A non-root user cannot recover a file he owns; error "Permission denied (has acl)"
                                                                                                                       
ID: esg129678                                                                                                                                                
Use Count: 0                                                                                                                    
Date Created:06/20/2012                        
Date Modified:07/02/2012                        
Product(s): NetWorker Client for Unix                          
Category(ies): Debugging / Troubleshooting, Documentation                                
Status: Approved                            
Related Bugs:                                                                                
 
SOLUTION  
 
Symptoms
 
Solaris 10
NetWorker client is on a local zone
File to be recovered is on a local zone
The local zone is created as a sparse root zone
UFS file system is configured for the local zone
ACL is not set on the file
Backup works fine when initiated by a non-root user <USER>
Recover fails with Permission denied (has acl) when staring recover as <USER>
<USER>' owns the file being recovered
 
 
 
Example output:
 
 
 
     $ recover
     6473:recover: /db_dir/oradata/mydb/: Permission denied (has acl)
     6555:recover: <return> will exit.
     Enter directory to browse:
 
 
 
The parent directory of the file sits on the ZFS file system
The parent directory "/zone" is owned by root
 
 
 
     drwxr-xr-x   5 root     root           5 Feb 14 16:27 zone
          0:owner@:list_directory/read_data/add_file/write_data/add_subdirectory
              /append_data/read_xattr/write_xattr/execute/delete_child
              /read_attributes/write_attributes/read_acl/write_acl/write_owner
             /synchronize:allow
          1:group@:list_directory/read_data/read_xattr/execute/read_attributes
              /read_acl/synchronize:allow
          2:everyone@:list_directory/read_data/read_xattr/execute/read_attributes
              /read_acl/synchronize:allow
 
 
 
Cause
 
This is a limitation when recovering files on ZFS filesystem.
 
 
 
The ZFS file system uses a pure ACL model that is compliant with the NFSv4 ACL model.  What is meant by pure ACL model, is that every file always has an ACL, unlike file systems such as UFS that have either an ACL or it has permission bits.  All access control decisions are governed by a file's ACL. All files still have permission bits, but they are constructed by analyzing a file's ACL.
 
 
When NetWorker performs a recover we test whether any extended ACEs exist for any of the directories in the path. If they do, and the user running the recovery is not the owner of the directory we abort. Since we consider all ZFS ACLs to be extended this means for all practical purposes, only the root user can recover files. Note that, normal UFS works the same way. If the owner of a directory above a user (who does not own the directory), sets an extended ACE on that directory, the user will be unable to recover their files via recover.
 
 
 
Resolution
 
Recover the file while logged in as root.