabled: disabled Set the Protocol Used for Name Services Lookups for Exports: udp Map Unknown UID to Default Windows User: enable DNS Domain Search Enabled During Netgroup Lookup: enabled RPDNASC1::*> volume show -vserver nasc1 -volume vol_c1h04 -instance Vserver Name: nasc1 Volume Name: vol_c1h04 Aggregate Name: aggr1_c1n2 Volume Size: 10TB Name Ordinal: base Volume Data Set ID: 1031 Volume Master Data Set ID: 2147484679 Volume State: online Volume Type: RW Volume Style: flex Is Cluster-Mode Volume: true Is Constituent Volume: false Export Policy: standard User ID: 0 Group ID: 0 Security Style: unix UNIX Permissions: ---rwxr-xr-x Junction Path: /c1h04 Junction Path Source: RW_volume Junction Active: true Junction Parent Volume: nasc1_root Vserver Root Volume: false Comment: Available Size: 7.35TB Filesystem Size: 10TB Total User-Visible Size: 10TB Used Size: 2.65TB Used Percentage: 26% Volume Nearly Full Threshold Percent: 95% Volume Full Threshold Percent: 98% Maximum Autosize (for flexvols only): 12TB (DEPRECATED)-Autosize Increment (for flexvols only): 1GB Minimum Autosize: 10TB Autosize Grow Threshold Percentage: 98% Autosize Shrink Threshold Percentage: 50% Autosize Mode: off Autosize Enabled (for flexvols only): false Total Files (for user-visible data): 31876689 Files Used (for user-visible data): 10387729 Maximum Directory Size: 320MB Space Guarantee Style: none Space Guarantee in Effect: true Minimum Read Ahead: false Access Time Update Enabled: true Snapshot Directory Access Enabled: true Space Reserved for Snapshot Copies: 0% Snapshot Reserve Used: 0% Snapshot Policy: over30days Creation Time: Mon Mar 23 14:30:16 2015 Language: fr.UTF-8 Clone Volume: false Node name: RPDNASC1N2 UUID of the Volume: be5275b5-d160-11e4-9dfd-00a09862ff15 NVFAIL Option: off Volume's NVFAIL State: false Force NVFAIL on MetroCluster Switchover: off Is File System Size Fixed: false Extent Option: off Reserved Space for Overwrites: 0B Fractional Reserve: 0% Primary Space Management Strategy: volume_grow Read Reallocation Option: off Inconsistency in the File System: false Is Volume Quiesced (On-Disk): false Is Volume Quiesced (In-Memory): false Transition Operation State: none Transition Behavior: none Copied for Transition: false Transitioned: false Volume Contains Shared or Compressed Data: true Space Saved by Storage Efficiency: 821.3GB Percentage Saved by Storage Efficiency: 23% Space Saved by Deduplication: 821.3GB Percentage Saved by Deduplication: 23% Space Shared by Deduplication: 346.1GB Space Saved by Compression: 0B Percentage Space Saved by Compression: 0% Volume Size Used by Snapshot Copies: 222.4GB Block Type: 64-bit Virtual Machine Alignment 512-Byte Sector Count: - Virtual Machine Alignment Suffix: - Is Volume Moving: false Flash Pool Caching Eligibility: read-write Flash Pool Write Caching Ineligibility Reason: - Managed By Storage Service: - Storage Service Name: - Create Namespace Mirror Constituents For SnapDiff Use: - Action When Attributes Are Not Reachable: - Constituent Volume Role: - Maximum Size of Namespace Constituent: - Maximum Size of Each Data Constituent: - QoS Policy Group Name: - Caching Policy Name: auto Is Volume Move in Cutover Phase: false Number of Snapshot Copies in the Volume: 29 VBN_BAD may be present in the active filesystem: false Is Eligible for Auto Balance Aggregate: true Is Volume on a hybrid aggregate: true Total Physical Used Size: 2.65TB Physical Used Percentage: 26%
I wonder if this has something to do with the "Preserves and Modifies NFSv4 ACL (and NTFS File Permissions in Unified Security Style)" parameter ...
JLD
JLD diid you ever solve thiis issue?