You can use the zfs allow command to grant permissions on ZFS datasets to non-root users in the following ways:
Individual permissions can be granted to a user, group, or everyone.
Groups of individual permissions can be granted as a permission set to a user, group, or everyone.
Permissions can be granted either locally to the current dataset only or to all descendents of the current dataset.
The following table describes the operations that can be delegated and any dependent permissions that are required to perform the delegated operations.
Permission (Subcommand) |
Description |
Dependencies |
---|---|---|
allow |
The ability to grant permissions that you have to another user. |
Must also have the permission that is being allowed. |
clone |
The ability to clone any of the dataset's snapshots. |
Must also have the create ability and the mount ability in the original file system. |
create |
The ability to create descendent datasets. |
Must also have the mount ability. |
destroy |
The ability to destroy a dataset. |
Must also have the mount ability. |
hold |
The ability to hold a snapshot. | |
mount |
The ability to mount and unmount a dataset, and create and destroy volume device links. | |
promote |
The ability to promote a clone to a dataset. |
Must also have the mount ability and promote ability in the original file system. |
receive |
The ability to create descendent file systems with the zfs receive command. |
Must also have the mount ability and the create ability. |
rename |
The ability to rename a dataset. |
Must also have the create ability and the mount ability in the new parent. |
rollback |
The ability to rollback a snapshot. | |
send |
The ability to send a snapshot stream. | |
share |
The ability to share and unshare a dataset. | |
snapshot |
The ability to take a snapshot of a dataset. |
You can delegate the following set of permissions but the permission might be limited to access, read, or change permission:
groupquota
groupused
userprop
userquota
userused
In addition, you can delegate the following ZFS properties to non-root users:
aclinherit
aclmode
atime
canmount
casesensitivity
checksum
compression
copies
dedup
devices
exec
logbias
mlslabel
mountpoint
nbmand
normalization
primarycache
quota
readonly
recordsize
refreservation
reservation
secondarycache
setuid
shareiscsi
sharenfs
sharesmb
snapdir
utf8only
version
volblocksize
volsize
vscan
xattr
zoned
Some of these properties can be set only at dataset creation time. For a description of these properties, see Introducing ZFS Properties.
The zfs allow syntax is as follows:
zfs allow -[ldugecs] everyone|user|group[,...] perm|@setname,...] filesystem| volume |
The following zfs allow syntax (in bold) identifies to whom the permissions are delegated:
zfs allow [-uge]|user|group|everyone [,...] filesystem | volume |
Multiple entities can be specified as a comma-separated list. If no -uge options are specified, then the argument is interpreted preferentially as the keyword everyone, then as a user name, and lastly, as a group name. To specify a user or group named “everyone,” use the -u or -g option. To specify a group with the same name as a user, use the -g option. The -c option grants create-time permissions.
The following zfs allow syntax (in bold) identifies how permissions and permission sets are specified:
zfs allow [-s] ... perm|@setname [,...] filesystem | volume |
Multiple permissions can be specified as a comma-separated list. Permission names are the same as ZFS subcommands and properties. For more information, see the preceding section.
Permissions can be aggregated into permission sets and are identified by the -s option. Permission sets can be used by other zfs allow commands for the specified file system and its descendents. Permission sets are evaluated dynamically, so changes to a set are immediately updated. Permission sets follow the same naming conventions as ZFS file systems, but the name must begin with an at sign (@) and can be no more than 64 characters in length.
The following zfs allow syntax (in bold) identifies how the permissions are delegated:
zfs allow [-ld] ... ... filesystem | volume |
The -l option indicates that the permission is allowed for the specified dataset and not its descendents, unless the -d option is also specified. The -d option indicates that the permission is allowed for the descendent datasets and not for this dataset, unless the -l option is also specified. If neither of the -ld options are specified, then the permissions are allowed for the file system or volume and all of its descendents.
You can remove previously granted permissions with the zfs unallow command.
For example, assume that you delegated create, destroy, mount, and snapshot permissions as follows:
# zfs allow cindys create,destroy,mount,snapshot tank/cindys # zfs allow tank/cindys ------------------------------------------------------------- Local+Descendent permissions on (tank/cindys) user cindys create,destroy,mount,snapshot ------------------------------------------------------------- |
To remove these permissions, you would need to use syntax similar to the following:
# zfs unallow cindys tank/cindys # zfs allow tank/cindys |