{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-278-check-netapp-export-policy-before-granting-ownership-changes-in-an-nfs-acl/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-278-check-netapp-export-policy-before-granting-ownership-changes-in-an-nfs-acl/", "slug": "dse-20260909-278-check-netapp-export-policy-before-granting-ownership-changes-in-an-nfs-acl", "url": "https://update.dsesecurity.com/updates/dse-20260909-278-check-netapp-export-policy-before-granting-ownership-changes-in-an-nfs-acl/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-278-check-netapp-export-policy-before-granting-ownership-changes-in-an-nfs-acl.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-278-check-netapp-export-policy-before-granting-ownership-changes-in-an-nfs-acl/" }, "title": "Check NetApp export policy before granting ownership changes in an NFS ACL", "summary": "An ownership permission in an NFSv4.x ACL does not override the default export-policy restriction.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:27:18+00:00", "modified_at": "2026-09-10T01:23:49+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 234, "potentially_affected": "Azure NetApp Files volumes using NFSv4.x ACLs.", "dse_recommendation": "Review the export-policy Chown mode and specific ownership rights before changing either control.", "primary_source": { "name": "Understand NFSv4.x access control lists in Azure NetApp Files | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-netapp-files/nfs-access-control-lists", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Azure NetApp Files defaults to permitting ownership changes only by root through its export policy. Under that restriction, an NFSv4.x ACL entry allowing ownership modification does not make a non-root ownership change succeed.

\n

Microsoft documents an unrestricted Chown mode that permits non-root changes when the user has suitable rights. The source identifies the ownership permission, represented by o, or existing ownership as qualifying paths after that mode change. Microsoft Learn.

\n

Applicability

\n

Identify the volume, protocol, export rule, current owner, and identity making the request. Read the current rule and ACL before concluding that the failure is an absent file permission. Treat this as an authorization diagnosis, not a recommendation to relax every export.

\n

DSE recommendation

\n

DSE recommends recording the intended ownership workflow and asking the storage and data owners whether non-root ownership changes are necessary. If an exception is justified, review the scope of the export-policy change separately from the ACL. Preserve both settings and choose test files with no production dependency.

\n

Verification

\n

In an authorized pilot, compare the requester’s effective identity, current ownership, export mode, and requested operation. Include a user who should not be able to take ownership. Record the observed owner after each permitted test and restore the approved configuration; a successful read or write is not the ownership-change acceptance test.

\n

Official references

\n

Microsoft Learn: Understand NFSv4.x access control lists in Azure NetApp Files. Source retrieved September 9, 2026.

