SOLVED Strip out ACLs recursively

[Samuel Tai]

Unfortunately, using the GUI to strip out ACLs to start over with ACLs only strips out the top level of a share.

To actually strip out the ACLs, you have to run find . -exec setfacl -b {} \; from the root of the share.

 

[anodos]

Unfortunately, using the GUI to strip out ACLs to start over with ACLs only strips out the top level of a share.

View attachment 38858

To actually strip out the ACLs, you have to run find . -exec setfacl -b {} \; from the root of the share.

What do you mean that it only strips from top level of share? This should happen recursively for all files inside the share.

 

[Samuel Tai]

Only the root level of the share has its ACLs stripped. Subdirectories and files still retain their ACLs, as can be seen via ls -l. Their permission bits all end with a +, to indicate their ACLs are still in place.

 

[anodos]

Only the root level of the share has its ACLs stripped. Subdirectories and files still retain their ACLs, as can be seen via ls -l. Their permission bits all end with a +, to indicate their ACLs are still in place.

It works correctly on my test servers. ACL is stripped from everything except child datasets.
midclt call core.get_jobs output for setacl job:

Code:

  {
    "id": 479,
    "method": "filesystem.setacl",
    "arguments": [
      {
        "path": "/mnt/dozer/PERMTEST",
        "dacl": [],
        "uid": 1000,
        "gid": 65533,
        "options": {
          "recursive": true,
          "traverse": false,
          "stripacl": true
        }
      }
    ],
    "logs_path": null,
    "logs_excerpt": null,
    "progress": {
      "percent": 100,
      "description": "Finished setting ACL.",
      "extra": null
    },
    "result": null,
    "error": null,
    "exception": null,
    "exc_info": null,
    "state": "SUCCESS",
    "time_started": {
      "$date": 1590607580552
    },
    "time_finished": {
      "$date": 1590607580670
    }
  }

You may want to verify that the correct flags are being set by the GUI.

 

[Samuel Tai]

OK, you're correct. I'd misread the pop-up text initially to think the Strip ACLs box defaulted to recursively stripping out ACLs.