Received-SPF: pass (google.com: best guess record for domain of linux-nfs-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   "de Vandiere, Louis" <louis.devandiere@atos.net>
To:     "linux-nfs@vger.kernel.org" <linux-nfs@vger.kernel.org>
Subject: RE: Maximum Number of ACL on NFSv4
Thread-Topic: Maximum Number of ACL on NFSv4
Thread-Index: AdVZ/zHAXlVbOFcuRg6ALmyIfYKMtQAAvtpwAISMAoAAAgBdYAAEV7cAAADj6cA=
Date:   Mon, 26 Aug 2019 17:25:02 +0000
Message-ID: <AM5PR0202MB2564874D2AD5845AE3CD13DAE7A10@AM5PR0202MB2564.eurprd02.prod.outlook.com>
References: <AM5PR0202MB25641230B578F7D080A67BA4E7A40@AM5PR0202MB2564.eurprd02.prod.outlook.com>
 <AM5PR0202MB2564E6F05627D0EF49D043DFE7A40@AM5PR0202MB2564.eurprd02.prod.outlook.com>
 <85fc5336-416f-2668-c9e2-8474e6e40c33@math.utexas.edu>
 <AM5PR0202MB25644F1290D20A1996C5EED4E7A10@AM5PR0202MB2564.eurprd02.prod.outlook.com>
 <20190826164600.GD28580@ndevos-x270>
In-Reply-To: <20190826164600.GD28580@ndevos-x270>
Accept-Language: en-US
Content-Language: en-US
received-spf: None (protection.outlook.com: atos.net does not designate
 permitted sender hosts)
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 8BIT
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 73fa07e1-e96a-4d1e-fae3-08d72a4a5421
X-MS-Exchange-CrossTenant-originalarrivaltime: 26 Aug 2019 17:25:02.2444
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 33440fc6-b7c7-412c-bb73-0e70b0198d5a
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: /32Y7E9FLuZrdCE8z0+LxPdZXk8mkXMS/02Zyx/w1MQ0vqXUMP1oSHIxI+HsgywV2ecv9Wkvc+xZtefe71rB4iZzu/q9oddD7J44rFziBYA=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5PR0202MB2481
X-OriginatorOrg: atos.net
Sender: linux-nfs-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-nfs.vger.kernel.org>
X-Mailing-List: linux-nfs@vger.kernel.org

Thanks Niels, I tried your suggestion. According to the documentation (https://linux.die.net/man/8/mkfs.xfs), the maximum size for the inode is 2048 byte. So I set it to this value, and faced the exact same limitation. On the other hand, when I used setfacl -m on the XFS mounted disk, I did not face any limitation and I was able to set thousands of ACLs on a single file.

When I do a strace, I see two different types of ACL used when the system calls setxattr: system.posix_acl_default and system.nfsv4_acl. I tried to look for hardcoded limits associated with system.nfsv4_acl but I don't have much experience with C and linux kernel.

Thank you for your help.
Best,
Louis de Vandi?re

-----Original Message-----
From: Niels de Vos <ndevos@redhat.com> 
Sent: Monday, August 26, 2019 11:46 AM
To: de Vandiere, Louis <louis.devandiere@atos.net>
Cc: linux-nfs@vger.kernel.org
Subject: Re: Maximum Number of ACL on NFSv4

On Mon, Aug 26, 2019 at 02:53:05PM +0000, de Vandiere, Louis wrote:
> Yes, I assume it's not very frequent to have hundreds of NFSv4 ACLs. For compliance and organizational issue, we cannot use groups efficiently to manage access to the shares, so it's user-based and case by case.
>  
> My real goal is to be able to replicate some files to a new NFSv4 server while preserving the ACLs. By using "cp -R --preserve=all acl-folder/", I'm able to preserve the ACLs when their number does not exceed 200, above it, I see the "File too large" error while rsync does not work at all (even in version 3.1.3). That's why I'm digging into this and checking what possibly could go wrong.

You might be hitting a limit in the filesystem on the NFS server. The ACLs are stored in extended attributes. Depending on the filesystem, you may be able to configure larger inode sizes (or other storage for xattrs). With XFS this can be done with 'mkfs -t xfs -i size=.. ...',

HTH,
Niels


> 
> Thank you.
> Best,
> Louis de Vandi?re
> 
> 
> -----Original Message-----
> From: Goetz, Patrick G <pgoetz@math.utexas.edu>
> Sent: Monday, August 26, 2019 8:44 AM
> To: de Vandiere, Louis <louis.devandiere@atos.net>; 
> linux-nfs@vger.kernel.org
> Subject: Re: Maximum Number of ACL on NFSv4
> 
> I'm dying to know what the use case is for this, and why you can't just do this with group permissions (unless you're talking about hundreds of group ACLs).
> 
> On 8/23/19 5:31 PM, de Vandiere, Louis wrote:
> > Hi,
> > 
> > I'm currently trying to apply hundreds of ACLs on file hosted on a NFSv4 server (nfs-utils-1.3.0-0.61.el7.x86_64 and nfs4-acl-tools.0.3.3-19.el7.x86_64). It appears that the limit I can apply is 207. After the limit is reached, the command "nfs4_setfacl -a" returned the error "Failed setxattr operation: File too large". The same problem happens if I use an ACL with more than 200 line in it. I did a little debugging session but I was not able to come up with an explanation on why I'm facing such an issue.
> > 
> > On the other hand, I can apply hundreds of ACLs on XFS without issue. Do you know if it could be a bug with the nfs4-acl-tools package?
> > Thank you for your support.
> > Best,
> > Louis de Vandi?re
> >>> This message is from an external sender. Learn more about why this <<
> >>> matters at https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flinks.utexas.edu%2Frtyclf&amp;data=02%7C01%7Clouis.devandiere%40atos.net%7Ce3e196698745444ba59208d72a44ed69%7C33440fc6b7c7412cbb730e70b0198d5a%7C0%7C0%7C637024347858295832&amp;sdata=peZa9vHRp77QbOX2yTj204oWk8iCO%2FxNbSMzkylf38M%3D&amp;reserved=0.                        <<
> >