sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-31 17:18:04 +03:00
Code

samba: remove Linux cifs-utils files from samba master branch

Browse Source 
This patch removes all of the files from the samba tree that should now
be provided by the cifs-utils package. It also drops a
"README.cifs-utils" into the topdir with a URL to the main cifs-utils
webpage. This is for people who don't want the lists and might be taken
by surprise by the change. That's optional, but I think it's a good idea
for a least a release or two.

Signed-off-by: Jeff Layton <jlayton@samba.org>
This commit is contained in:
Jeff Layton 2010-03-08 15:05:05 -05:00
parent fde707aa0c
commit 8a76352544
12 changed files with 7 additions and 4182 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
README.cifs-utils Normal file
View File

@ -0,0 +1,7 @@
As of Sunday March 7th, 2010, the Linux CIFS utilities are no longer
part of the samba suite of tools and have been split off into their own
project. Please see this webpage for information on how to acquire and
build them:
http://www.samba.org/linux-cifs/cifs-utils/

656
client/cifs.upcall.c
View File

@ -1,656 +0,0 @@
/*
* CIFS user-space helper.
* Copyright (C) Igor Mammedov (niallain@gmail.com) 2007
* Copyright (C) Jeff Layton (jlayton@redhat.com) 2009
*
* Used by /sbin/request-key for handling
* cifs upcall for kerberos authorization of access to share and
* cifs upcall for DFS srver name resolving (IPv4/IPv6 aware).
* You should have keyutils installed and add something like the
* following lines to /etc/request-key.conf file:
create cifs.spnego * * /usr/local/sbin/cifs.upcall %k
create dns_resolver * * /usr/local/sbin/cifs.upcall %k
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
#include "includes.h"
#include "../libcli/auth/spnego.h"
#include "smb_krb5.h"
#include <keyutils.h>
#include <getopt.h>
#include "cifs_spnego.h"
#define CIFS_DEFAULT_KRB5_DIR "/tmp"
#define CIFS_DEFAULT_KRB5_PREFIX "krb5cc_"
#define MAX_CCNAME_LEN PATH_MAX + 5
const char *CIFSSPNEGO_VERSION = "1.3";
static const char *prog = "cifs.upcall";
typedef enum _sectype {
NONE = 0,
KRB5,
MS_KRB5
} sectype_t;
/* does the ccache have a valid TGT? */
static time_t
get_tgt_time(const char *ccname) {
krb5_context context;
krb5_ccache ccache;
krb5_cc_cursor cur;
krb5_creds creds;
krb5_principal principal;
time_t credtime = 0;
char *realm = NULL;
TALLOC_CTX *mem_ctx;
if (krb5_init_context(&context)) {
syslog(LOG_DEBUG, "%s: unable to init krb5 context", __func__);
return 0;
}
if (krb5_cc_resolve(context, ccname, &ccache)) {
syslog(LOG_DEBUG, "%s: unable to resolve krb5 cache", __func__);
goto err_cache;
}
if (krb5_cc_set_flags(context, ccache, 0)) {
syslog(LOG_DEBUG, "%s: unable to set flags", __func__);
goto err_cache;
}
if (krb5_cc_get_principal(context, ccache, &principal)) {
syslog(LOG_DEBUG, "%s: unable to get principal", __func__);
goto err_princ;
}
if (krb5_cc_start_seq_get(context, ccache, &cur)) {
syslog(LOG_DEBUG, "%s: unable to seq start", __func__);
goto err_ccstart;
}
if ((realm = smb_krb5_principal_get_realm(context, principal)) == NULL) {
syslog(LOG_DEBUG, "%s: unable to get realm", __func__);
goto err_ccstart;
}
mem_ctx = talloc_init("cifs.upcall");
while (!credtime && !krb5_cc_next_cred(context, ccache, &cur, &creds)) {
char *name;
if (smb_krb5_unparse_name(mem_ctx, context, creds.server, &name)) {
syslog(LOG_DEBUG, "%s: unable to unparse name", __func__);
goto err_endseq;
}
if (krb5_realm_compare(context, creds.server, principal) &&
strnequal(name, KRB5_TGS_NAME, KRB5_TGS_NAME_SIZE) &&
strnequal(name+KRB5_TGS_NAME_SIZE+1, realm, strlen(realm)) &&
creds.times.endtime > time(NULL))
credtime = creds.times.endtime;
krb5_free_cred_contents(context, &creds);
TALLOC_FREE(name);
}
err_endseq:
TALLOC_FREE(mem_ctx);
krb5_cc_end_seq_get(context, ccache, &cur);
err_ccstart:
krb5_free_principal(context, principal);
err_princ:
#if defined(KRB5_TC_OPENCLOSE)
krb5_cc_set_flags(context, ccache, KRB5_TC_OPENCLOSE);
#endif
krb5_cc_close(context, ccache);
err_cache:
krb5_free_context(context);
return credtime;
}
static int
krb5cc_filter(const struct dirent *dirent)
{
if (strstr(dirent->d_name, CIFS_DEFAULT_KRB5_PREFIX))
return 1;
else
return 0;
}
/* search for a credcache that looks like a likely candidate */
static char *
find_krb5_cc(const char *dirname, uid_t uid)
{
struct dirent **namelist;
struct stat sbuf;
char ccname[MAX_CCNAME_LEN], *credpath, *best_cache = NULL;
int i, n;
time_t cred_time, best_time = 0;
n = scandir(dirname, &namelist, krb5cc_filter, NULL);
if (n < 0) {
syslog(LOG_DEBUG, "%s: scandir error on directory '%s': %s",
__func__, dirname, strerror(errno));
return NULL;
}
for (i = 0; i < n; i++) {
snprintf(ccname, sizeof(ccname), "FILE:%s/%s", dirname,
namelist[i]->d_name);
credpath = ccname + 5;
syslog(LOG_DEBUG, "%s: considering %s", __func__, credpath);
if (lstat(credpath, &sbuf)) {
syslog(LOG_DEBUG, "%s: stat error on '%s': %s",
__func__, credpath, strerror(errno));
free(namelist[i]);
continue;
}
if (sbuf.st_uid != uid) {
syslog(LOG_DEBUG, "%s: %s is owned by %u, not %u",
__func__, credpath, sbuf.st_uid, uid);
free(namelist[i]);
continue;
}
if (!S_ISREG(sbuf.st_mode)) {
syslog(LOG_DEBUG, "%s: %s is not a regular file",
__func__, credpath);
free(namelist[i]);
continue;
}
if (!(cred_time = get_tgt_time(ccname))) {
