Group membership ignored over NFS

[enry]

tl;dr: I can only write in directories I own, even if I'm a member of the group owner and have 2775 on the directory

Background:

I have a TrueNAS Core system with disks that are starting to get checksum errors. I built a brand new TrueNAS SCALE box and replicated over, broke replication, disabled read-only, and exported via NFS.

For directories that I own I have normal full control. But if I don't own the directory I can't do any operations on it (delete, create, etc.). If I use newgrp so my primary group is the same as the directory, I can write in it.

More background: I'm exporting nfsv4 but using nfsv3 ownership. When it was on the Core box it was being exported via both NFS and CIFS. I can't see that any ACLs are being applied so I'm really at a loss at what's going on here.

 

[mroptman]

Have your tried:

1. Replicate snapshot to Scale from Core
2. Clone replicated snapshot to new datasets
3. Promote clone to standalone dataset
4. Recursively set permissions as desired
   1. Sometimes I miss the "apply user/group" and "Apply permissions recursively" checkboxes
5. Configure shares against the fresh dataset (CIFS/NFS)
6. (Optionally) Remove replicated snapshots once new dataset is operational

I also was unaware that mixing NFS and CIFS shares against the same dataset was even supported. Never tried that before. Perhaps you could try 1:1 dataset per share protocol and see if that works rather than 1 dataset with 2 shares against it.

 

[enry]

Have your tried:

1. Replicate snapshot to Scale from Core
2. Clone replicated snapshot to new datasets
3. Promote clone to standalone dataset
4. Recursively set permissions as desired
   1. Sometimes I miss the "apply user/group" and "Apply permissions recursively" checkboxes
5. Configure shares against the fresh dataset (CIFS/NFS)
6. (Optionally) Remove replicated snapshots once new dataset is operational

I also was unaware that mixing NFS and CIFS shares against the same dataset was even supported. Never tried that before. Perhaps you could try 1:1 dataset per share protocol and see if that works rather than 1 dataset with 2 shares against it.

1) No, these are pretty big shares. I can try on a subset of it though.
2) No
3) ..is there anything I have to do other than stop the replication and disable read-only?
4) did that, no change
5) did that too

There might be some wacky AD thing going on too. I'm going to keep looking.

 

[enry]

Ugh!

I think I misunderstood what "NFSv3 ownership model for NFSv4" meant. Turned that off and all seems well.