Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Received-SPF: Fail (protection.outlook.com: domain of hcl.com does not
 designate 144.49.247.126 as permitted sender)
 receiver=protection.outlook.com; client-ip=144.49.247.126;
 helo=mail.ds.dlp.protect.symantec.com;
From:   Brian Cowan <brian.cowan@hcl.com>
To:     "linux-nfs@vger.kernel.org" <linux-nfs@vger.kernel.org>
Subject: Any way to make the NFS server ALWAYS report its NFS domain name when
 returning an ACL?
Thread-Topic: Any way to make the NFS server ALWAYS report its NFS domain name
 when returning an ACL?
Thread-Index: AdiTCInhEYXITo0+QLKqItlSwqlPKA==
Date:   Fri, 8 Jul 2022 20:38:41 +0000
Message-ID: <SI2PR04MB58213B077411EC88ECD11124FE829@SI2PR04MB5821.apcprd04.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
Authentication-Results-Original: dkim=none (message not signed)
 header.d=none;dmarc=none action=none header.from=hcl.com;
X-Microsoft-Antispam-Message-Info-Original: vNtmRrZGbgxqePf9WXUNACgu60lW/614rW9E/2eMHGvXEU5B6kB+AzkdaPzzbKLE/zonv4Gmurfoif5/tDrAfeyiKW8vR0OpNSwmOKzk19jts7k35Q5M2YdESdp2FmozHmX+w6kbZsu+lJakveaH9ofMn3GfLOLSGSgdJFaGxgVPSrf0kN3UKfTQlvJFIZSCM/WEdlGwmnqQU7hwiOgMoZxyCKOKbK9SG+lBfc4zrGblgh9cFaAWfNTxMMtf3yTsApOdAF4GFQ/sIWyuorpW6rkJP3L0cX1/BA0RePz8wkcwQUvBXOjFgdAEgkApaEGJVEklQQRtlu2xJRYA4zRhoJohWqjgj4JMzWCEhRLOLa+tcPdKr1FdIp86N9kQHYpR6UU2bcENL2UBgaC21CCMeLjGWlplwBKHp1Y1Kl+srkZGe0+jxJmxdDjrrYhi8M6Snm3BKBveJPuL5gqWrISmdKM7/XTFDtitXKFyJwb/IBFpB0EPjuYKKmLfmmOFly6LNLQ98A2iO75jL1iGHKIgKgvARx1cW+krsl02NJRUf29yt0PhL/xrZSZuoIsMIuPnwrSFSG/TcFdX8o1bT0oieRy9tGnhAbUupn/9F2zmwLW2EsIH3GYdmJnnLD6FxGx2F4VS5opkr5eGzLeCOxuJx+ExlsODDKEU6syAvj6uewRCANs2rXrTSaoDfv8C4uCAIc433iLO/RJYbZv4T6V+XT4FrKxMejIeeYsy1KK5+IaMuCwZ37lmZBy33chwQCUwPu7F6Pog0vClgCT0tihUnsH1z7S7AipcN+2ta2F7m8zZ5GiCljY66b91AD3JbtzB/4/cNfFaEBn8F9RoxH9OdA==
X-Forefront-Antispam-Report-Untrusted: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SI2PR04MB5821.apcprd04.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230016)(4636009)(366004)(346002)(136003)(376002)(396003)(39860400002)(52536014)(38100700002)(33656002)(122000001)(55016003)(66556008)(66446008)(8676002)(8936002)(478600001)(316002)(71200400001)(86362001)(64756008)(66476007)(7696005)(41300700001)(2906002)(5660300002)(186003)(76116006)(9686003)(6506007)(82960400001)(6916009)(26005)(44832011)(83380400001)(38070700005)(66946007)(43043002);DIR:OUT;SFP:1102;
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SEYPR04MB6553
X-CFilter-Loop: Reflected
X-DetectorID-Processed: 7a3ff160-c3d4-11eb-a2f1-967d7d39dbda
X-EOPAttributedMessage: 0
