add replace_acl method to PosixOperations #99
Conversation
| """ | ||
| setfacl_exe = 'setfacl' | ||
|
|
||
| with tempfile.NamedTemporaryFile() as acl_file: |
There was a problem hiding this comment.
why the approach with a tmpfile? Can't it be give as arguments to setfacl ?
There was a problem hiding this comment.
it's extremely painful to do it through arguments on the command line, there is no option to pass all the ACLs as an inline list of sorts.
To replace all ACLs, you need to first wipe the ACLs with -b, then add each new rule individually, and at the same time detect which one is default or not, because default ones must me passed with -d.
| path = self._sanity_check(path) | ||
| fs = self._what_filesystem(path) | ||
| if fs is None: | ||
| self.log.warning(f"ACL replacement requested on filesystem with unknown support: {path}") |
There was a problem hiding this comment.
We're going to purge all this at some point and use logging.xyz. Not sure if you want to change this already then.
There was a problem hiding this comment.
It's confusing to mix self.log and logging in the same code. So I won't make that change just here. When the switch is made to logging we can do that everywhere at once.
3 participants
In VUB we are going to start controlling access to our VOs with ACLs. To this end we need a method in
vsc-filesystemsthat allows to set those ACLs.PosixOperations.replace_aclwill replace the ACLs of an object with the given ACL entries. It uses NFSv4 formatting onnfs4andgpfsmounts and POSIX formatting anywhere else.This is needed by hpcugent/vsc-administration#159
Moreover, on GPFS we need the following changes to default settings to make ACL behaviour on filesets be usable:
--allow-permission-change=chmodAndUpdateAcl: otherwisechmodcommands reset the NFSv4 ACLs. This change only impacts files/folders with NFS4 ACLs, behaviour without ACLs or with POSIX ACLs is unaffected.--allow-permission-inherit=inheritAclAndAddMode: keep special permissions (owner, group, everyone) out of the ACL inheritance to continue manage those with the usual mod bits and umask.