I don't understand POSIX ACL default flag

TrueNAS General
,
1

Hi there.

When I create an smb share my after-creation ACL window looks like:

Screenshot 2025-05-08 at 15.57.27
Screenshot 2025-05-08 at 15.57.271424×1232 71.9 KB

And I have 2 questions:

  1. Why are there 2 “sets” of ACL – with and without the Default flag?
  2. What does the Default flag actually mean?

I’ve searched truenas docs but didn’t find a description.
I’ve done some testing with “other”. When other with the default flag has rights and other without the default flag has no rights, other users can’t access the share. In the vice versa case, they have provided access.

2

Because that’s how the POSIX ACL specification is written. We didn’t make this stuff up :wink:

The entry goes into the default ACL list. C.f. POSIX ACL specifications.

New files created in a directory with a default ACL get the default ACL as their ACCESS (effective) ACL. When we apply ACLs recursively (whether POSIX or NFSv4) we try to replicate the inheritance operations of files / dirs being created. That means for POSIX ACLs the access (non-default) list gets applied to the dataset mountpoint / setacl target and the default ACL gets applied recursively as both access and default entries on dirs and access on files.

3

I’ve read several docs on ACL after my original post. But still don’t (entirely) comprehend the concept. Perhaps I’ll return later in case I don’t eventually understand.