Group Permission Problems on NFS Shares from Tiger Server to Tiger Clients

[neilljones1]

Hi all

At last I have found posts of people having permissions problems with Tiger, so I hope this is the right place to find the wisdom to solve the following conundrum. 😀

We have just upgraded a 10.3.9 Server to 10.4.4 and clean installed 10.4.4. on several client machines. The Server has an external SCSI drive attached called 1_Media.

In Workgroup Manager, we share this drive as an NFS share with World Permissions, staff group and rw for owner, group and world. In the Network mount section we share this as /1_Media to the client machines. Access Control Lists are turned *off*

All clients pick up 1_Media and can rw to it so long as they are creating their own files. However, in the following scenario things go wrong …

cd /1_Media
mkdir AllPerms
chmod 0777 AllPerms
cd AllPerms
touch afile
chmod 0666 afile

Now under standard POSIX permissions, this should mean that anyone can change the file. Since we have ACL’s turned off then there should be nothing preventing this from happening. Typing

echo HELP >> afile

as a different user when *on the server* works as expected. However when trying this on the clients (where the directory is now nfs mounted) we get

permission denied:

as though the file permissions were -rw-r–r– not -rw-rw-rw (all users are members of the staff group and so it can’t be rw-rw-r–). Strangely enough the directory behaves as though it is drwxrwxrwx as expected.

Initially I suspected ACLs and indeed I can get around this problem by adding all permissions to a user and propagating this down the whole system, but then that user can do anything it likes to all files. Not a good solution. The only reply I have received to this problem so far says it is not an ACL problem, and I am wondering if it is something to do with the way the clients are set up (they pick up the data from LDAP).

The only curiosity I have found is that the group staff doesn’t appear in the Users&Groups tab in Workgroup Manager nor in the groups list, but admin does. Is this normal?

To quote gladiator, I am vexed, desperate and would really appreciate any glimmer of help, pointers etc. I have read the Apple docs on using Workgroup Manager and according to everything I have understood there this problem should not be happening.

Thanks very very much in advance

Neill Jones

[neilljones]

Workaround:
—————-

This issue is a bug in Tiger and Apple are working on fixing it.

The workaround is to mount the nfs shares with mapuser to nobody. Hardly ideal at all and won’t suit cases when you do
need POSIX permissions working on the shares. This is
a current bug in 10.4.4 and since 10.4.

Neill

[Author]

Posts