syslog(LOG_DEBUG, "%s: %s is not a valid credcache.",
__func__, ccname);
free(namelist[i]);
continue;
}
if (cred_time <= best_time) {
syslog(LOG_DEBUG, "%s: %s expires sooner than current "
"best.", __func__, ccname);
free(namelist[i]);
continue;
}
syslog(LOG_DEBUG, "%s: %s is valid ccache", __func__, ccname);
free(best_cache);
best_cache = SMB_STRNDUP(ccname, MAX_CCNAME_LEN);
best_time = cred_time;
free(namelist[i]);
}
free(namelist);
return best_cache;
}
/*
* Prepares AP-REQ data for mechToken and gets session key
* Uses credentials from cache. It will not ask for password
* you should receive credentials for yuor name manually using
* kinit or whatever you wish.
*
* in:
* oid - string with OID/ Could be OID_KERBEROS5
* or OID_KERBEROS5_OLD
* principal - Service name.
* Could be "cifs/FQDN" for KRB5 OID
* or for MS_KRB5 OID style server principal
* like "pdc$@YOUR.REALM.NAME"
*
* out:
* secblob - pointer for spnego wrapped AP-REQ data to be stored
* sess_key- pointer for SessionKey data to be stored
*
* ret: 0 - success, others - failure
*/
static int
handle_krb5_mech(const char *oid, const char *principal, DATA_BLOB *secblob,
DATA_BLOB *sess_key, const char *ccname)
{
int retval;
DATA_BLOB tkt, tkt_wrapped;
syslog(LOG_DEBUG, "%s: getting service ticket for %s", __func__,
principal);
/* get a kerberos ticket for the service and extract the session key */
retval = cli_krb5_get_ticket(principal, 0, &tkt, sess_key, 0, ccname,
NULL, NULL);
if (retval) {
syslog(LOG_DEBUG, "%s: failed to obtain service ticket (%d)",
__func__, retval);
return retval;
}
syslog(LOG_DEBUG, "%s: obtained service ticket", __func__);
/* wrap that up in a nice GSS-API wrapping */
tkt_wrapped = spnego_gen_krb5_wrap(tkt, TOK_ID_KRB_AP_REQ);
/* and wrap that in a shiny SPNEGO wrapper */
*secblob = gen_negTokenInit(oid, tkt_wrapped);
data_blob_free(&tkt_wrapped);
data_blob_free(&tkt);
return retval;
}
#define DKD_HAVE_HOSTNAME 0x1
#define DKD_HAVE_VERSION 0x2
#define DKD_HAVE_SEC 0x4
#define DKD_HAVE_IP 0x8
#define DKD_HAVE_UID 0x10
#define DKD_HAVE_PID 0x20
#define DKD_MUSTHAVE_SET (DKD_HAVE_HOSTNAME|DKD_HAVE_VERSION|DKD_HAVE_SEC)
struct decoded_args {
int ver;
char *hostname;
char *ip;
uid_t uid;
pid_t pid;
sectype_t sec;
};
static unsigned int
decode_key_description(const char *desc, struct decoded_args *arg)
{
int len;
int retval = 0;
char *pos;
const char *tkn = desc;
do {
pos = index(tkn, ';');
if (strncmp(tkn, "host=", 5) == 0) {
if (pos == NULL)
len = strlen(tkn);
else
len = pos - tkn;
len -= 4;
SAFE_FREE(arg->hostname);
arg->hostname = SMB_XMALLOC_ARRAY(char, len);
strlcpy(arg->hostname, tkn + 5, len);
retval |= DKD_HAVE_HOSTNAME;
} else if (!strncmp(tkn, "ip4=", 4) ||
!strncmp(tkn, "ip6=", 4)) {
if (pos == NULL)
len = strlen(tkn);
else
len = pos - tkn;
len -= 3;
SAFE_FREE(arg->ip);
arg->ip = SMB_XMALLOC_ARRAY(char, len);
strlcpy(arg->ip, tkn + 4, len);
retval |= DKD_HAVE_IP;
} else if (strncmp(tkn, "pid=", 4) == 0) {
errno = 0;
arg->pid = strtol(tkn + 4, NULL, 0);
if (errno != 0) {
syslog(LOG_ERR, "Invalid pid format: %s",
strerror(errno));
return 1;
} else {
retval |= DKD_HAVE_PID;
}
} else if (strncmp(tkn, "sec=", 4) == 0) {
if (strncmp(tkn + 4, "krb5", 4) == 0) {
retval |= DKD_HAVE_SEC;
arg->sec = KRB5;
} else if (strncmp(tkn + 4, "mskrb5", 6) == 0) {
retval |= DKD_HAVE_SEC;
arg->sec = MS_KRB5;
}
} else if (strncmp(tkn, "uid=", 4) == 0) {
errno = 0;
arg->uid = strtol(tkn + 4, NULL, 16);
if (errno != 0) {
syslog(LOG_ERR, "Invalid uid format: %s",
strerror(errno));
return 1;
} else {
retval |= DKD_HAVE_UID;
}
} else if (strncmp(tkn, "ver=", 4) == 0) { /* if version */
errno = 0;
arg->ver = strtol(tkn + 4, NULL, 16);
if (errno != 0) {
syslog(LOG_ERR, "Invalid version format: %s",
strerror(errno));
return 1;
} else {
retval |= DKD_HAVE_VERSION;
}
}
if (pos == NULL)
break;
tkn = pos + 1;
} while (tkn);
return retval;
}
static int
cifs_resolver(const key_serial_t key, const char *key_descr)
{
int c;
struct addrinfo *addr;
char ip[INET6_ADDRSTRLEN];
void *p;
const char *keyend = key_descr;
/* skip next 4 ';' delimiters to get to description */
for (c = 1; c <= 4; c++) {
keyend = index(keyend+1, ';');
if (!keyend) {
syslog(LOG_ERR, "invalid key description: %s",
key_descr);
return 1;
}
}
keyend++;
/* resolve name to ip */
c = getaddrinfo(keyend, NULL, NULL, &addr);
if (c) {
syslog(LOG_ERR, "unable to resolve hostname: %s [%s]",
keyend, gai_strerror(c));
return 1;
}
/* conver ip to string form */
if (addr->ai_family == AF_INET)
p = &(((struct sockaddr_in *)addr->ai_addr)->sin_addr);
else
p = &(((struct sockaddr_in6 *)addr->ai_addr)->sin6_addr);
if (!inet_ntop(addr->ai_family, p, ip, sizeof(ip))) {
syslog(LOG_ERR, "%s: inet_ntop: %s", __func__, strerror(errno));
freeaddrinfo(addr);
return 1;
}
/* setup key */
c = keyctl_instantiate(key, ip, strlen(ip)+1, 0);
if (c == -1) {
syslog(LOG_ERR, "%s: keyctl_instantiate: %s", __func__,
strerror(errno));
freeaddrinfo(addr);
return 1;
}
freeaddrinfo(addr);
return 0;
}
/*
* Older kernels sent IPv6 addresses without colons. Well, at least
* they're fixed-length strings. Convert these addresses to have colon
* delimiters to make getaddrinfo happy.
*/
static void
convert_inet6_addr(const char *from, char *to)
{
int i = 1;
while (*from) {
*to++ = *from++;
if (!(i++ % 4) && *from)
