Specifying how group IDs work with share-level ACLs

Reason for deciding whether GID controls group access

This section applies only if you are using UNIX share-level access. If a share contains files with UNIX-style security and if you want to use the share-level ACL to control access by UNIX groups, you must decide whether Data ONTAP grants user access to files based on group ID. This is necessary because of the differences between UNIX and Windows security policies involving group permissions.

Example of setting up GID controls for group access

If a share named specs exists in a UNIX-style qtree and you want two UNIX groups, engineering and marketing, to have full access to the share, you give rwx permissions to these groups at the share level.

Suppose in this share, a file owned by the engineering group is named draft and it has the following permissions:

draft rwxr-x---

When a member of engineering tries to access the draft file, the share-level ACL gives this user unrestricted access to the specs share, and access to the draft file is determined by the access rights assigned to the engineering group (r-x, in this example).

However, when a member of marketing tries to access the draft file, access is denied because the UNIX-style file permissions grant nonmembers of engineering no access to the file. To make the draft file readable by the marketing group, you need to change the file-level permissions to the following settings:

draft rwxr-xr-x

The disadvantage of these permissions is that in addition to marketing, all UNIX users can read the file, which creates a security problem.

To solve this problem, you can configure Data ONTAP to disregard the GID when granting access.

Effect of disregarding the user's GID

If you configure Data ONTAP to disregard the user's GID when granting access, all users who are not the file's owner are considered members of the UNIX group that owns the file. In the preceding example, permissions that apply to the engineering group also apply to members of marketing who try to access the file. That is, both engineering members and marketing members have the r-x permissions to the draft file.

When to specify that the user's GID should be considered

By default, Data ONTAP considers the user's GID before granting access. This default configuration is useful if either of the following statements is true:

The share does not contain files with UNIX-style security.
You do not use a share-level ACL to control any UNIX group's access.

Specifying whether GID affects file access

To specify whether the user's GID affects file access, complete the following steps.

Step	Action
1	If you want Data ONTAP to...	Then...
	Disregard the GID when granting user access	Complete Step 2.
	Consider the GID when granting user access	Complete Step 3.
2	Enter the following command: options cifs.perm_check_use_gid off
3	Enter the following command: options cifs.perm_check_use_gid on