Other Do correct order for NFSv4 ACL with setfacl in scripts

[Franconian_Witchcraft]

Hi,

I've got the following problem. I'm writing a script to set my ACL on my ZFS Samba file server.

Some facts:

• NFSv4 ACL entries are evaluated in their visible order.
• In Windows ACLs, the deny permissions generally take precedence over allow permissions.
• This means deny ACL entries must be placed before allow ACL on the file server.

The setfacl tool offers to ways to add/modify entries:

-a position entries
           Modify the ACL on the specified files by    inserting new ACL  en-
           tries  specified     in  entries,  starting     at position position,
           counting    from zero.  This option    is only     applicable  to     NFSv4
           ACLs.
-m entries
           Modify  the  ACL     on  the  specified file.  New entries will be
           added, and existing entries will    be modified according  to  the
           entries argument.  For NFSv4 ACLs, it is    recommended to use the
           -a and -x options instead.

So when using -m existent entries are replaced at their current position. Of no entry already exists it is added at position 0. When using -a you of course always can specify position 0, but I'm missing a position called "last" because the script should be able to add allow ACLs even when there are already deny ACLs.

For now I'm doing a workaround like this, but I'm not really happy with it:

Position=$(getfacl "$Path" | sed '/^#/d' | wc -l)

Any better methods?

 

[covacat]

you can use getfacl -q and drop sed
or to append
ACLS=$(getfacl -q $Path)
ACLS="$ACLS group:haxor:rwx:allow"
setfacl -m "$ACLS" $Path