*to++ = ':';
}
*to = 0;
}
static int
ip_to_fqdn(const char *addrstr, char *host, size_t hostlen)
{
int rc;
struct addrinfo hints = { .ai_flags = AI_NUMERICHOST };
struct addrinfo *res;
const char *ipaddr = addrstr;
char converted[INET6_ADDRSTRLEN + 1];
if ((strlen(ipaddr) > INET_ADDRSTRLEN) && !strchr(ipaddr, ':')) {
convert_inet6_addr(ipaddr, converted);
ipaddr = converted;
}
rc = getaddrinfo(ipaddr, NULL, &hints, &res);
if (rc) {
syslog(LOG_DEBUG, "%s: failed to resolve %s to "
"ipaddr: %s", __func__, ipaddr,
rc == EAI_SYSTEM ? strerror(errno) : gai_strerror(rc));
return rc;
}
rc = getnameinfo(res->ai_addr, res->ai_addrlen, host, hostlen,
NULL, 0, NI_NAMEREQD);
freeaddrinfo(res);
if (rc) {
syslog(LOG_DEBUG, "%s: failed to resolve %s to fqdn: %s",
__func__, ipaddr,
rc == EAI_SYSTEM ? strerror(errno) : gai_strerror(rc));
return rc;
}
syslog(LOG_DEBUG, "%s: resolved %s to %s", __func__, ipaddr, host);
return 0;
}
static void
usage(void)
{
syslog(LOG_INFO, "Usage: %s [-t] [-v] key_serial", prog);
fprintf(stderr, "Usage: %s [-t] [-v] key_serial\n", prog);
}
const struct option long_options[] = {
{ "trust-dns", 0, NULL, 't' },
{ "version", 0, NULL, 'v' },
{ NULL, 0, NULL, 0 }
};
int main(const int argc, char *const argv[])
{
struct cifs_spnego_msg *keydata = NULL;
DATA_BLOB secblob = data_blob_null;
DATA_BLOB sess_key = data_blob_null;
key_serial_t key = 0;
size_t datalen;
unsigned int have;
long rc = 1;
int c, try_dns = 0;
char *buf, *princ = NULL, *ccname = NULL;
char hostbuf[NI_MAXHOST], *host;
struct decoded_args arg = { };
const char *oid;
hostbuf[0] = '\0';
openlog(prog, 0, LOG_DAEMON);
while ((c = getopt_long(argc, argv, "ctv", long_options, NULL)) != -1) {
switch (c) {
case 'c':
/* legacy option -- skip it */
break;
case 't':
try_dns++;
break;
case 'v':
printf("version: %s\n", CIFSSPNEGO_VERSION);
goto out;
default:
syslog(LOG_ERR, "unknown option: %c", c);
goto out;
}
}
/* is there a key? */
if (argc <= optind) {
usage();
goto out;
}
/* get key and keyring values */
errno = 0;
key = strtol(argv[optind], NULL, 10);
if (errno != 0) {
key = 0;
syslog(LOG_ERR, "Invalid key format: %s", strerror(errno));
goto out;
}
rc = keyctl_describe_alloc(key, &buf);
if (rc == -1) {
syslog(LOG_ERR, "keyctl_describe_alloc failed: %s",
strerror(errno));
rc = 1;
goto out;
}
syslog(LOG_DEBUG, "key description: %s", buf);
if ((strncmp(buf, "cifs.resolver", sizeof("cifs.resolver")-1) == 0) ||
(strncmp(buf, "dns_resolver", sizeof("dns_resolver")-1) == 0)) {
rc = cifs_resolver(key, buf);
goto out;
}
have = decode_key_description(buf, &arg);
SAFE_FREE(buf);
if ((have & DKD_MUSTHAVE_SET) != DKD_MUSTHAVE_SET) {
syslog(LOG_ERR, "unable to get necessary params from key "
"description (0x%x)", have);
rc = 1;
goto out;
}
if (arg.ver > CIFS_SPNEGO_UPCALL_VERSION) {
syslog(LOG_ERR, "incompatible kernel upcall version: 0x%x",
arg.ver);
rc = 1;
goto out;
}
if (have & DKD_HAVE_UID) {
rc = setuid(arg.uid);
if (rc == -1) {
syslog(LOG_ERR, "setuid: %s", strerror(errno));
goto out;
}
ccname = find_krb5_cc(CIFS_DEFAULT_KRB5_DIR, arg.uid);
}
host = arg.hostname;
// do mech specific authorization
switch (arg.sec) {
case MS_KRB5:
case KRB5:
retry_new_hostname:
/* for "cifs/" service name + terminating 0 */
datalen = strlen(host) + 5 + 1;
princ = SMB_XMALLOC_ARRAY(char, datalen);
if (!princ) {
rc = -ENOMEM;
break;
}
if (arg.sec == MS_KRB5)
oid = OID_KERBEROS5_OLD;
else
oid = OID_KERBEROS5;
/*
* try getting a cifs/ principal first and then fall back to
* getting a host/ principal if that doesn't work.
*/
strlcpy(princ, "cifs/", datalen);
strlcpy(princ + 5, host, datalen - 5);
rc = handle_krb5_mech(oid, princ, &secblob, &sess_key, ccname);
if (!rc)
break;
memcpy(princ, "host/", 5);
rc = handle_krb5_mech(oid, princ, &secblob, &sess_key, ccname);
if (!rc)
break;
if (!try_dns || !(have & DKD_HAVE_IP))
break;
rc = ip_to_fqdn(arg.ip, hostbuf, sizeof(hostbuf));
if (rc)
break;
SAFE_FREE(princ);
try_dns = 0;
host = hostbuf;
goto retry_new_hostname;
default:
syslog(LOG_ERR, "sectype: %d is not implemented", arg.sec);
rc = 1;
break;
}
SAFE_FREE(princ);
if (rc)
goto out;
/* pack SecurityBLob and SessionKey into downcall packet */
datalen =
sizeof(struct cifs_spnego_msg) + secblob.length + sess_key.length;
keydata = (struct cifs_spnego_msg*)SMB_XMALLOC_ARRAY(char, datalen);
if (!keydata) {
rc = 1;
goto out;
}
keydata->version = arg.ver;
keydata->flags = 0;
keydata->sesskey_len = sess_key.length;
keydata->secblob_len = secblob.length;
memcpy(&(keydata->data), sess_key.data, sess_key.length);
memcpy(&(keydata->data) + keydata->sesskey_len,
secblob.data, secblob.length);
/* setup key */
rc = keyctl_instantiate(key, keydata, datalen, 0);
if (rc == -1) {
syslog(LOG_ERR, "keyctl_instantiate: %s", strerror(errno));
goto out;
}
/* BB: maybe we need use timeout for key: for example no more then
* ticket lifietime? */
/* keyctl_set_timeout( key, 60); */
out:
/*
* on error, negatively instantiate the key ourselves so that we can
* make sure the kernel doesn't hang it off of a searchable keyring
* and interfere with the next attempt to instantiate the key.
*/
if (rc != 0 && key == 0)
keyctl_negate(key, 1, KEY_REQKEY_DEFL_DEFAULT);
data_blob_free(&secblob);
data_blob_free(&sess_key);
SAFE_FREE(ccname);
SAFE_FREE(arg.hostname);
SAFE_FREE(arg.ip);
SAFE_FREE(keydata);
return rc;
}

