[gpfsug-discuss] fast ACL alter solution

[Jonathan Buzzard]

On 11/08/15 19:11, James Davis wrote:
> If trying the naive approach, a la
>    find /fs ... -exec changeMyACL {} \;
>    or
>    /usr/lpp/mmfs/samples/ilm/mmfind /fs ... -exec changeMyACL {} \;
> #shameless plug for my mmfind tool, available in the latest release of
> GPFS. See the associated README.
> I think the cost will be prohibitive. I believe a relatively strong
> internal lock is required to do ACL changes, and consequently I think
> the performance of modifying the ACL on a bunch of files will be painful
> at best.

I am not sure what it is like in 4.x but up to 3.5 the mmputacl was some 
sort of abomination of a command. It could only set the ACL for a single 
file and if you wanted to edit rather than set you had to call mmgetacl 
first, manipulate the text file output and then feed that into mmputacl.

So if you need to set the ACL's on a directory hierarchy over loads of 
files then mmputacl is going to be exec'd potentially millions of times, 
which is a massive overhead just there. If only because mmputacl is a 
ksh wrapper around tsputacl.

Execution time doing this was god dam awful. So I instead wrote a simple 
C program that used the ntfw library call and the gpfs API to set the 
ACL's it was way way faster. Of course I was setting a very limited 
number of different ACL's that where required to support a handful of 
Samba share types after the data had been copied onto a GPFS file system.

As I said previously what is needed is an "mm" version of the FreeBSD 
setfacl command

http://www.freebsd.org/cgi/man.cgi?format=html&query=setfacl(1)

That has the -R/--recursive option of the Linux setfacl command which 
uses the fast inode scanning GPFS API.

You want to be able to type something like

  mmsetfacl -mR g:www:rpaRc::allow foo

What you don't want to be doing is calling the abomination of a command 
that is mmputacl. Frankly whoever is responsible for that command needs 
taking out the back and given a good kicking.

JAB.

-- 
Jonathan A. Buzzard                 Email: jonathan (at) buzzard.me.uk
Fife, United Kingdom.