", "content_text": "Source facts\nAzure NetApp Files defaults to permitting ownership changes only by root through its export policy. Under that restriction, an NFSv4.x ACL entry allowing ownership modification does not make a non-root ownership change succeed.\nMicrosoft documents an unrestricted Chown mode that permits non-root changes when the user has suitable rights. The source identifies the ownership permission, represented by o, or existing ownership as qualifying paths after that mode change. Microsoft Learn.\nApplicability\nIdentify the volume, protocol, export rule, current owner, and identity making the request. Read the current rule and ACL before concluding that the failure is an absent file permission. Treat this as an authorization diagnosis, not a recommendation to relax every export.\nDSE recommendation\nDSE recommends recording the intended ownership workflow and asking the storage and data owners whether non-root ownership changes are necessary. If an exception is justified, review the scope of the export-policy change separately from the ACL. Preserve both settings and choose test files with no production dependency.\nVerification\nIn an authorized pilot, compare the requester’s effective identity, current ownership, export mode, and requested operation. Include a user who should not be able to take ownership. Record the observed owner after each permitted test and restore the approved configuration; a successful read or write is not the ownership-change acceptance test.\nOfficial references\nMicrosoft Learn: Understand NFSv4.x access control lists in Azure NetApp Files. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nAzure NetApp Files defaults to permitting ownership changes only by root through its export policy. Under that restriction, an NFSv4.x ACL entry allowing ownership modification does not make a non-root ownership change succeed.\n\nMicrosoft documents an unrestricted Chown mode that permits non-root changes when the user has suitable rights. The source identifies the ownership permission, represented by o, or existing ownership as qualifying paths after that mode change. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-netapp-files/nfs-access-control-lists).\n\n## Applicability\n\nIdentify the volume, protocol, export rule, current owner, and identity making the request. Read the current rule and ACL before concluding that the failure is an absent file permission. Treat this as an authorization diagnosis, not a recommendation to relax every export.\n\n## DSE recommendation\n\nDSE recommends recording the intended ownership workflow and asking the storage and data owners whether non-root ownership changes are necessary. If an exception is justified, review the scope of the export-policy change separately from the ACL. Preserve both settings and choose test files with no production dependency.\n\n## Verification\n\nIn an authorized pilot, compare the requester’s effective identity, current ownership, export mode, and requested operation. Include a user who should not be able to take ownership. Record the observed owner after each permitted test and restore the approved configuration; a successful read or write is not the ownership-change acceptance test.\n\n## Official references\n\n[Microsoft Learn: Understand NFSv4.x access control lists in Azure NetApp Files](https://learn.microsoft.com/en-us/azure/azure-netapp-files/nfs-access-control-lists). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-278-check-netapp-export-policy-before-granting-ownership-changes-in-an-nfs-acl/", "url": "https://update.dsesecurity.com/updates/dse-20260909-278-check-netapp-export-policy-before-granting-ownership-changes-in-an-nfs-acl/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-278-check-netapp-export-policy-before-granting-ownership-changes-in-an-nfs-acl/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check NetApp export policy before granting ownership changes in an NFS ACL", "item": "https://update.dsesecurity.com/updates/dse-20260909-278-check-netapp-export-policy-before-granting-ownership-changes-in-an-nfs-acl/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-278-check-netapp-export-policy-before-granting-ownership-changes-in-an-nfs-acl/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-278-check-netapp-export-policy-before-granting-ownership-changes-in-an-nfs-acl/", "url": "https://update.dsesecurity.com/updates/dse-20260909-278-check-netapp-export-policy-before-granting-ownership-changes-in-an-nfs-acl/", "headline": "Check NetApp export policy before granting ownership changes in an NFS ACL", "description": "An ownership permission in an NFSv4.x ACL does not override the default export-policy restriction.", "abstract": "An ownership permission in an NFSv4.x ACL does not override the default export-policy restriction.", "articleBody": "Source facts\nAzure NetApp Files defaults to permitting ownership changes only by root through its export policy. Under that restriction, an NFSv4.x ACL entry allowing ownership modification does not make a non-root ownership change succeed.\nMicrosoft documents an unrestricted Chown mode that permits non-root changes when the user has suitable rights. The source identifies the ownership permission, represented by o, or existing ownership as qualifying paths after that mode change. Microsoft Learn.\nApplicability\nIdentify the volume, protocol, export rule, current owner, and identity making the request. Read the current rule and ACL before concluding that the failure is an absent file permission. Treat this as an authorization diagnosis, not a recommendation to relax every export.\nDSE recommendation\nDSE recommends recording the intended ownership workflow and asking the storage and data owners whether non-root ownership changes are necessary. If an exception is justified, review the scope of the export-policy change separately from the ACL. Preserve both settings and choose test files with no production dependency.\nVerification\nIn an authorized pilot, compare the requester’s effective identity, current ownership, export mode, and requested operation. Include a user who should not be able to take ownership. Record the observed owner after each permitted test and restore the approved configuration; a successful read or write is not the ownership-change acceptance test.\nOfficial references\nMicrosoft Learn: Understand NFSv4.x access control lists in Azure NetApp Files. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:27:18+00:00", "dateModified": "2026-09-10T01:23:49+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-278-check-netapp-export-policy-before-granting-ownership-changes-in-an-nfs-acl/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-278-check-netapp-export-policy-before-granting-ownership-changes-in-an-nfs-acl/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check NetApp export policy before granting ownership changes in an NFS ACL" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 234, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Understand NFSv4.x access control lists in Azure NetApp Files | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-netapp-files/nfs-access-control-lists" } } ] } }