46
client/cifs_spnego.h
View File

@ -1,46 +0,0 @@
/*
* fs/cifs/cifs_spnego.h -- SPNEGO upcall management for CIFS
*
* Copyright (c) 2007 Red Hat, Inc.
* Author(s): Jeff Layton (jlayton@redhat.com)
* Steve French (sfrench@us.ibm.com)
*
* This library is free software; you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published
* by the Free Software Foundation; either version 2.1 of the License, or
* (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
* the GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with this library; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
#ifndef _CIFS_SPNEGO_H
#define _CIFS_SPNEGO_H
#define CIFS_SPNEGO_UPCALL_VERSION 2
/*
* The version field should always be set to CIFS_SPNEGO_UPCALL_VERSION.
* The flags field is for future use. The request-key callout should set
* sesskey_len and secblob_len, and then concatenate the SessKey+SecBlob
* and stuff it in the data field.
*/
struct cifs_spnego_msg {
uint32_t version;
uint32_t flags;
uint32_t sesskey_len;
uint32_t secblob_len;
uint8_t data[1];
};
#ifdef __KERNEL__
extern struct key_type cifs_spnego_key_type;
#endif /* KERNEL */
#endif /* _CIFS_SPNEGO_H */

1779
client/mount.cifs.c
View File

File diff suppressed because it is too large Load Diff

38
client/mount.h
View File

@ -1,38 +0,0 @@
/*
* Copyright (C) 2008 Jeff Layton (jlayton@samba.org)
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 3 of the License, or
* (at your option) any later version.
* *
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
/* most of this info was taken from the util-linux-ng sources */
#ifndef _MOUNT_H_
#define _MOUNT_H_
/* exit status - bits below are ORed */
#define EX_USAGE 1 /* incorrect invocation or permission */
#define EX_SYSERR 2 /* out of memory, cannot fork, ... */
#define EX_SOFTWARE 4 /* internal mount bug or wrong version */
#define EX_USER 8 /* user interrupt */
#define EX_FILEIO 16 /* problems writing, locking, ... mtab/fstab */
#define EX_FAIL 32 /* mount failure */
#define EX_SOMEOK 64 /* some mount succeeded */
#define _PATH_MOUNTED_LOCK _PATH_MOUNTED "~"
#define _PATH_MOUNTED_TMP _PATH_MOUNTED ".tmp"
extern int lock_mtab(void);
extern void unlock_mtab(void);
#endif /* ! _MOUNT_H_ */

220
client/mtab.c
View File

@ -1,220 +0,0 @@
/*
* mtab locking routines for use with mount.cifs and umount.cifs
* Copyright (C) 2008 Jeff Layton (jlayton@samba.org)
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
/*
* This code was copied from the util-linux-ng sources and modified:
*
* git://git.kernel.org/pub/scm/utils/util-linux-ng/util-linux-ng.git
*
* ...specifically from mount/fstab.c. That file has no explicit license. The
* "default" license for anything in that tree is apparently GPLv2+, so I
* believe we're OK to copy it here.
*
* Jeff Layton <jlayton@samba.org>
*/
#include <unistd.h>
#include <errno.h>
#include <stdio.h>
#include <sys/time.h>
#include <sys/stat.h>
#include <time.h>
#include <fcntl.h>
#include <mntent.h>
#include <stdlib.h>
#include <signal.h>
#include "mount.h"
/* Updating mtab ----------------------------------------------*/
/* Flag for already existing lock file. */
static int we_created_lockfile = 0;
static int lockfile_fd = -1;
/* Flag to indicate that signals have been set up. */
static int signals_have_been_setup = 0;
static void
handler (int sig) {
exit(EX_USER);
}
static void
setlkw_timeout (int sig) {
/* nothing, fcntl will fail anyway */
}
/* Remove lock file. */
void
unlock_mtab (void) {
if (we_created_lockfile) {
close(lockfile_fd);
lockfile_fd = -1;
unlink (_PATH_MOUNTED_LOCK);
we_created_lockfile = 0;
}
}
/* Create the lock file.
The lock file will be removed if we catch a signal or when we exit. */
/* The old code here used flock on a lock file /etc/mtab~ and deleted
this lock file afterwards. However, as rgooch remarks, that has a
race: a second mount may be waiting on the lock and proceed as
soon as the lock file is deleted by the first mount, and immediately
afterwards a third mount comes, creates a new /etc/mtab~, applies
flock to that, and also proceeds, so that the second and third mount
now both are scribbling in /etc/mtab.
The new code uses a link() instead of a creat(), where we proceed
only if it was us that created the lock, and hence we always have
to delete the lock afterwards. Now the use of flock() is in principle
superfluous, but avoids an arbitrary sleep(). */
/* Where does the link point to? Obvious choices are mtab and mtab~~.
HJLu points out that the latter leads to races. Right now we use
mtab~.<pid> instead. Use 20 as upper bound for the length of %d. */
#define MOUNTLOCK_LINKTARGET _PATH_MOUNTED_LOCK "%d"
#define MOUNTLOCK_LINKTARGET_LTH (sizeof(_PATH_MOUNTED_LOCK)+20)
/*
* The original mount locking code has used sleep(1) between attempts and
* maximal number of attemps has been 5.
*
* There was very small number of attempts and extremely long waiting (1s)
* that is useless on machines with large number of concurret mount processes.
*
* Now we wait few thousand microseconds between attempts and we have global
* time limit (30s) rather than limit for number of attempts. The advantage
* is that this method also counts time which we spend in fcntl(F_SETLKW) and
* number of attempts is not so much restricted.
*
* -- kzak@redhat.com [2007-Mar-2007]
*/
/* maximum seconds between first and last attempt */
#define MOUNTLOCK_MAXTIME 30
/* sleep time (in microseconds, max=999999) between attempts */
#define MOUNTLOCK_WAITTIME 5000
int
lock_mtab (void) {
int i;
struct timespec waittime;
struct timeval maxtime;
char linktargetfile[MOUNTLOCK_LINKTARGET_LTH];
if (!signals_have_been_setup) {
int sig = 0;
struct sigaction sa;
sa.sa_handler = handler;
sa.sa_flags = 0;
sigfillset (&sa.sa_mask);
while (sigismember (&sa.sa_mask, ++sig) != -1
&& sig != SIGCHLD) {
if (sig == SIGALRM)
sa.sa_handler = setlkw_timeout;
else
sa.sa_handler = handler;
sigaction (sig, &sa, (struct sigaction *) 0);
}
signals_have_been_setup = 1;
}
sprintf(linktargetfile, MOUNTLOCK_LINKTARGET, getpid ());
i = open (linktargetfile, O_WRONLY|O_CREAT, S_IRUSR|S_IWUSR);
if (i < 0) {
/* linktargetfile does not exist (as a file)
and we cannot create it. Read-only filesystem?
Too many files open in the system?
Filesystem full? */
return EX_FILEIO;
}
close(i);
gettimeofday(&maxtime, NULL);
maxtime.tv_sec += MOUNTLOCK_MAXTIME;
waittime.tv_sec = 0;
waittime.tv_nsec = (1000 * MOUNTLOCK_WAITTIME);
/* Repeat until it was us who made the link */
while (!we_created_lockfile) {
struct timeval now;
struct flock flock;
int errsv, j;
j = link(linktargetfile, _PATH_MOUNTED_LOCK);
errsv = errno;
if (j == 0)
we_created_lockfile = 1;
if (j < 0 && errsv != EEXIST) {
(void) unlink(linktargetfile);
return EX_FILEIO;
}
lockfile_fd = open (_PATH_MOUNTED_LOCK, O_WRONLY);
if (lockfile_fd < 0) {
/* Strange... Maybe the file was just deleted? */
gettimeofday(&now, NULL);
if (errno == ENOENT && now.tv_sec < maxtime.tv_sec) {
we_created_lockfile = 0;
continue;
}
(void) unlink(linktargetfile);
return EX_FILEIO;
}
flock.l_type = F_WRLCK;
flock.l_whence = SEEK_SET;
flock.l_start = 0;
flock.l_len = 0;
if (j == 0) {
/* We made the link. Now claim the lock. If we can't
* get it, continue anyway
*/
fcntl (lockfile_fd, F_SETLK, &flock);
(void) unlink(linktargetfile);
} else {
/* Someone else made the link. Wait. */
gettimeofday(&now, NULL);
if (now.tv_sec < maxtime.tv_sec) {
alarm(maxtime.tv_sec - now.tv_sec);
if (fcntl (lockfile_fd, F_SETLKW, &flock) == -1) {
(void) unlink(linktargetfile);
return EX_FILEIO;
}
alarm(0);
nanosleep(&waittime, NULL);
} else {
(void) unlink(linktargetfile);
return EX_FILEIO;
}
close(lockfile_fd);
}
}
return 0;
}

