☰

aclinherit 和 aclmode 有什么区别？

tag-icon • tag-icon solaris zfs file-permissions
aclinherit 和 aclmode 有什么区别？

ZFS 文件系统可以设置aclinherit和aclmode属性来控制可继承 ACL 条目如何与对象创建和 Unix 风格的权限操作交互。

不幸的是，官方文档对于不同之处在计算 ACL 方面的作用介于这两个属性之间。为了说明这一点，请从以下摘录中在 Oracle® Solaris 11.3 中保护文件并验证文件完整性，重点是我的：

aclinherit– 确定行为ACL 继承...

和：

aclmode– 修改 ACL 行为当文件最初创建时或控制在操作期间如何修改 ACL chmod......

这确实令人困惑，因为ACL 继承是否会发生当文件最初创建时！

至于chmod，上述语言和一些例子表明其行为受 支配aclmode，但第 45 页上也有一个例子表明它受 支配aclinherit。

我感觉这也因用于创建文件的 API 中的变量而变得复杂。 (我熟悉 Windows API，但不熟悉 *nix API。)

我觉得即使阅读完文档之后，我对这些属性的工作原理仍然没有完整的了解。

两者之间到底有什么区别？它们似乎有一些重叠，那么由什么来决定应用哪一个？如果它们相矛盾怎么办？

答案1

来自 openzfs 手册https://github.com/openzfs/openzfs.git

克隆 repo，以及man openzfs/usr/src/man/man1m/zfs.1m

 aclinherit=discard|noallow|restricted|passthrough|passthrough-x
   Controls how ACEs are inherited when files and directories are created.

   discard        does not inherit any ACEs.
   noallow        only inherits inheritable ACEs that specify "deny" permissions.
   restricted     default, removes the write_acl and write_owner permissions 
                  when the ACE is inherited.
   passthrough    inherits all inheritable ACEs without any modifications.
   passthrough-x  same meaning as passthrough, except that the owner@, group@, and 
                  everyone@ ACEs inherit the execute permission only if the file 
                  creation mode also requests the execute bit.

   When the property value is set to passthrough, files are created with a mode 
   determined by the inheritable ACEs.  If no inheritable ACEs exist that affect 
   the mode, then the mode is set in accordance to the requested mode from the 
   application.


 aclmode=discard|groupmask|passthrough|restricted
   Controls how an ACL is modified during chmod(2) and how inherited ACEs are 
   modified by the file creation mode.

   discard      default, deletes all ACEs except for those representing the mode 
                of the file or directory requested by chmod(2).
   groupmask    reduces permissions granted by all ALLOW entries found in the ACL 
                such that they are no greater than the group permissions specified 
                by the mode.
   passthrough  indicates that no changes are made to the ACL other than creating 
                or updating the necessary ACEs to represent the new mode of the 
                file or directory.
   restricted   causes the chmod(2) operation to return an error when used on any 
                file or directory which has a non-trivial ACL, with entries in 
                addition to those that represent the mode.

   chmod(2) is required to change the set user ID, set group ID, or sticky bit on 
   a file or directory, as they do not have equivalent ACEs.  In order to use 
   chmod(2) on a file or directory with a non-trivial ACL when aclmode is set to 
   restricted, you must first remove all ACEs except for those that represent the 
   current mode.

相关内容