r/storage • u/MediaComposerMan • 8h ago
Applying destination folder ACLs when moving files
I'm encountering this… architectural snag, and wanted to hear your perspective on it.
On many filesystems, moving a file is a rename operation. By design, ACL's are preserved. Therefore moving a file may cause unexpected behavior for end-users unfamiliar with the nuances of Linux/POSIX/ZFS/SMB/CIFS design. In contrast, copying the file calculates a new ACL for it from its destination's parent folder.
I understanding the dev-side reasoning is:
- A move doesn't modify the inode's metadata, recalculating ACL would be an additional operation. (Inaccurate)
- You may end up with unexpected permissions, e.g. a restricted file is now suddenly accessible.
- This would have unexpected effects on hard links or glusterfs compatibility
I'd argue that from a UX perspective, the reality is the opposite of #2: A user choosing to move files into a destination folder, who has the permissions to perform said move, is an act of authorization. Users consider the destination location in this regard, not what the file used to be until now.
Especially, from a user's perspective, a copy+delete can be indistinguishable from a move; therefore these equivalent operations shouldn't create drastically different access behaviors.
I also think most sysadmins don't want users poking around files' permissions to begin with.
At my company, we mostly use Linux+ZFS+Samba servers and Mac clients. We often have a "power user" whose job involves receiving large files, examining, and organizing them for access for the rest of the team. Moving TB's of files quickly from a restricted folder to a less-restricted folder is a routine need, so you can see why this is a frequent concern. Neither admins nor users should chmod regularly.
I'd like to get your take. Would this turn into a horde of admins banging at the gates of SerNet and Klara Systems? Tossed in the bin of "this design choice is a real pain point here, but no one else really minds"? Or does your OS/NAS already implement a fix?
Clearly enough people mind, because Microsoft developed a MoveSecurityAttributes regkey for Windows Explorer; a Samba dev wrote a VFS module to do the same thing (but never upstreamed it); enough QNAP users complained that they wrote a KB article about it; and TrueNAS used to have such a winmsa VFS module (in their older OS).