406
client/umount.cifs.c
View File

@ -1,406 +0,0 @@
/*
Unmount utility program for Linux CIFS VFS (virtual filesystem) client
Copyright (C) 2005 Steve French (sfrench@us.ibm.com)
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>. */
#ifndef _GNU_SOURCE
#define _GNU_SOURCE
#endif
#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <ctype.h>
#include <sys/types.h>
#include <sys/mount.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
#include <sys/vfs.h>
#include <fcntl.h>
#include <getopt.h>
#include <errno.h>
#include <string.h>
#include <mntent.h>
#include <limits.h>
#include "mount.h"
#define UNMOUNT_CIFS_VERSION_MAJOR "0"
#define UNMOUNT_CIFS_VERSION_MINOR "6"
#ifndef UNMOUNT_CIFS_VENDOR_SUFFIX
#ifdef _SAMBA_BUILD_
#include "version.h"
#ifdef SAMBA_VERSION_VENDOR_SUFFIX
#define UNMOUNT_CIFS_VENDOR_SUFFIX "-"SAMBA_VERSION_OFFICIAL_STRING"-"SAMBA_VERSION_VENDOR_SUFFIX
#else
#define UNMOUNT_CIFS_VENDOR_SUFFIX "-"SAMBA_VERSION_OFFICIAL_STRING
#endif /* SAMBA_VERSION_OFFICIAL_STRING and SAMBA_VERSION_VENDOR_SUFFIX */
#else
#define UNMOUNT_CIFS_VENDOR_SUFFIX ""
#endif /* _SAMBA_BUILD_ */
#endif /* UNMOUNT_CIFS_VENDOR_SUFFIX */
#ifndef MNT_DETACH
#define MNT_DETACH 0x02
#endif
#ifndef MNT_EXPIRE
#define MNT_EXPIRE 0x04
#endif
#ifndef MOUNTED_LOCK
#define MOUNTED_LOCK "/etc/mtab~"
#endif
#ifndef MOUNTED_TEMP
#define MOUNTED_TEMP "/etc/mtab.tmp"
#endif
#define CIFS_IOC_CHECKUMOUNT _IO(0xCF, 2)
#define CIFS_MAGIC_NUMBER 0xFF534D42 /* the first four bytes of SMB PDU */
static struct option longopts[] = {
{ "all", 0, NULL, 'a' },
{ "help",0, NULL, 'h' },
{ "read-only", 0, NULL, 'r' },
{ "ro", 0, NULL, 'r' },
{ "verbose", 0, NULL, 'v' },
{ "version", 0, NULL, 'V' },
{ "expire", 0, NULL, 'e' },
{ "force", 0, 0, 'f' },
{ "lazy", 0, 0, 'l' },
{ "no-mtab", 0, 0, 'n' },
{ NULL, 0, NULL, 0 }
};
const char * thisprogram;
int verboseflg = 0;
static void umount_cifs_usage(void)
{
printf("\nUsage: %s <remotetarget> <dir>\n", thisprogram);
printf("\nUnmount the specified directory\n");
printf("\nLess commonly used options:");
printf("\n\t-r\tIf mount fails, retry with readonly remount.");
printf("\n\t-n\tDo not write to mtab.");
printf("\n\t-f\tAttempt a forced unmount, even if the fs is busy.");
printf("\n\t-l\tAttempt lazy unmount, Unmount now, cleanup later.");
printf("\n\t-v\tEnable verbose mode (may be useful for debugging).");
printf("\n\t-h\tDisplay this help.");
printf("\n\nOptions are described in more detail in the manual page");
printf("\n\tman 8 umount.cifs\n");
printf("\nTo display the version number of the cifs umount utility:");
printf("\n\t%s -V\n",thisprogram);
printf("\nInvoking the umount utility on cifs mounts, can execute");
printf(" /sbin/umount.cifs (if present and umount -i is not specified.\n");
}
static int umount_check_perm(char * dir)
{
int fileid;
int rc;
/* allow root to unmount, no matter what */
if(getuid() == 0)
return 0;
/* presumably can not chdir into the target as we do on mount */
fileid = open(dir, O_RDONLY | O_DIRECTORY | O_NOFOLLOW, 0);
if(fileid == -1) {
if(verboseflg)
printf("error opening mountpoint %d %s",errno,strerror(errno));
return errno;
}
rc = ioctl(fileid, CIFS_IOC_CHECKUMOUNT, NULL);
if(verboseflg)
printf("ioctl returned %d with errno %d %s\n",rc,errno,strerror(errno));
if(rc == ENOTTY) {
printf("user unmounting via %s is an optional feature of",thisprogram);
printf(" the cifs filesystem driver (cifs.ko)");
printf("\n\tand requires cifs.ko version 1.32 or later\n");
} else if (rc != 0)
printf("user unmount of %s failed with %d %s\n",dir,errno,strerror(errno));
close(fileid);
return rc;
}
static int remove_from_mtab(char * mountpoint)
{
int rc;
int num_matches;
FILE * org_fd;
FILE * new_fd;
struct mntent * mount_entry;
struct stat statbuf;
/* If it is a symlink, e.g. to /proc/mounts, no need to update it. */
if ((lstat(MOUNTED, &statbuf) == 0) && (S_ISLNK(statbuf.st_mode)))
return 0;
/* Do we first need to check if it is writable? */
atexit(unlock_mtab);
if (lock_mtab()) {
printf("Mount table locked\n");
return -EACCES;
}
if(verboseflg)
printf("attempting to remove from mtab\n");
org_fd = setmntent(MOUNTED, "r");
if(org_fd == NULL) {
printf("Can not open %s\n",MOUNTED);
unlock_mtab();
return -EIO;
}
new_fd = setmntent(MOUNTED_TEMP,"w");
if(new_fd == NULL) {
printf("Can not open temp file %s", MOUNTED_TEMP);
endmntent(org_fd);
unlock_mtab();
return -EIO;
}
/* BB fix so we only remove the last entry that matches BB */
num_matches = 0;
while((mount_entry = getmntent(org_fd)) != NULL) {
if(strcmp(mount_entry->mnt_dir, mountpoint) == 0) {
num_matches++;
}
}
if(verboseflg)
printf("%d matching entries in mount table\n", num_matches);
/* Is there a better way to seek back to the first entry in mtab? */
endmntent(org_fd);
org_fd = setmntent(MOUNTED, "r");
if(org_fd == NULL) {
printf("Can not open %s\n",MOUNTED);
unlock_mtab();
return -EIO;
}
while((mount_entry = getmntent(org_fd)) != NULL) {
if(strcmp(mount_entry->mnt_dir, mountpoint) != 0) {
addmntent(new_fd, mount_entry);
} else {
if(num_matches != 1) {
addmntent(new_fd, mount_entry);
num_matches--;
} else if(verboseflg)
printf("entry not copied (ie entry is removed)\n");
}
}
if(verboseflg)
printf("done updating tmp file\n");
rc = fchmod (fileno (new_fd), S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH);
if(rc < 0) {
printf("error %s changing mode of %s\n", strerror(errno),
MOUNTED_TEMP);
}
endmntent(new_fd);
rc = rename(MOUNTED_TEMP, MOUNTED);
if(rc < 0) {
printf("failure %s renaming %s to %s\n",strerror(errno),
MOUNTED_TEMP, MOUNTED);
unlock_mtab();
return -EIO;
}
unlock_mtab();
return rc;
}
/* Make a canonical pathname from PATH. Returns a freshly malloced string.
It is up the *caller* to ensure that the PATH is sensible. i.e.
canonicalize ("/dev/fd0/.") returns "/dev/fd0" even though ``/dev/fd0/.''
is not a legal pathname for ``/dev/fd0'' Anything we cannot parse
we return unmodified. */
static char *
canonicalize(char *path)
{
char *canonical;
if (path == NULL) {
return NULL;
}
if (strlen(path) > PATH_MAX) {
fprintf(stderr, "Mount point string too long\n");
return NULL;
}
canonical = (char *)malloc (PATH_MAX + 1);
if (!canonical) {
fprintf(stderr, "Error! Not enough memory!\n");
return NULL;
}
if (realpath (path, canonical))
return canonical;
strncpy (canonical, path, PATH_MAX);
canonical[PATH_MAX] = '\0';
return canonical;
}
int main(int argc, char ** argv)
{
int c;
int rc;
int flags = 0;
int nomtab = 0;
int retry_remount = 0;
struct statfs statbuf;
char * mountpoint;
if(argc && argv) {
thisprogram = argv[0];
} else {
umount_cifs_usage();
return -EINVAL;
}
if(argc < 2) {
umount_cifs_usage();
return -EINVAL;
}
if(thisprogram == NULL)
thisprogram = "umount.cifs";
/* add sharename in opts string as unc= parm */
while ((c = getopt_long (argc, argv, "afhilnrvV",
longopts, NULL)) != -1) {
switch (c) {
/* No code to do the following option yet */
/* case 'a':
++umount_all;
break; */
case '?':
case 'h': /* help */
umount_cifs_usage();
exit(1);
case 'n':
++nomtab;
break;
case 'f':
flags |= MNT_FORCE;
break;
case 'l':
flags |= MNT_DETACH; /* lazy unmount */
break;
case 'e':
flags |= MNT_EXPIRE; /* gradually timeout */
break;
case 'r':
++retry_remount;
break;
case 'v':
++verboseflg;
break;
case 'V':
printf ("umount.cifs version: %s.%s%s\n",
UNMOUNT_CIFS_VERSION_MAJOR,
UNMOUNT_CIFS_VERSION_MINOR,
UNMOUNT_CIFS_VENDOR_SUFFIX);
exit (0);
default:
printf("unknown unmount option %c\n",c);
umount_cifs_usage();
exit(1);
}
}
/* move past the umount options */
argv += optind;
argc -= optind;
mountpoint = canonicalize(argv[0]);
if((argc < 1) || (argv[0] == NULL)) {
printf("\nMissing name of unmount directory\n");
umount_cifs_usage();
return -EINVAL;
}
if(verboseflg)
printf("optind %d unmount dir %s\n",optind, mountpoint);
/* check if running effectively root */
if(geteuid() != 0) {
printf("Trying to unmount when %s not installed suid\n",thisprogram);
if(verboseflg)
printf("euid = %d\n",geteuid());
return -EACCES;
}
/* fixup path if needed */
/* Trim any trailing slashes */
while ((strlen(mountpoint) > 1) &&
(mountpoint[strlen(mountpoint)-1] == '/'))
{
mountpoint[strlen(mountpoint)-1] = '\0';
}
/* make sure that this is a cifs filesystem */
rc = statfs(mountpoint, &statbuf);
if(rc || (statbuf.f_type != CIFS_MAGIC_NUMBER)) {
printf("This utility only unmounts cifs filesystems.\n");
return -EINVAL;
}
/* check if our uid was the one who mounted */
rc = umount_check_perm(mountpoint);
if (rc) {
printf("Not permitted to unmount\n");
return rc;
}
if(umount2(mountpoint, flags)) {
/* remember to kill daemon on error */
switch (errno) {
case 0:
printf("unmount failed but no error number set\n");
break;
default:
printf("unmount error %d = %s\n",errno,strerror(errno));
}
printf("Refer to the umount.cifs(8) manual page (man 8 umount.cifs)\n");
return -1;
} else {
if(verboseflg)
printf("umount2 succeeded\n");
if(nomtab == 0)
remove_from_mtab(mountpoint);
}
return 0;
}

