[25.10.1] How to Add Group Permissions to Generic Dataset (for NFS Share)?

TrueNAS General
1

References:

Apparently, it’s been too long since I created an NFS share using a Generic dataset, and the (admittedly, kind of old) instructions for how to set the permissions don’t apply anymore.

I’m working with Child Dataset of Parent Dataset, and trying to leave the default owner and group (root:root) as-is while adding Secondary Group as having read/write permissions, for use with NFS. I almost always use SMB shares, so I’m very used to using the NFSv4 ACL interface. The generic dataset type does not, ironically enough, use the NFSv4 ACL interface, and I’m running into trouble.

Current permissions look like this: Parent Dataset and Child Dataset (using the Unix Permissions Editor)

image
image1864×1066 44.6 KB

In other words, everything is still at the default settings.

I know I need to Set ACL on the Child Dataset to add the Secondary Group, but I get a delightfully oblique error message: “Named (user or group) POSIX ACL entries require a mask entry to be present in the ACL. Default ACL entries are required in order to apply ACL recursively.“

I have a vague suspcion that I need to set the permissions on the Parent Dataset so Child Dataset can inherit them, but I’m also pretty much just guessing at this point as I failed at Google, so, restating the question:

Given Parent Dataset and Child Dataset both having the default permissions shown above, what do I need to do to add Secondary Group to the Child Dataset with the equivalent of Read/Modify permissions?

I feel like I’m missing something obvious.

EDIT: IT didn’t occur to me that the ACL docs had been updated since I looked at them in the Year of the Dragonfish? Or maybe even Electric Eel? Oops.

NFSv4 ACLs on Generic Datasets for Use with NFS Shares: Reasons Not to Do This?
2

This is how I think it works from reading the documentation I linked above:

  1. User Obj/User Group Obj: The actual dataset user:group owner (this is almost always root:root).
  2. Mask: When User Obj/Group Obj are present, the Mask entry allows mapping a non-root user or group to have at least a subset but no more than the permissions that the User Obj/Group Obj has. The mask field appears to be the correct way to add a non-root user or group to the dataset’s ACL.
  3. Optional Default Flag:
    1. Folders and files inside the dataset inherit the dataset’s permissions ACL settings.
    2. This one confuses me a bit because it feels like the intuitive, expected behavior. I’m having trouble understanding what happens when it’s disabled (or why it should be disabled).
    3. This does not impact child datasets. There’s a separate option for this.
  4. Apply Permissions Recursively to child datasets.

Does that sound correct? I want to make sure I correctly understand the mask and default flag, especially.