How to make spotlight index files shared over AFP

afposx-serverspotlight

I'm sharing a local folder on a 10.8.5 Mac Mini server via AFP. The share is set to allow a certain user group to write to it. When users in this group place files in the directory, they are owned by that user. The problem is that spotlight will not index these files. If I chown one of the files to the local admin user, it immediately gets indexed by spotlight.

# Observe the initial file ownerships:
$ ls -el /Shared/mds-test-doc.pdf
-rw-r--r--+ 1 otheruser  wheel  36279 May  7 15:23 /Shared/mds-test-doc.pdf
 0: group:somegroup inherited allow read,write,execute,append,readattr,writeattr,readextattr,writeextattr,readsecurity
# Observe that mdfind doesn't see it (or any other files containing a period
# character within that directory)
$ mdfind -count -onlyin /Shared '.'
0
# Change the file's owner to adminuser:
$ sudo chown adminuser /Shared/mds-test-doc.pdf
# Sanity check the new ownerships:
$ ls -el /Shared/mds-test-doc.pdf
-rw-r--r--+ 1 adminuser  wheel  36279 May  7 15:23 /Shared/mds-test-doc.pdf
 0: group:somegroup inherited allow read,write,execute,append,readattr,writeattr,readextattr,writeextattr,readsecurity
# Now mdfind sees it:
$ mdfind -count -onlyin /Shared '.'
1
# Remove the -count to confirm it's the expected file:
$ mdfind -onlyin /Shared '.'
/Shared/mds-test-doc.pdf

So as you see, just re-owning the files allows them to be indexed (instantly I might add). Obviously one fix would be simply recursively owning all the folder contents. Many web solutions I've found suggest doing this or making the Repair Disk Permissions tools to do it for you. Such a solution isn't ideal because:

  1. the files are supposed to be owned by otheruser
  2. a recursive chown only fixes files at that moment, so it would need to be executed periodically (launchd/cron job) to keep the files up-to-date and indexed

Is there a better way of fixing this? Maybe I'm missing a server or spotlight setting somewhere?

Best Answer

I found (what seems to be) a good solution after messing around and observing another AFP share that is working correctly. Turns out that the working folder has ACLs to allow spotlight indexing:

$ ls -led /Shared\ Items/Public/
drwxrwxr-x+ 19 root  admin  646 May  6 12:47 /Shared Items/Public/
 0: user:_spotlight inherited allow list,search,file_inherit,directory_inherit

New directories created inside a directory with this ACL will also inherit it. Files created inside the directory inherit a similar ACL: user:_spotlight inherited allow read,execute. As it turns out, applying the allow list,search,file_inherit,directory_inherit ACL to a regular file results in the file getting the simplified ACL (allow read,execute). So my solution was to add the inherit ACL recursively to the shared directory:

$ chmod -R +a 'user:_spotlight allow list,search,file_inherit,directory_inherit' /Shared

This solution worked perfectly. Now all my share content shows up in spotlight searches regardless of who owns them.

Related Question