2
docs-xml/Samba3-HOWTO/manpages.xml
View File

@ -17,7 +17,6 @@
<xi:include href="../manpages-3/libsmbclient.7.xml"/>
<xi:include href="../manpages-3/lmhosts.5.xml"/>
<xi:include href="../manpages-3/log2pcap.1.xml"/>
<xi:include href="../manpages-3/mount.cifs.8.xml"/>
<xi:include href="../manpages-3/net.8.xml"/>
<xi:include href="../manpages-3/nmbd.8.xml"/>
<xi:include href="../manpages-3/nmblookup.1.xml"/>
@ -48,7 +47,6 @@
<xi:include href="../manpages-3/testparm.1.xml"/>
<xi:include href="../manpages-3/wbinfo.1.xml"/>
<xi:include href="../manpages-3/winbindd.8.xml"/>
<xi:include href="../manpages-3/umount.cifs.8.xml"/>
<xi:include href="../manpages-3/vfs_audit.8.xml"/>
<xi:include href="../manpages-3/vfs_cacheprime.8.xml"/>
<xi:include href="../manpages-3/vfs_cap.8.xml"/>

BIN
docs-xml/linux-client/linux-cifs-client-guide.odt
View File

Binary file not shown.

124
docs-xml/manpages-3/cifs.upcall.8.xml
View File

@ -1,124 +0,0 @@
<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
<refentry id="cifs.upcall.8">
<refmeta>
<refentrytitle>cifs.upcall</refentrytitle>
<manvolnum>8</manvolnum>
<refmiscinfo class="source">Samba</refmiscinfo>
<refmiscinfo class="manual">System Administration tools</refmiscinfo>
<refmiscinfo class="version">3.6</refmiscinfo>
</refmeta>
<refnamediv>
<refname>cifs.upcall</refname>
<refpurpose>Userspace upcall helper for Common Internet File System (CIFS)</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>cifs.upcall</command>
<arg choice="opt">--trust-dns|-t</arg>
<arg choice="opt">--version|-v</arg>
<arg choice="req">keyid</arg>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>DESCRIPTION</title>
<para>This tool is part of the <citerefentry><refentrytitle>samba</refentrytitle>
<manvolnum>7</manvolnum></citerefentry> suite.</para>
<para>cifs.upcall is a userspace helper program for the linux CIFS client
filesystem. There are a number of activities that the kernel cannot easily
do itself. This program is a callout program that does these things for the
kernel and then returns the result.</para>
<para>cifs.upcall is generally intended to be run when the kernel calls
request-key<manvolnum>8</manvolnum> for a particular key type. While it
can be run directly from the command-line, it's not generally intended
to be run that way.</para>
</refsect1>
<refsect1>
<title>OPTIONS</title>
<variablelist>
<varlistentry>
<term>-c</term>
<listitem><para>This option is deprecated and is currently ignored.
</para></listitem>
</varlistentry>
<varlistentry>
<term>--trust-dns|-t</term>
<listitem><para>With krb5 upcalls, the name used as the host portion of the service principal defaults to the hostname portion of the UNC. This option allows the upcall program to reverse resolve the network address of the server in order to get the hostname.</para>
<para>This is less secure than not trusting DNS. When using this option, it's possible that an attacker could get control of DNS and trick the client into mounting a different server altogether. It's preferable to instead add server principals to the KDC for every possible hostname, but this option exists for cases where that isn't possible. The default is to not trust reverse hostname lookups in this fashion.
</para></listitem>
</varlistentry>
<varlistentry>
<term>--version|-v</term>
<listitem><para>Print version number and exit.
</para></listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>CONFIGURATION FOR KEYCTL</title>
<para>cifs.upcall is designed to be called from the kernel via the
request-key callout program. This requires that request-key be told
where and how to call this program. The current cifs.upcall program
handles two different key types:
</para>
<variablelist>
<varlistentry>
<term>cifs.spnego</term>
<listitem><para>This keytype is for retrieving kerberos session keys
</para></listitem>
</varlistentry>
<varlistentry>
<term>dns_resolver</term>
<listitem><para>This key type is for resolving hostnames into IP addresses
</para></listitem>
</varlistentry>
</variablelist>
<para>To make this program useful for CIFS, you'll need to set up entries for them in request-key.conf<manvolnum>5</manvolnum>. Here's an example of an entry for each key type:</para>
<programlisting>
#OPERATION TYPE D C PROGRAM ARG1 ARG2...
#========= ============= = = ================================
create cifs.spnego * * /usr/local/sbin/cifs.upcall %k
create dns_resolver * * /usr/local/sbin/cifs.upcall %k
</programlisting>
<para>
See <citerefentry><refentrytitle>request-key.conf<manvolnum>5</manvolnum></refentrytitle></citerefentry> for more info on each field.
</para>
</refsect1>
<refsect1>
<title>SEE ALSO</title>
<para>
<citerefentry><refentrytitle>request-key.conf</refentrytitle>
<manvolnum>5</manvolnum></citerefentry>,
<citerefentry><refentrytitle>mount.cifs</refentrytitle>
<manvolnum>8</manvolnum></citerefentry>
</para>
</refsect1>
<refsect1>
<title>AUTHOR</title>
<para>Igor Mammedov wrote the cifs.upcall program.</para>
<para>Jeff Layton authored this manpage.</para>
<para>The maintainer of the Linux CIFS VFS is Steve French.</para>
<para>The <ulink url="mailto:linux-cifs-client@lists.samba.org">Linux
CIFS Mailing list</ulink> is the preferred place to ask
questions regarding these programs.
</para>
</refsect1>
</refentry>

