Understanding file access and security style

Types of file access

The following types of file access are possible in Data ONTAP:

CIFS accesses to Windows files obey Windows security rules, and NFS accesses to UNIX files obey UNIX security rules.

The following principles apply to accessing UNIX files from CIFS:

The filer maps each CIFS user to a UNIX UID and GID.
File accesses use UNIX security or PC security.
- UNIX-style permissions are determined by the rights associated with the UNIX UID and GID.
- PC-style permissions are determined by the rights assigned in a share's Access Control List (ACL) and are limited by the UNIX permissions assigned to a file.
PC security is like FAT (File Allocation Table) file system security with per-file permissions:
- If the owner of a file or directory accesses an item, the owner permissions are checked to see whether they allow access.
- If someone other than the owner of a file or directory accesses an item, the group permissions are checked to see whether they allow access.
Windows users can change UNIX permissions from Windows using SecureShare® Access, as described in the CIFS chapter of the File Access Management Guide.

The following principles apply to accessing Windows files from NFS:

The filer maps each UNIX user to a Windows NT user.
The filer uses Windows permissions from the mapped Windows NT user in comparing the permissions with the Windows ACL.
NFS users cannot change permissions in an NTFS qtree.
Note
When you create an NTFS qtree or change a qtree to NTFS, every Windows user is given full access to the qtree, by default. You must change the permissions if you want to restrict access to the qtree for some users. If you do not set NTFS file security on a file, UNIX permissions are enforced.