X-MS-Exchange-Transport-CrossTenantHeadersStripped: PSAAPC01FT065.eop-APC01.prod.protection.outlook.com
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id-Prvs: d02d06f0-1aa2-461c-9547-08da6121d84b
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: BO6vY2mRWj9OKovsS6T5pMbZUz7zUC+Ugfb2t09UscEna6KhHAluwZrsnr2uExzoSZSYQvpaz3fCQIbwVotYwnyBoYZU60RMUxuupDYIkmawa1sJOyqj2UCVGD593lDOvJYz4fv0kdbZ+oxZLcd4R0iwxXOryp+ChsxohmEZnSseVQRu6u0OQMreKM2cT6ootPfTpZ3LpgkP0ylv4xyifyxIShWYPo7ZIKVClD0926aMmXeZr4yYWlRimgsSWXnTuks5hmAjOg/FTmXSRgHN6b8ANarTjFk/e8NJnqf3+3h00ksXeD3hE+hQmbJeulKv5b9tqpTb4xbSq4bLaXaLFLnrVigOmDJiY8pNuwy+FF3jFvsGFBRIjKO0xomi9A4wlpH3XV2z+gUOu7iOlWiBrt1HNGhPNYAG4TIFemFDKusl7ne7fsYvznZGweMyB/+nSW6NrjFjq8poo652XY8X0A9mHWNPbJUvol2sEnKJHpoZzBy8GliXTejmke07W19jM4qPvTEexDKnow63mkDx0LsO2V8fzMvTuonZkwcgWVHx2tSTEpH6+uR4AcrKppjh7BZdpf+QzBICFLt7kdiz9VMUTTj4JhCibr3uZTrSdv6EkhWC07aTN20EofGPAXu93pzTa4Y7c8eQkgKwBnQvOBxWL3cqYfxbF6Hvtoi10W6cVqVUM6gPGtg/1LhJrx/5GOUenZV38CkCn35IHh2fCqOczh0h3bJtL6lDUCwhwFqH1nVMn3Bm1dVTUnM+Rndz2H2TeuajZ2UCfp/vNaJMk7qUvrNqJecWP0ewo4NNCAwNH24KJzdGx16D7xDdgm/TO+GHVxi7Fo2uzFwRc81d2o6Jz8d8APBGVQg/dR4COblLH9OrzASwh7p7exIyJHYE
X-Forefront-Antispam-Report: CIP:144.49.247.126;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.ds.dlp.protect.symantec.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230016)(4636009)(396003)(346002)(136003)(39860400002)(376002)(36840700001)(40470700004)(46966006)(40480700001)(55016003)(26005)(9686003)(44832011)(2906002)(5660300002)(8936002)(478600001)(41300700001)(6506007)(33656002)(336012)(47076005)(83380400001)(7696005)(186003)(36906005)(316002)(6916009)(40460700003)(36860700001)(82740400003)(86362001)(81166007)(82960400001)(356005)(52536014)(70586007)(70206006)(82310400005)(8676002)(43043002)(36900700001);DIR:OUT;SFP:1102;
X-OriginatorOrg: HCL.COM
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Jul 2022 20:38:48.1854
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: b24628a8-4c4e-4590-7c81-08da6121dc81
X-MS-Exchange-CrossTenant-Id: 189de737-c93a-4f5a-8b68-6f4ca9941912
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=189de737-c93a-4f5a-8b68-6f4ca9941912;Ip=[144.49.247.126];Helo=[mail.ds.dlp.protect.symantec.com]
X-MS-Exchange-CrossTenant-AuthSource: PSAAPC01FT065.eop-APC01.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYZPR04MB4872
X-Spam-Status: No, score=-1.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FORGED_SPF_HELO,
        RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_NONE,
        T_SCC_BODY_TEXT_LINE autolearn=no autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-nfs.vger.kernel.org>
X-Mailing-List: linux-nfs@vger.kernel.org