732
docs-xml/manpages-3/mount.cifs.8.xml
View File

@ -1,732 +0,0 @@
<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
<refentry id="mount.cifs.8">
<refmeta>
<refentrytitle>mount.cifs</refentrytitle>
<manvolnum>8</manvolnum>
<refmiscinfo class="source">Samba</refmiscinfo>
<refmiscinfo class="manual">System Administration tools</refmiscinfo>
<refmiscinfo class="version">3.6</refmiscinfo>
</refmeta>
<refnamediv>
<refname>mount.cifs</refname>
<refpurpose>mount using the Common Internet File System (CIFS)</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>mount.cifs</command>
<arg choice="req">service</arg>
<arg choice="req">mount-point</arg>
<arg choice="opt">-o options</arg>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>DESCRIPTION</title>
<para>This tool is part of the <citerefentry><refentrytitle>samba</refentrytitle>
<manvolnum>7</manvolnum></citerefentry> suite.</para>
<para>mount.cifs mounts a Linux CIFS filesystem. It
is usually invoked indirectly by
the <citerefentry><refentrytitle>mount</refentrytitle><manvolnum>8</manvolnum></citerefentry> command when using the
"-t cifs" option. This command only works in Linux, and the kernel must
support the cifs filesystem. The CIFS protocol is the successor to the
SMB protocol and is supported by most Windows servers and many other
commercial servers and Network Attached Storage appliances as well as
by the popular Open Source server Samba.
</para>
<para>
The mount.cifs utility attaches the UNC name (exported network resource)
specified as <emphasis>service</emphasis> (using //server/share syntax,
where "server" is the server name or IP address and "share" is the name
of the share) to the local directory <emphasis>mount-point</emphasis>.
</para>
<para>
Options to <emphasis>mount.cifs</emphasis> are specified as a comma-separated
list of key=value pairs. It is possible to send options other
than those listed here, assuming that the cifs filesystem kernel module (cifs.ko) supports them.
Unrecognized cifs mount options passed to the cifs vfs kernel code will be logged to the
kernel log.
</para>
<para><emphasis>mount.cifs</emphasis> causes the cifs vfs to launch a thread named cifsd. After mounting it keeps running until
the mounted resource is unmounted (usually via the umount utility).
</para>
<para>
<emphasis>mount.cifs -V</emphasis> command displays the version of cifs mount helper.
</para>
<para>
<emphasis>modinfo cifs</emphasis> command displays the version of cifs module.
</para>
</refsect1>
<refsect1>
<title>OPTIONS</title>
<variablelist>
<varlistentry><term>user=<replaceable>arg</replaceable></term>
<listitem><para>specifies the username to connect as. If
this is not given, then the environment variable <emphasis>USER</emphasis> is used. This option can also take the
form "user%password" or "workgroup/user" or
"workgroup/user%password" to allow the password and workgroup
to be specified as part of the username.
</para>
<note>
<para>
The cifs vfs accepts the parameter <parameter>user=</parameter>, or for users familiar with smbfs it accepts the longer form of the parameter <parameter>username=</parameter>. Similarly the longer smbfs style parameter names may be accepted as synonyms for the shorter cifs parameters <parameter>pass=</parameter>,<parameter>dom=</parameter> and <parameter>cred=</parameter>.
</para>
</note>
</listitem>
</varlistentry>
<varlistentry><term>password=<replaceable>arg</replaceable></term>
<listitem><para>specifies the CIFS password. If this
option is not given then the environment variable
<emphasis>PASSWD</emphasis> is used. If the password is not specified
directly or indirectly via an argument to mount, <emphasis>mount.cifs</emphasis> will prompt
for a password, unless the guest option is specified.
</para>
<para>Note that a password which contains the delimiter
character (i.e. a comma ',') will fail to be parsed correctly
on the command line. However, the same password defined
in the PASSWD environment variable or via a credentials file (see
below) or entered at the password prompt will be read correctly.
</para>
</listitem></varlistentry>
<varlistentry><term>credentials=<replaceable>filename</replaceable></term>
<listitem><para>
specifies a file that contains a username
and/or password and optionally the name of the
workgroup. The format of the file is:
</para>
<programlisting>
username=<replaceable>value</replaceable>
password=<replaceable>value</replaceable>
domain=<replaceable>value</replaceable>
</programlisting>
<para>
This is preferred over having passwords in plaintext in a
shared file, such as <filename>/etc/fstab</filename>. Be sure to protect any
credentials file properly.
</para>
</listitem></varlistentry>
<varlistentry>
<term>uid=<replaceable>arg</replaceable></term>
<listitem>
<para>sets the uid that will own all files or directories on the
mounted filesystem when the server does not provide ownership
information. It may be specified as either a username or a numeric uid.
When not specified, the default is uid 0. The mount.cifs helper must be
at version 1.10 or higher to support specifying the uid in non-numeric
form. See the section on FILE AND DIRECTORY OWNERSHIP AND PERMISSIONS below for more
information. </para>
</listitem>
</varlistentry>
<varlistentry>
<term>forceuid</term>
<listitem>
<para>instructs the client to ignore any uid provided by
the server for files and directories and to always assign the owner to
be the value of the uid= option. See the section on FILE AND DIRECTORY OWNERSHIP AND PERMISSIONS below for more information.</para>
</listitem>
</varlistentry>
<varlistentry>
<term>gid=<replaceable>arg</replaceable></term>
<listitem>
<para>sets the gid that will own all files or
directories on the mounted filesystem when the server does not provide
ownership information. It may be specified as either a groupname or a
numeric gid. When not specified, the default is gid 0. The mount.cifs
helper must be at version 1.10 or higher to support specifying the gid
in non-numeric form. See the section on FILE AND DIRECTORY OWNERSHIP AND
PERMISSIONS below for more information.</para>
</listitem>
</varlistentry>
<varlistentry>
<term>forcegid</term>
<listitem>
<para>instructs the client to ignore any gid provided by
the server for files and directories and to always assign the owner to
be the value of the gid= option. See the section on FILE AND DIRECTORY OWNERSHIP AND PERMISSIONS below for more information.</para>
</listitem>
</varlistentry>
<varlistentry>
<term>port=<replaceable>arg</replaceable></term>
<listitem><para>sets the port number on the server to attempt to contact to negotiate
CIFS support. If the CIFS server is not listening on this port or
if it is not specified, the default ports will be tried i.e.
port 445 is tried and if no response then port 139 is tried.
</para></listitem>
</varlistentry>
<varlistentry>
<term>servern=<replaceable>arg</replaceable></term>
<listitem><para>
Specify the server netbios name (RFC1001 name) to use
when attempting to setup a session to the server. Although
rarely needed for mounting to newer servers, this option
is needed for mounting to some older servers (such
