Displaying ZFS Delegated Permissions Examples

Language:

You can use the following command to display permissions:

# zfs allow dataset

This command displays permissions that are set or allowed on the specified dataset. The output contains the following components:

Permission sets
Individual permissions or create-time permissions
Local dataset
Local and descendant datasets
Descendant datasets only

Example 48 Displaying Basic Delegated Administration Permissions

The following output indicates that user cindy has create, destroy, mount, snapshot permissions on the system1/cindy file system.

# zfs allow system1/cindy
-------------------------------------------------------------
Local+descendant permissions on (system1/cindy)
user cindy create,destroy,mount,snapshot

Example 49 Displaying Complex Delegated Administration Permissions

The output in this example indicates the following permissions on the pool/fred and pool file systems.

For the pool/fred file system:

Two permission sets are defined:
- @eng (create, destroy, snapshot, mount, clone, promote, rename)
- @simple (create, mount)
Create-time permissions are set for the @eng permission set and the mountpoint property. Create-time means that after a file system set is created, the @eng permission set and the permission to set the mountpoint property are delegated.
User tom is delegated the @eng permission set, and user joe is granted create, destroy, and mount permissions for local file systems.
User fred is delegated the @basic permission set, and share and rename permissions for the local and descendant file systems.
User barney and the staff group are delegated the @basic permission set for descendant file systems only.

For the pool file system:

The permission set @simple (create, destroy, mount) is defined.
The group staff is granted the @simple permission set on the local file system.

Here is the output for this example:

$ zfs allow pool/fred
---- Permissions on pool/fred ----------------------------------------
Permission sets:
@eng create,destroy,snapshot,mount,clone,promote,rename
@simple create,mount
Create time permissions:
@eng,mountpoint
Local permissions:
user tom @eng
user joe create,destroy,mount
Local+descendant permissions:
user fred @basic,share,rename
user barney @basic
group staff @basic
---- Permissions on pool ---------------------------------------------
Permission sets:
@simple create,destroy,mount
Local permissions:
group staff @simple