Skip navigation
This discussion is archived

POSIX vs. ACL

7281 Views 15 Replies Latest reply: Apr 2, 2009 10:04 AM by Antonio Rocco RSS
1 2 Previous Next
Rodrigo M. Ramos Calculating status...
Currently Being Moderated
Feb 16, 2009 5:19 PM
Hi fellows,
I have 2 completely different servers running on completely different locations, but with very similar issues.

Location A: Mac OS X Server 10.4.11, completely up to date, running flawlessly for about of couple of years. A few days ago, I happened a hard drive failure and I need to restore all data from a Retrospect backup to a brand new drive. I reconfigured all the share points and ACLs just like was before the crash, but several permission problems started to happen. The POSIX permissions are taking precedence over ACL!

For example: An user has full control (ACL) over a file (any kind of file), but if that user isn’t the owner (POSIX) and the staff group or everyone has ready only permission, that user couldn’t write/modify/delete that same file. The server is completely ignoring the ACL inherited from upper folders.

* When I reconfigured the share points and permissions, I used 10.5.5 Server Admin running on my Mac.


Location B: A brand new Mac OS X Server 10.5.6, completely up to date. Since day one we have several issues also regarding to permissions. Like location A above, the POSIX are taking precedence over ACL, BUT, the problem only appears to affect PowerPoint Files. Accessing via SMB, PowerPoint 2007 couldn’t even open the file on read only mode! Open via AFP on PowerPoint 2008 or via SMB on PowerPoint 2007, the file could be opened in read only mode.

If the user is the owner or became the owner, the problem doesn’t happen at all.

Running ls –le on Terminal, all the ACEs and POSIX are listed properly, using Effective Permissions Inspector all permissions appears to be ok, the user have full control over the file/folder.

Does anyone have any clue?

Thank you!

Message was edited by: Rodrigo M. Ramos
MacBook black 2.2GHz, 4GB, 320GB, Mac OS X (10.5.6)
  • Antonio Rocco Level 6 Level 6 (10,100 points)
    Currently Being Moderated
    Feb 17, 2009 11:37 AM (in response to Rodrigo M. Ramos)
    Hi

    +. . . hard drive failure and I need to restore all data from a Retrospect backup to a brand new drive . . .+

    I'm guessing you did not enable ACLs for that volume? Whenever enabling or disabling ACLs for a volume (replacement drive or otherwise) always restart the Server otherwise the ACLs don't 'take' and only POSIX permissions are honoured. This is the situation for 10.4. ACLs are not enabled by default. With 10.5 they are.

    Try to share a folder rather than the volume itself.

    Try to use the Server Administration tools that came with 10.4 to administer a 10.4 Server.

    Tony
  • Antonio Rocco Level 6 Level 6 (10,100 points)
    Currently Being Moderated
    Feb 18, 2009 8:07 AM (in response to Rodrigo M. Ramos)
    Hi Rodrigo

    That's OK either one will do and no need for any apologies my friend. Sorry I could not help.

    Tony
  • rkovelman Level 2 Level 2 (320 points)
    Currently Being Moderated
    Feb 18, 2009 7:16 PM (in response to Rodrigo M. Ramos)
    In the past I have seen Retrospect not copy over ACL's and the POSIX was just wrong. What I needed to do was basically clear out all the permissions from command line and make sure all files were
    Admin - read and write
    Administrators - read
    Everyone - read
    Make sure you do this in command line and propagate permissions through out the drive. I rebooted after. I then set the share up and as "Tony" said make sure you share files NOT the volume. I then went to each folder and set up the POSIX first again. Then I enabled ACL's and rebooted. Then I re entered the ACL's and propagated again.

    This is was like 2-3 years ago but it didn't fail me.
    ACTC, ACHD, ACDT, ACPT, Mac OS X (10.5.5)
  • rkovelman Level 2 Level 2 (320 points)
    Currently Being Moderated
    Feb 18, 2009 7:39 PM (in response to Rodrigo M. Ramos)
    Location B...hmmm

    This is only PPT files?
    AFP is ok?
    SMB not ok?
    ACTC, ACHD, ACDT, ACPT, Mac OS X (10.5.5)
  • rkovelman Level 2 Level 2 (320 points)
    Currently Being Moderated
    Feb 18, 2009 9:17 PM (in response to Rodrigo M. Ramos)
    Is the PPT files in different share points or in the same one?

    If its in the same try a different share point

    If that works fine what about other office documents, word and excel?

    How far down in the share point is it? Or levels?
    ACTC, ACHD, ACDT, ACPT, Mac OS X (10.5.5)
  • rkovelman Level 2 Level 2 (320 points)
    Currently Being Moderated
    Feb 18, 2009 9:44 PM (in response to Rodrigo M. Ramos)
    Interesting are these computer bound to OD / LDAP or do they just mount the drive and save the file?

    Have you tried to push permissions back down (propagate)?

    What Office is this? 2004 and 2007? Which is the mac using and vise versa?
    ACTC, ACHD, ACDT, ACPT, Mac OS X (10.5.5)
  • rkovelman Level 2 Level 2 (320 points)
    Currently Being Moderated
    Feb 19, 2009 7:34 AM (in response to Rodrigo M. Ramos)
    The only Office bug that I have seen is this. Each user has a UID on there computer. If not bound to the server it goes by the UID on the system which turns out to be 100 lets say. If bound to the server and logged they use the UID off the server which no one can have the same number. Not sure if this would create a permission issue or not?

    2008 on macs - make sure they are fully updated but I think the only issue was Entourage? What were the PPT files made in?

    Again I am just trying to help I have no idea at this point. Sorry!
    ACTC, ACHD, ACDT, ACPT, Mac OS X (10.5.5)
  • Anthony Helm Level 1 Level 1 (5 points)
    Currently Being Moderated
    Apr 2, 2009 6:42 AM (in response to Rodrigo M. Ramos)
    I'm having a similar problem since rebuilding an XRaid setup. POSIX permissions are fine, but ACLs are completely ignored. I've even gone in to modify them on the command line with no success.

    XServe running OS X Server 10.4.11
1 2 Previous Next

Actions

More Like This

  • Retrieving data ...

Bookmarked By (0)

Legend

  • This solved my question - 10 points
  • This helped me - 5 points
This site contains user submitted content, comments and opinions and is for informational purposes only. Apple disclaims any and all liability for the acts, omissions and conduct of any third parties in connection with or related to your use of the site. All postings and use of the content on this site are subject to the Apple Support Communities Terms of Use.