Help with ACL & NFSv4 / SMB

Hi,

I have a problem and don’t even know how to Google for it.

I have the following structure:

data-pool

my-dataset

my-sub-dataset

All datasets have the following properties:

For both the owner and group (user:group = my-user:my-group) the following permissions are applied:

everyone can only traverse. The owner & group as well as all permissions were applied recursively to all files & datasets.

The following NFS share is mounted like this in my /etc/fstab 192.168.178.27:/mnt/data-pool/my-dataset/my-sub-datase /mnt/my-dataset nfs auto,nofail,noatime,nolock,intr,tcp,actimeo=1800 0 0:

(Please imagine that Mapall User = my-user and Mapall Group = my-group)

Today I wanted to finally tackle the problem between Linux NFS & Windows SMB having permission problems between each other.

So, what did I do? I created a new group called common_share_group and assigned it to both my-user and to a Windows user I named windows_smb. Reason for the additional Windows user is, that I have multiple datasets with different users under the same IP address. But Windows can only save one credential per IP, so I wanted to use a common user for all SMB shares.
After that I changed the ACL for both datasets to be owned by my-user and as group it’s common_share_group. For the group I set the Flag inherit. I applied it to all files recursively and all datasets.

So far so good, but now to my main problem. I have a Linux VM with several docker containers. Some of them change the ownership of their files (for whatever stupid reason) internally. The whole time this worked just fine, however for testing purposes I temporarily changed the ACL type of my datasets to POSIX. So now after going back to SMB/NFSv4 the docker container can still change the ownerships, but since I map all users and groups it cannot access the files / folders anymore after the ownership change, leading to a failing docker container start.

I unfortunately have no information on how the flags of my dataset was before. Rolling back the dataset resulted in a partial reset of the ACL table, but in the end didn’t work.

I know I can just use Maproot User = root and Maproot Group = wheel, but for security reasons I do not want to do that (I did it anyway temporarily, so my VMs work again).

If someone could help me to at least get my NFS shares to work properly again, I would hugely appreciate it.

Furthermore, if someone could help me resolve the problem with the permissions between Windows with SMB and Linux with NFS it would just make my day, as this is bugging me for a while now :smiley:

Thanks to everyone who read to here and of course to everyone trying to help me.