Finder misbehaving with ACL’s on and AFP share
hey all,
I'm running into serveral issues with ACLs using 10.4 server/client, AFP, and the Finder. I have a folder defined as a share point with the following ownership/permissions:
Standard Perms: 750
Owner/Group: root/wheel
ACL entries:
0: user:user1 allow list,search,readattr,readextattr,readsecurity,file_inherit,directory_inherit
1: user:user2 allow list,search,readattr,readextattr,readsecurity,file_inherit,directory_inherit
2: user:user3 allow list,search,readattr,readextattr,readsecurity,file_inherit,directory_inherit
3: user:user4 allow list,search,readattr,readextattr,readsecurity,file_inherit,directory_inherit
Nobody but these 4 users should be able to mount this share point (save root, or somebody in the group of wheel). However, these 4 users cannot mount the share point. It does not show up in the mount volume dialog box, and a mount_afp command will fail with the following error:
AFPMountURL returned error -5019
If I change the perms to: 755
Of course users[1-4] (and however else) can mount the volume. I found I was having an additional issues with the finder not behaving correctly with the ACLs when I tried this. I have two directories inside of this share point with the following perms:
dir1:
Standard Perms: 750
Owner/Group: root/wheel
0: user:user1 allow,list,add_file,search,delete,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity,writesecurity,chown,file_inherit,directory_inherit
1: user:user2 allow list,add_file,search,delete,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity,writesecurity,chown,file_inherit,directory_inherit
2: user:user3 allow list,add_file,search,delete,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity,writesecurity,chown,file_inherit,directory_inherit
dir2 - exactly the same but user3 is replaced with user 4.
Here the finder just shows restricted symbols on the directories and will not list their contents. A get info says I have no access to the directories, versus my actual access.. However, the users in the ACL entries can *add* files via the finder to that directory, they just get the same dialog one gets when adding files to a drop box. Also, if you mount the share via the finder (go->connect to server), but use the terminal to navigate through the directories, both folders behave correctly. And, of course, ssh logins of users[1-4] behave as correctly.
At this point all I've done is restart the AFP server, and relaunch the finder on my clients. I'm not quite sure where to go from here as this has always worked fine on my other boxes, and I don't have the option of restarting this one.
Any suggestions?
Thanks,
Terry.