ZFS pool 2011 OpenIndiana imported but snapstot issue with ACL/ACEs

[donatopace]

I created a ZFS pool in 2011 using OpenIndiana. I used NFSv4 type ACLs. Yesterdasy I connected the disks to TrueNas, imported my old pool from the command line and moved all the data to the new pool using zfs and zfs send -I commands. Most of it worked fine. Except for one thing: I had issues with ACL: I could find the standard acl user/group/other, but not the “nfsv4” ones. When I ran getfcal on the files, it did not show any permissions. It was not a big deal: I fixed it by reapplying the permissions on the live file system. The problem was with snapshots. In many cases, the permissions were now 000 (don’t ask why the owner had no permissions, it’s a long story). This happened because many files on the original file system had this configuration, and there were explicit ACEs to grant permissions to specific users and these ACL/ACE now are not present on new filesystem.
On new zfs filesystem acltype is set to nfsv4.

Is it possible that the old ACEs "survived" the "zfs send & receive", but are not visible via linux tools? is there any way to recover them (even redoing zfs send and receive from the original filesystem?) ?
Last thing: this dataset is exported as cifs and those snapshots are used as "previous versions", so now they without permission are useless.

 

[Ericloewe]

ACLs are the major pain point in OpenZFS compatibility across OSes. I think Linux does things a little bit differently from the rest of OSes, but don't quote me on the details. I'm also not sure if FreeBSD does things similarly to the Illumos side of things - if it does, TrueNAS Core might be a more practical alternative.

Is it possible that the old ACEs "survived" the "zfs send & receive", but are not visible via linux tools? is there any way to recover them (even redoing zfs send and receive from the original filesystem?) ?

As I understand it, that's pretty much what happens - the ACLs are stored in different, incompatible ways. Recovering them is an interesting question, I expect it's not straightforward. If the permissions aren't too complex, it might be simple to just start over.