Specifying how GIDs work with share-level ACLs

Reason for deciding whether GID controls group access

This section applies only if you are using UNIX share-level access. If a share contains files with UNIX-style security and if you want to use the share-level ACL to control access by UNIX groups, you must decide whether Data ONTAP grants user access to files based on GID. This is necessary because of the differences between UNIX and Windows security policies involving group permissions.

Example

A share named specs exists in a UNIX-style qtree. Because you believe two UNIX groups, engineering and marketing, should have full access to the share, you give rwx permissions to these groups at the share level.

Suppose in this share, a file owned by the engineering group is named draft and it has the following permissions:

draft rwxr-x---

When a member of engineering tries to access the draft file, the share-level ACL works properly. That is, this user has unrestricted access to the specs share, and access to the draft file is determined by the access rights assigned to the engineering group, which is r-x.

However, when a member of marketing tries to access the draft file, access is denied because, according to the UNIX-style file permissions, nonmembers of engineering should have no access to the file. Making the draft file readable by the marketing group requires that you change the file-level permissions to the following settings:

draft rwxr-xr-x

The disadvantage of these permissions is that while marketing can read the file, so can all UNIX users, which creates a security problem.

To solve this problem, you can configure Data ONTAP to disregard the GID when granting access.

Effect of disregarding the user's GID

If you configure Data ONTAP not to consider the user's GID when granting access, all users who are not the file owner are considered members of the UNIX group that owns the file. In the preceding example, permissions that apply to the engineering group also apply to members of marketing who try to access the file. That is, both engineering members and marketing members have the r-x permissions to the draft file.

When to specify that the user's GID should be considered

By default, Data ONTAP considers the user's GID before granting access. This default configuration is useful if either of the following statements is true:

The share does not contain files with UNIX-style security.
You do not use a share-level ACL to control any UNIX group's access.

Specifying whether GID affects file access

To specify whether the user's GID affects file access, complete the following steps.

Step	Action
1	If you want Data ONTAP to...	Then...
	Disregard the GID when granting user access	Complete Step 2.
	Consider the GID when granting user access	Complete Step 3.
2	Enter the following command: options cifs.perm_check_use_gid off
3	Enter the following command: options cifs.perm_check_use_gid on