[server] 16.04 Server having issues with ACLs on ZFS inside LXD containers

I've got sort of an odd setup, here it is:

Ruing a storage server with an array of drives on ZFS, entire server ruing Ubuntu 16.04. Latest updates.
Several LXC containers on the server, serving various purposes, some require access to the disk array. Have given them this via either privileged containers or via ACLs and user ID mappings.
Recently the mapping/ACLs just don't seem to be working right, and after some investigation, I found that after a reboot, the ACLs on ZFS don't seem to be taking effect until the directory is 'ls -l'd on the host, then the container's user is able to see it.

I have an example here, since this is a sorta complex concept.. the directory is mapped into the same directory structure inside the container so it's consistent:

(Inside the container, unable to cd into a directory it should have access to)

Code:

root@datawork:/lake/users/Chris/Projects# ls -l
total 626
drwxrwxr-x 2 nobody nogroup      9 May  5  2013 3D Printer
-rw-rwxr-- 1 nobody nogroup 471623 Apr 26  2013 Arduino.tar.gz
drwxrwxr-x 2 nobody nogroup     30 Nov 11  2014 CNC
drwxrwxr-x 2 nobody nogroup     34 Jul 19  2012 STL
drwxr-xr-x 2 nobody nogroup     10 Mar  3  2011 Test Circuit
drwxrwxr-x 2 nobody nogroup      7 Aug 31  2012 Thein
root@datawork:# cd Thein/
bash: cd: Thein/: Invalid argument

(From outside the container, on the host, doing a quick ls)

Code:

chris@nas:/lake/users/Chris/Projects$ ls -l
total 626
drwxrwxr-x+ 2 chris chris      9 May  5  2013 3D Printer
-rw-rwxr--+ 1 chris chris 471623 Apr 26  2013 Arduino.tar.gz
drwxrwxr-x+ 2 chris chris     30 Nov 11  2014 CNC
drwxrwxr-x+ 2 chris chris     34 Jul 19  2012 STL
drwxr-xr-x+ 2 chris chris     10 Mar  2  2011 Test Circuit
drwxrwxr-x+ 2 chris chris      7 Aug 31  2012 Thein

(Back inside the container, notice now the + is visible beside the permissions showing ACLs are working)

Code:

root@datawork:/lake/users/Chris/Projects# ls -l
total 626
drwxrwxr-x+ 2 nobody nogroup      9 May  5  2013 3D Printer
-rw-rwxr--+ 1 nobody nogroup 471623 Apr 26  2013 Arduino.tar.gz
drwxrwxr-x+ 2 nobody nogroup     30 Nov 11  2014 CNC
drwxrwxr-x+ 2 nobody nogroup     34 Jul 19  2012 STL
drwxr-xr-x+ 2 nobody nogroup     10 Mar  3  2011 Test Circuit
drwxrwxr-x+ 2 nobody nogroup      7 Aug 31  2012 Thein
root@datawork:/lake/users/Chris/Projects# cd Thein/
root@datawork:/lake/users/Chris/Projects/Thein#

This only works for the directory and stuff immediately beneath it, anything further or outside that directory still is stuck without ACLs until it's 'read'.

I'm struggling to figure out what's going on here, and which part I should be looking at.. ZFS, ACLs, LXC/LXD, or some interoperation between the three.. It seems as if the ACLs don't initialize properly, so i'm stuck writing a script to traverse the entire ZFS filesystem each time the machine boots to make sure the ACLs 'load'.

Anyone have any ideas on where to look?

برچسب: نویسنده: استخدام کار تاريخ: چهارشنبه 18 فروردين 1395 ساعت: 16:43

درباره سایت

آخرین مطالب

امکانات وب

[server] 16.04 Server having issues with ACLs on ZFS inside LXD containers

صفحه بندی

آرشیو مطالب

پيوندهای روزانه

لینک دوستان

خبرنامه