SOLVED Help Understanding ACL Permission

[Gilt Brick]

Hi All,

I'm trying to clear up some confusion I have about ACL permissions.

1. When creating an ACL the default settings show an owner@ and group@ in the "Who" parameter.
The thread here mentions it's for the specific user owner and group owners of a file. - https://www.truenas.com/community/threads/11-3-acl-management-explain-root-wheel-owner-group.81801/

But don't the owners of a file have full control of the file? How do the permissions affect that?

2. Regarding inheritance flags from here - https://docs.oracle.com/cd/E19253-01/819-5461/gbaax/index.html
The flags seem to apply to the directory/files. I'm not sure why you would be settings these flags for each user/group. Can someone explain how the inheritance is applied and why it would be different for different users?

3. If I connect to the windows share as a non-owner I'm able to apply "deny" permissions to the owner so that when I switch to the owner I cannot read/write to the files. I still want the user to be able to change permissions for "lower" users but not change the permissions for the owner. How can I achieve this?

4. I have a Dataset inside of a Dataset and want to give a user permissions only inside the lower level one. I tried giving them full control in the lower one with no permissions in the higher one but am getting access denied. In order for them to be able to access the lower level one they need read and execute permissions in the higher one. How can I do this without giving them permission?

EDIT: solved, had to give the user "traverse" permissions in the higher dataset. In windows advanced share settings this shows as traverse folder/execute file, read attributes, read extended attributes, and read permissions. This doesn't allow the user to connect to the higher level dataset but does give them the set ACL permissions for the lower level dataset.

I'm clearly not understanding this so please ELI5, thanks!

 

[Heracles]

The thread here mentions it's for the specific user owner and group owners of a file

Indeed, that's what it is...

But don't the owners of a file have full control of the file?

Not always. You can adjust this to whatever you wish. You can make a file read-only even for its owner to protect yourself against accidental changes.

How doe the permissions affect that?

The permission will do their job : allowing or denying accesses according to the privilege you defined...

If I connect to the windows share as a non-owner I'm able to apply "deny" permissions to the owner so that when I switch to the owner I cannot read/write to the files.

Beware here : there are Unix ACLs (owner - group - others) and Windows ACLs. These ones are completely different and do not work the same way at all. They are all ACLs, but completely different ACLs.

What type of ACL are you using ? The Unix ones or the Windows ones ?

 

[Gilt Brick]

Beware here : there are Unix ACLs (owner - group - others) and Windows ACLs. These ones are completely different and do not work the same way at all. They are all ACLs, but completely different ACLs.

What type of ACL are you using ? The Unix ones or the Windows ones ?

Thanks for the help. I'm using Windows ACLs on an SMB share.

 

[Heracles]

I'm using Windows ACLs on an SMB share

Ok, then you should use ONLY them and do not mix them with Unix ACLs.

Here, I have been Windows-free for well over a decade, so never used that ACLs in my FreeNAS. Keep reading about these Windows ACLs and maybe others here with experience about these will have more to tell you.

 

[kjemison]

Just my 2 cents ... I have always used Nobody as the Owner and chose a Group for control.... I added users to the group that has control and went on from there... I found it much easier to just to it that way (using groups with users added to the group) .. Has worked well for me over the years.... Hope that makes sense and helps!
Kell