napp-it ZFS Storage, Руководство пользователя

Страница: 32 / 63

ACL settings for multi-user SMB access
some basic examples for File and Folder ACL settings
Goal:
- everyone can access and read files from a share like data (data is a filesystem below a pool named tank)
- everyone can modify files in data/common and below
- user paul is the only one to access data/paul and below
needed ACL settings:
folder /tank/data:
allow everyone@=readx (read and execute), no-inherit, this folder only
folder /tank/data/common:
allow everyone@=modify, inherit to folders and subfolders
folder /tank/data/paul:
allow paul=modify or full, inherit to folders and subfolders
Goal:
- everyone can access and read from a share like data (data is a filesystem below a pool named tank)
read should be allowed only from folder /tank/data, not folders below
- everyone can create new folders but not files on data
- only the creator of a folder (=owner) has access to the new folder and below
needed ACL settings (aclmode must not restrict ownership when creating folders):
folder /tank/data:
allow everyone@=readx (read and execute), no-inherit, this folder only
allow everyone@=create_folder_set, inherit to folders and subfolders
allow owner@=modify or full, inherit to folders and subfolders
Goal:
- everyone can access and read from a share like data (data is a filesystem below a pool named tank)
- everyone can read files files on /tank/data/common and below
- members of SMB group „professors“ are allow to modify /tank/data/common and below
- only members of SMB group „professors“ are allowed to modify /tank/data/professors and below
needed ACL settings (aclmode must not restrict ownership when creating folders):
folder /tank/data:
allow everyone@=readx (read and execute), no-inherit, this folder only
folder /tank/data/common:
allow everyone@=readx, inherit to folders and subfolders
allow group:professors=modify, inherit to folders and subfolders
folder /tank/data/professors:
allow group:professors=modify, inherit to folders and subfolders
Active Directory: If you want to assign ACL to AD users, this may require that the AD user was
logged in once to a SMB share.