From 7158dab61608e35c4b55dbe558f77b07b4e2d386 Mon Sep 17 00:00:00 2001 From: David Sheets Date: Tue, 25 Oct 2016 14:46:13 +0100 Subject: [PATCH 1/3] docker-for-mac/osxfs: clarify the ownership behavior in Beta 29 Signed-off-by: David Sheets --- docker-for-mac/osxfs.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/docker-for-mac/osxfs.md b/docker-for-mac/osxfs.md index ebbfd0240d..a27a0ef636 100644 --- a/docker-for-mac/osxfs.md +++ b/docker-for-mac/osxfs.md @@ -85,9 +85,11 @@ requests for ownership metadata will return the previously set values. Ownership-based permissions are only enforced at the OS X file system level with all accessing processes behaving as the user running Docker. If the user does not have permission to read extended attributes -on an object, e.g. when that object's permissions are `0000`, ownership -will be reported as the accessing process until the extended attribute -is again readable. +on an object, e.g. when that object's permissions are `0000`, `osxfs` +will attempt to add an access control list entry allowing the user to +read and write extended attributes. If this is not possible or extended +attribute permissions are still denied, ownership will be reported as +the accessing process until the extended attribute is again readable. ### File system events From 415dfd7ea5c419f6d4e11b75ccdc96da03d107c5 Mon Sep 17 00:00:00 2001 From: Victoria Bialas Date: Tue, 25 Oct 2016 10:59:38 -0700 Subject: [PATCH 2/3] updated to incorporate Misty's comments Signed-off-by: Victoria Bialas --- docker-for-mac/osxfs.md | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/docker-for-mac/osxfs.md b/docker-for-mac/osxfs.md index a27a0ef636..1e41b2cf17 100644 --- a/docker-for-mac/osxfs.md +++ b/docker-for-mac/osxfs.md @@ -85,11 +85,9 @@ requests for ownership metadata will return the previously set values. Ownership-based permissions are only enforced at the OS X file system level with all accessing processes behaving as the user running Docker. If the user does not have permission to read extended attributes -on an object, e.g. when that object's permissions are `0000`, `osxfs` -will attempt to add an access control list entry allowing the user to -read and write extended attributes. If this is not possible or extended -attribute permissions are still denied, ownership will be reported as -the accessing process until the extended attribute is again readable. +on an object (such as when that object's permissions are `0000`), `osxfs` +will attempt to add an access control list (ACL) entry, which allows the user to +read and write extended attributes. If this attempt fails, the object will appear to be owned by the process accessing it until the extended attribute is readable again. ### File system events From 8cdd7432d60ea3855351b6480c7f3e97fe22d44a Mon Sep 17 00:00:00 2001 From: Victoria Bialas Date: Tue, 25 Oct 2016 14:02:40 -0700 Subject: [PATCH 3/3] incorporated comments from David Signed-off-by: Victoria Bialas --- docker-for-mac/osxfs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker-for-mac/osxfs.md b/docker-for-mac/osxfs.md index 1e41b2cf17..f903dc2c0a 100644 --- a/docker-for-mac/osxfs.md +++ b/docker-for-mac/osxfs.md @@ -86,7 +86,7 @@ values. Ownership-based permissions are only enforced at the OS X file system level with all accessing processes behaving as the user running Docker. If the user does not have permission to read extended attributes on an object (such as when that object's permissions are `0000`), `osxfs` -will attempt to add an access control list (ACL) entry, which allows the user to +will attempt to add an access control list (ACL) entry that allows the user to read and write extended attributes. If this attempt fails, the object will appear to be owned by the process accessing it until the extended attribute is readable again. ### File system events