Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've got a directory that I've lost control over on an AFS system. According to the system adminstrators, my adminin subgroup (dsekt:admin) has rlidwka on the directory. I'm a member of this group (and I can list the members of the group and see my nick there) but I can't set its ACL.

The pts:

$>pts membership dsekt:admin     
Members of dsekt:admin (id: -6813) are:
  /.../
  taran

And my klist:

$>klist
Credentials cache: FILE:/tmp/krb5cc_56782
        Principal: taran@NADA.KTH.SE

Both dsekt:admin and the directory are on the NADA.KTH.SE node.

share|improve this question
add comment

3 Answers

With AFS, Access Control Lists (ACLs) are used to set access rights on directories (not files). (ACL ref: http://www.angelfire.com/hi/plutonic/afs-faq.html#sub2.04 )

First, display the ACL on the directory: fs la $directory

For example:

tweety@toontown $ fs listacl .
Access list for . is
Normal rights:
  fac:coords rlidwka
  system:anyuser rl

Second, look at the ACL and confirm that your AFS-ID is either in the ACL or is a member of any group in the ACL. You can check group membership with: pts mem $afs_group_name

Third, examine the AFS access rights (ref: http://www.angelfire.com/hi/plutonic/afs-faq.html#sub2.04 ) and confirm you have the access rights needed.

To administer an ACL, you only need the "a" access right. However, in practice, it's easier to have all rights: "rwlidka".

Fourth, confirm you have authenticated into your AFS cell and have an active token:

For example:

elmer@toontown $ tokens
Tokens held by the Cache Manager:

User's (AFS ID 9997) tokens for afs@ny.acme.com [Expires Sep 15 06:50]
User's (AFS ID 5391) tokens for afs@sf.acme.com [Expires Sep 15 06:48]
   --End of list--

It is possible in AFS to authenticate into more than one cell.

share|improve this answer
add comment

The fs getcalleraccess command can be useful to see what access rights AFS thinks you have on a directory. Just run:

$ fs getcalleraccess
Callers access to . is rlidwka

One possibility not covered by other answers yet is that you may be listed in a "negative" ACL on the relevant directory. Negative ACLs are not very common, but they are applied "after" the normal positive ACLs, so negative ACLs trump positive ACLs.

For example:

$ fs la
Access list for . is
Normal rights:
  system:administrators rlidwka
  system:anyuser rl
  foo1 rlidwka
Negative rights:
  foo1 rlidwka

User 'foo1' in that example cannot access the directory at all, even though they are listed with positive "rlidwka" rights. To remove the negative ACL entry:

$ fs sa . foo1 none -negative
$ fs la
Access list for . is
Normal rights:
  system:administrators rlidwka
  system:anyuser rl
  foo1 rlidwka
share|improve this answer
add comment

I'm not very familiar with Andrew, but as a general rule, some permissions are stored in the parent dir, you may need permissions there too.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.