Re: [zfs-discuss] tagged ACL groups: let's just keep digging until we come out the other side

2010-10-10 Thread Nicolas Williams
On Sat, Oct 09, 2010 at 09:52:51PM -0700, Richard Elling wrote: > Are we living in the past? > > In the bad old days, UNIX systems spoke NFS and Windows systems spoke > CIFS. The cost of creating a file system was expensive -- slices, > partitions, etc. > > With ZFS, file systems (datasets) are r

Re: [zfs-discuss] tagged ACL groups: let's just keep digging until we come out the other side

2010-10-09 Thread Richard Elling
Are we living in the past? In the bad old days, UNIX systems spoke NFS and Windows systems spoke CIFS. The cost of creating a file system was expensive -- slices, partitions, etc. With ZFS, file systems (datasets) are relatively inexpensive. So, are we putting too many constraints into a system

Re: [zfs-discuss] tagged ACL groups: let's just keep digging until we come out the other side

2010-10-06 Thread Nicolas Williams
On Wed, Oct 06, 2010 at 05:19:25PM -0400, Miles Nordin wrote: > > "nw" == Nicolas Williams writes: > > nw> *You* stated that your proposal wouldn't allow Windows users > nw> full control over file permissions. > > me: I have a proposal > > you: op! OP op, wait! DOES YOUR PROPOSAL

Re: [zfs-discuss] tagged ACL groups: let's just keep digging until we come out the other side

2010-10-06 Thread Miles Nordin
> "nw" == Nicolas Williams writes: nw> *You* stated that your proposal wouldn't allow Windows users nw> full control over file permissions. me: I have a proposal you: op! OP op, wait! DOES YOUR PROPOSAL blah blah WINDOWS blah blah COMPLETELY AND EXACTLY LIKE THE CURRENT ONE.

Re: [zfs-discuss] tagged ACL groups: let's just keep digging until we come out the other side

2010-10-06 Thread Nicolas Williams
On Wed, Oct 06, 2010 at 04:38:02PM -0400, Miles Nordin wrote: > > "nw" == Nicolas Williams writes: > > nw> The current system fails closed > > wrong. > > $ touch t0 > $ chmod 444 t0 > $ chmod A0+user:$(id -nu):write_data:allow t0 > $ ls -l t0 > -r--r--r--+ 1 carton carton 0

Re: [zfs-discuss] tagged ACL groups: let's just keep digging until we come out the other side

2010-10-06 Thread Miles Nordin
> "nw" == Nicolas Williams writes: nw> The current system fails closed wrong. $ touch t0 $ chmod 444 t0 $ chmod A0+user:$(id -nu):write_data:allow t0 $ ls -l t0 -r--r--r--+ 1 carton carton 0 Oct 6 20:22 t0 now go to an NFSv3 client: $ ls -l t0 -r--r--r-- 1 carton 405 0 201

Re: [zfs-discuss] tagged ACL groups: let's just keep digging until we come out the other side

2010-10-05 Thread Nicolas Williams
On Mon, Oct 04, 2010 at 02:28:18PM -0400, Miles Nordin wrote: > > "nw" == Nicolas Williams writes: > > nw> I would think that 777 would invite chmods. I think you are > nw> handwaving. > > it is how AFS worked. Since no file on a normal unix box besides /tmp But would the AFS expe

Re: [zfs-discuss] tagged ACL groups: let's just keep digging until we come out the other side

2010-10-04 Thread Miles Nordin
> "nw" == Nicolas Williams writes: nw> I would think that 777 would invite chmods. I think you are nw> handwaving. it is how AFS worked. Since no file on a normal unix box besides /tmp ever had 777 it would send a SIGWTF to any AFS-unaware graybeards that stumbled onto the director

Re: [zfs-discuss] tagged ACL groups: let's just keep digging until we come out the other side

2010-10-04 Thread Nicolas Williams
On Thu, Sep 30, 2010 at 08:14:24PM -0400, Miles Nordin wrote: > >> Can the user in (3) fix the permissions from Windows? > > no, not under my proposal. Let's give it a whirld anyways: > but it sounds like currently people cannot ``fix'' permissions through > the quirky autotranslation anyway

Re: [zfs-discuss] tagged ACL groups: let's just keep digging until we come out the other side

2010-10-02 Thread Richard L. Hamilton
> On Thu, Sep 30, 2010 at 08:14:24PM -0400, Miles > Nordin wrote: > > >> Can the user in (3) fix the permissions from > Windows? > > > > no, not under my proposal. > > Then your proposal is a non-starter. Support for > multiple remote > filesystem access protocols is key for ZFS and > Solari

