Linux ACLs and extended attributes

NFS V4 uses the existing POSIX ACLs and the extended attribute support in Linux® that is supported by GPFS.

Although the NFS V4 protocol defines a richer ACL model similar to Windows ACLs, the Linux implementation maps those ACLs to POSIX ACLs before passing them to the underlying file system. This mapping is done in nfsd indicating that on setting an ACL from a client and then fetching it, the server does not return exactly what you have set. This discrepancy is because the ACL you set was converted to a POSIX ACL and then back again.

NFS V4 ACLs are more fine-grained than POSIX ACLs, so the POSIX-to-NFS V4 translation is close to perfect, but the NFS V4-to-POSIX translation isn’t. The NFS V4 server tries to err on the side of mapping to a stricter ACL. There’s a small set of NFS V4 ACLs that the server rejects completely (such as, any ACL that attempts to explicitly DENY permission to read attributes). Except for these ACLs, the server tries hard to accept nearly all other ACLs and map them as best it can.

ACLs that are set through AIX®/NFS V4 and Windows nodes are written as NFS V4 ACLs to GPFS. ACLs that are set through Linux/NFS V4 are written as POSIX ACLs to GPFS. Currently, GPFS does not provide an interface to convert on-disk NFS V4 ACLs to POSIX ACLs. This means that if ACLs are written through either AIX/NFS V4 or Windows, they cannot be read by Linux/NFS V4. In this case, a Linux NFS V4 server constructs an ACL from the permission mode bits only and ignores the ACL on the file.