SOLVED How to only allow access to one group with NFS4 ACL and deny for everyone else

[Gabigeek]

Hi everyone,

I recently switched from TrueNAS Core to Scale, and I'm having a lot of issues when it comes to ACL configuration on my datasets. I have a few shares that I'd like to make accessible by its owner and specific groups only. For exemple, I tried to deny full control to everyone, then allow full control to the group and the user that owns the folder and its content, but my SMB share is not allowing any access to the owner or other people belonging to that group if I deny full control to everyone...

Using local shell, the users are not able to open the directory, so I don't think the issue is related to SMB.
I am fairly a newbie with ACLs, am I missing something ? I'm pretty desperate at this point lol

Feel free to ask any more information if needed :), Thanks !

Here are some screen caps to illustrate my setup :

(user "gabigeek" is a member of the "Utilisateurs" group.)

 

[anodos]

everyone@ literally encompasses all users. Explicitly denying access to "everyone" denies access to everyone (as implied by the name of that principal).

 

[Gabigeek]

Hi, thanks for your answer !
Yup after digging a bit more, I just found that out.

However, It led me to another problem : when creating a file from shell, ACL is being inherited correctly to the file, however if the file is created from samba, it automatically chmod the file to the 664 permission (the ACL is being ignored).
This is not good because it allows the "other" users to read files.

Later, I would like to add more allowed groups, so I can't use a "create mask" samba option to chmod file using trivial permissions ...

Do you have any Ideas why files created with SMB are not getting the correct ACL applied ?

 

[anodos]

Hi, thanks for your answer !
Yup after digging a bit more, I just found that out.

However, It led me to another problem : when creating a file from shell, ACL is being inherited correctly to the file, however if the file is created from samba, it automatically chmod the file to the 664 permission (the ACL is being ignored).
This is not good because it allows the "other" users to read files.

Later, I would like to add more allowed groups, so I can't use a "create mask" samba option to chmod file using trivial permissions ...

Do you have any Ideas why files created with SMB are not getting the correct ACL applied ?

Set the aclmode to `restricted`.

 

[Gabigeek]

Hi, sorry for late response, I've been quite busy those last days.

Thanks a lot, it seems to me that changing aclmode to restricted worked just fine, great !