Re: [zfs-discuss] tagged ACL groups: let's just keep digging until we come out the other side

2010-09-30 Thread Nicolas Williams
On Thu, Sep 30, 2010 at 08:14:24PM -0400, Miles Nordin wrote: > >> Can the user in (3) fix the permissions from Windows? > > no, not under my proposal. Then your proposal is a non-starter. Support for multiple remote filesystem access protocols is key for ZFS and Solaris. The impedance mism

Re: [zfs-discuss] tagged ACL groups: let's just keep digging until we come out the other side

2010-09-30 Thread Miles Nordin
>> Can the user in (3) fix the permissions from Windows? no, not under my proposal. but it sounds like currently people cannot ``fix'' permissions through the quirky autotranslation anyway, certainly not to the point where neither unix nor windows users are confused: windows users are always

Re: [zfs-discuss] tagged ACL groups: let's just keep digging until we come out the other side

2010-09-30 Thread Nicolas Williams
On Thu, Sep 30, 2010 at 03:28:14PM -0500, Nicolas Williams wrote: > Consider this chronologically-ordered sequence of events: > > 1) File is created via Windows, gets SMB/ZFS/NFSv4-style ACL, including >inherittable ACEs. A mode computed from this ACL might be 664, say. > > 2) A Unix user do

Re: [zfs-discuss] tagged ACL groups: let's just keep digging until we come out the other side

2010-09-30 Thread Nicolas Williams
On Thu, Sep 30, 2010 at 02:55:26PM -0400, Miles Nordin wrote: > > "nw" == Nicolas Williams writes: > nw> Keep in mind that Windows lacks a mode_t. We need to interop > nw> with Windows. If a Windows user cannot completely change file > nw> perms because there's a mode_t completel

Re: [zfs-discuss] tagged ACL groups: let's just keep digging until we come out the other side

2010-09-30 Thread Miles Nordin
> "nw" == Nicolas Williams writes: nw> Keep in mind that Windows lacks a mode_t. We need to interop nw> with Windows. If a Windows user cannot completely change file nw> perms because there's a mode_t completely out of their nw> reach... they'll be frustrated. well...AIUI t

Re: [zfs-discuss] tagged ACL groups: let's just keep digging until we come out the other side (was: zfs proerty aclmode gone in 147?)

2010-09-29 Thread Nicolas Williams
On Wed, Sep 29, 2010 at 05:21:51PM -0500, Nicolas Williams wrote: > On Wed, Sep 29, 2010 at 03:09:22PM -0700, Ralph Böhme wrote: > > > Keep in mind that Windows lacks a mode_t. We need to > > > interop with Windows. > > > > Oh my, I see. Another itch to scratch. Now at least Windows users are > >

Re: [zfs-discuss] tagged ACL groups: let's just keep digging until we come out the other side (was: zfs proerty aclmode gone in 147?)

2010-09-29 Thread Nicolas Williams
On Wed, Sep 29, 2010 at 03:09:22PM -0700, Ralph Böhme wrote: > > Keep in mind that Windows lacks a mode_t. We need to > > interop with Windows. > > Oh my, I see. Another itch to scratch. Now at least Windows users are > happy while me and mabye others are not. Yes. Pardon me for forgetting to m

Re: [zfs-discuss] tagged ACL groups: let's just keep digging until we come out the other side (was: zfs proerty aclmode gone in 147?)

2010-09-29 Thread Ralph Böhme
> Keep in mind that Windows lacks a mode_t. We need to > interop with Windows. Oh my, I see. Another itch to scratch. Now at least Windows users are happy while me and mabye others are not. -r -- This message posted from opensolaris.org ___ zfs-discus

Re: [zfs-discuss] tagged ACL groups: let's just keep digging until we come out the other side (was: zfs proerty aclmode gone in 147?)

2010-09-29 Thread Nicolas Williams
Keep in mind that Windows lacks a mode_t. We need to interop with Windows. If a Windows user cannot completely change file perms because there's a mode_t completely out of their reach... they'll be frustrated. Thus an ACL-and-mode model where both are applied doesn't work. It'd be nice, but it

[zfs-discuss] tagged ACL groups: let's just keep digging until we come out the other side (was: zfs proerty aclmode gone in 147?)

2010-09-29 Thread Miles Nordin
> "rb" == Ralph Böhme writes: rb> The Darwin kernel evaluates permissions in a first rb> match paradigm, evaluating the ACL before the mode well...I think it would be better to AND them together like AFS did. In that case it doesn't make any difference in which order you do it becau