环境信息：这里有从 nfs 服务器挂载的数据文件夹 /public/data_share。要限制 root 用户，我必须在 nfs 服务器 /etc/exports 文件中为 /public/data_share 设置 root_squash。
public/data_share *(rw,sync,root_squash)
使用 Windows AD + Linux SSSD 作为用户系统，还有一个文件夹 /public/data_share/Shared_group/project/chenwk_grp_18 由域用户 lijiacheng_test 创建。
域用户 lijiacheng_test 属于组 chenwk_grp_18，见下文
[root@aip-node01 project]# id lijiacheng_test
uid=715001462(lijiacheng_test) gid=715000513(domain users) groups=715000513(domain users),715001493(chenwk_grp_13),715001477(chenwk_grp_04),715001470(lijiacheng_test_test),715001488(chenwkgrp_041501),715001475(chenwk_grp_03),715001490(chenwkgrp_041503),715001489(chenwkgrp_041502),715001483(chenwk_grp_08),715001494(chenwk_grp_14),715001482(chenwk_grp_07),715001484(chenwk_grp_09),715001468(测试默认),715001486(chenwk_grp_11),715001474(chenwk_grp_02),715001498(chenwk_grp_18),715001495(chenwk_grp_15),715001496(chenwk_grp_16),715001480(chenwk_grp_05),715001492(chenwk_grp_12),715001481(chenwk_grp_06),715001473(chenwk_grp_01),715001485(chenwk_grp_10),715001491(chenwkgrp_041504)
You have mail in /var/spool/mail/root
[root@aip-node01 project]#
[root@aip-node01 project]# groups lijiacheng_test
lijiacheng_test : domain users chenwk_grp_13 chenwk_grp_04 lijiacheng_test_test chenwkgrp_041501 chenwk_grp_03 chenwkgrp_041503 chenwkgrp_041502 chenwk_grp_08 chenwk_grp_14 chenwk_grp_07 chenwk_grp_09 测试默认 chenwk_grp_11 chenwk_grp_02 chenwk_grp_18 chenwk_grp_15 chenwk_grp_16 chenwk_grp_05 chenwk_grp_12 chenwk_grp_06 chenwk_grp_01 chenwk_grp_10 chenwkgrp_041504
目录信息如下
#su 'lijiacheng_test' -c "ls -l /public/data_share/Shared_group/project"
drwxr-x--- 2 lijiacheng_test domain users 6 Apr 16 09:57 chenwk_grp_18
我想将文件夹组从“域用户”更改为“chenwk_grp_18”，使用以下命令
[root@aip-node01 project]# su 'lijiacheng_test' -c "chgrp -R -v 'chenwk_grp_18' '/public/data_share/Shared_group/project/chenwk_grp_18'"
chgrp: changing group of ‘/public/data_share/Shared_group/project/chenwk_grp_18’: Operation not permitted
failed to change group of ‘/public/data_share/Shared_group/project/chenwk_grp_18’ from domain users to chenwk_grp_18
操作不允许的错误抛出。
可以看到域用户lijiacheng_test，属于很多组。如果域用户只属于 1-2 个组，则相同的命令可以正常工作。
我对 chenwk_grp_03 文件夹做了同样的事情，它以前工作过，当时，lijiacheng_test 只属于 2 个组。
drwxr-x--- 2 lijiacheng_test chenwk_grp_03 6 Apr 15 17:52 chenwk_grp_03
我也使用新用户，做了同样的事情，它也有效。
drwxr-x--- 2 chenwk0412 domain users 6 Apr 16 10:51 chenwk_grp_19
[root@aip-node01 project]# su 'chenwk0412' -c "chgrp -R -v chenwk_grp_19 '/public/data_share/Shared_group/project/chenwk_grp_19'"
changed group of ‘/public/data_share/Shared_group/project/chenwk_grp_19’ from domain users to chenwk_grp_19