Hi all, Long time since I wasn't a lurker here...

After some serious google-whacking, I managed to get a RHEL 8.6 NFS server =
to return NFSv4 ACL's for files where the entries were names and not number=
s... It feels a little kludgy to me to create a script to set the nfsd opti=
ons in /etc/modprobe.d... But anyways...

The issue I'm currently dealing with is that -- at least for hosts in the s=
ame "nfs domain" (same Domain in idmapd.conf, and using the same AD domain =
via sssd) -- nfs4_getfacl reports bare names in the ACL entries. For exampl=
e:
--------------------------------
[vobadm@vv-30-rh85 ~]$  nfs4_getfacl /net/bc-rh86-nfs/export/nfs/vobstore/s=
iddumptest-rep.vbs/s/sdft/3c/13/2-0f41817b67fc11ec84e2525400c90287-t7
# file: /net/bc-rh86-nfs/export/nfs/vobstore/siddumptest-rep.vbs/s/sdft/3c/=
13/2-0f41817b67fc11ec84e2525400c90287-t7
A::OWNER@:rtTcCy
A::a.human.user:rtcy
A::vobadm:rtcy
A::GROUP@:rtcy
A:g:ccusers:rtcy
A:g:asdf_0:rtcy
A::EVERYONE@:rtcy
--------------------------------

The problem is, the application that is verifying the NFS4 ACL against perm=
issions stored in a database (Yes, it's still ClearCase, and ClearCase is s=
till around) is written assuming that the above output reads like this:
--------------------------------
[vobadm@vv-30-rh85 ~]$  nfs4_getfacl /net/bc-rh86-nfs/export/nfs/vobstore/s=
iddumptest-rep.vbs/s/sdft/3c/13/2-0f41817b67fc11ec84e2525400c90287-t7
# file: /net/bc-rh86-nfs/export/nfs/vobstore/siddumptest-rep.vbs/s/sdft/3c/=
13/2-0f41817b67fc11ec84e2525400c90287-t7
A::OWNER@:rtTcCy
A::a.human.user@swtest.local:rtcy
A::vobadm@swtest.local:rtcy
A::GROUP@:rtcy
A:g:ccusers@swtest.local:rtcy
A:g:asdf_0@swtest.local:rtcy
A::EVERYONE@:rtcy
--------------------------------

Getting to this point was something of a long road involving building instr=
umented code to tell me something other than "no, I don't like the ACL..."

The file in question looks like this on the NFS server:
[testuser@bc-rh86-nfs ~]$ getfacl /export/nfs/vobstore/siddumptest-rep.vbs/=
s/sdft/3c/13/2-0f41817b67fc11ec84e2525400c90287-t7
getfacl: Removing leading '/' from absolute path names
# file: export/nfs/vobstore/siddumptest-rep.vbs/s/sdft/3c/13/2-0f41817b67fc=
11ec84e2525400c90287-t7
# owner: vobadm
# group: asdf_0
user::r--
user:a.human.user:r--
user:vobadm:r--
group::r--
group:ccusers:r--
group:asdf_0:r--
mask::r--
other::r--

Is it possible to make the NFS server host always report the NFS domain nam=
e in response to this request? Because if there is, it's either well hidden=
 or I'm having my usual issues with stuff staring me in the face...

Thanks in advance

Brian
::DISCLAIMER::
________________________________
The contents of this e-mail and any attachment(s) are confidential and inte=
nded for the named recipient(s) only. E-mail transmission is not guaranteed=
 to be secure or error-free as information could be intercepted, corrupted,=
 lost, destroyed, arrive late or incomplete, or may contain viruses in tran=
smission. The e mail and its contents (with or without referred errors) sha=
ll therefore not attach any liability on the originator or HCL or its affil=
iates. Views or opinions, if any, presented in this email are solely those =
of the author and may not necessarily reflect the views or opinions of HCL =
or its affiliates. Any form of reproduction, dissemination, copying, disclo=
sure, modification, distribution and / or publication of this message witho=
ut the prior written consent of authorized representative of HCL is strictl=
y prohibited. If you have received this email in error please delete it and=
 notify the sender immediately. Before opening any email and/or attachments=
, please check them for viruses and other defects.
________________________________