as OS/2 or Windows 98 and Windows ME) since when connecting
over port 139 they, unlike most newer servers, do not
support a default server name. A server name can be up
to 15 characters long and is usually uppercased.
</para></listitem>
</varlistentry>
<varlistentry>
<term>netbiosname=<replaceable>arg</replaceable></term>
<listitem><para>When mounting to servers via port 139, specifies the RFC1001
source name to use to represent the client netbios machine
name when doing the RFC1001 netbios session initialize.
</para></listitem>
</varlistentry>
<varlistentry>
<term>file_mode=<replaceable>arg</replaceable></term>
<listitem><para>If the server does not support the CIFS Unix extensions this
overrides the default file mode.</para></listitem>
</varlistentry>
<varlistentry>
<term>dir_mode=<replaceable>arg</replaceable></term>
<listitem><para>If the server does not support the CIFS Unix extensions this
overrides the default mode for directories. </para></listitem>
</varlistentry>
<varlistentry>
<term>ip=<replaceable>arg</replaceable></term>
<listitem><para>sets the destination IP address. This option is set automatically if the server name portion of the requested UNC name can be resolved so rarely needs to be specified by the user.</para></listitem>
</varlistentry>
<varlistentry>
<term>domain=<replaceable>arg</replaceable></term>
<listitem><para>sets the domain (workgroup) of the user </para></listitem>
</varlistentry>
<varlistentry>
<term>guest</term>
<listitem><para>don't prompt for a password </para></listitem>
</varlistentry>
<varlistentry>
<term>iocharset</term>
<listitem><para>Charset used to convert local path names to and from
Unicode. Unicode is used by default for network path
names if the server supports it. If iocharset is
not specified then the nls_default specified
during the local client kernel build will be used.
If server does not support Unicode, this parameter is
unused. </para></listitem>
</varlistentry>
<varlistentry>
<term>ro</term>
<listitem><para>mount read-only</para></listitem>
</varlistentry>
<varlistentry>
<term>rw</term>
<listitem><para>mount read-write</para></listitem>
</varlistentry>
<varlistentry>
<term>setuids</term>
<listitem><para>If the CIFS Unix extensions are negotiated with the server
the client will attempt to set the effective uid and gid of
the local process on newly created files, directories, and
devices (create, mkdir, mknod). If the CIFS Unix Extensions
are not negotiated, for newly created files and directories
instead of using the default uid and gid specified on the
the mount, cache the new file's uid and gid locally which means
that the uid for the file can change when the inode is
reloaded (or the user remounts the share).</para></listitem>
</varlistentry>
<varlistentry>
<term>nosetuids</term>
<listitem><para>The client will not attempt to set the uid and gid on
on newly created files, directories, and devices (create,
mkdir, mknod) which will result in the server setting the
uid and gid to the default (usually the server uid of the
user who mounted the share). Letting the server (rather than
the client) set the uid and gid is the default.If the CIFS
Unix Extensions are not negotiated then the uid and gid for
new files will appear to be the uid (gid) of the mounter or the
uid (gid) parameter specified on the mount.</para></listitem>
</varlistentry>
<varlistentry>
<term>perm</term>
<listitem><para>Client does permission checks (vfs_permission check of uid
and gid of the file against the mode and desired operation),
Note that this is in addition to the normal ACL check on the
target machine done by the server software.
Client permission checking is enabled by default.</para></listitem>
</varlistentry>
<varlistentry>
<term>noperm</term>
<listitem><para>Client does not do permission checks. This can expose
files on this mount to access by other users on the local
client system. It is typically only needed when the server
supports the CIFS Unix Extensions but the UIDs/GIDs on the
client and server system do not match closely enough to allow
access by the user doing the mount.
Note that this does not affect the normal ACL check on the
target machine done by the server software (of the server
ACL against the user name provided at mount time).</para></listitem>
</varlistentry>
<varlistentry>
<term>dynperm</term>
<listitem><para>Instructs the server to maintain ownership and
permissions in memory that can't be stored on the server. This information can disappear at any time (whenever the inode is flushed from the cache), so while this may help make some applications work, it's behavior is somewhat unreliable. See the section below on FILE AND DIRECTORY OWNERSHIP AND PERMISSIONS for more information.
</para></listitem>
</varlistentry>
<varlistentry>
<term>directio</term>
<listitem><para>Do not do inode data caching on files opened on this mount.
This precludes mmaping files on this mount. In some cases
with fast networks and little or no caching benefits on the
client (e.g. when the application is doing large sequential
reads bigger than page size without rereading the same data)
this can provide better performance than the default
behavior which caches reads (readahead) and writes
(writebehind) through the local Linux client pagecache
if oplock (caching token) is granted and held. Note that
direct allows write operations larger than page size
to be sent to the server. On some kernels this requires the cifs.ko module
to be built with the CIFS_EXPERIMENTAL configure option.</para></listitem>
</varlistentry>
<varlistentry>
<term>mapchars</term>
<listitem><para>Translate six of the seven reserved characters (not backslash, but including the colon, question mark, pipe, asterik, greater than and less than characters)
to the remap range (above 0xF000), which also
allows the CIFS client to recognize files created with
such characters by Windows's POSIX emulation. This can
also be useful when mounting to most versions of Samba
(which also forbids creating and opening files
whose names contain any of these seven characters).
This has no effect if the server does not support
Unicode on the wire. Please note that the files created
with mapchars mount option may not be accessible
if the share is mounted without that option.</para></listitem>
</varlistentry>
<varlistentry>
<term>nomapchars</term>
<listitem><para>Do not translate any of these seven characters (default)</para></listitem>
</varlistentry>
<varlistentry>
<term>intr</term>
<listitem><para>currently unimplemented</para></listitem>
</varlistentry>
<varlistentry>
<term>nointr</term>
<listitem><para>(default) currently unimplemented </para></listitem>
</varlistentry>
<varlistentry>
<term>hard</term>
<listitem><para>The program accessing a file on the cifs mounted file system will hang when the
server crashes.</para></listitem>
</varlistentry>
<varlistentry>
<term>soft</term>
<listitem><para>(default) The program accessing a file on the cifs mounted file system will not hang when the server crashes and will return errors to the user application.</para></listitem>
</varlistentry>
<varlistentry>
<term>noacl</term>
<listitem><para>Do not allow POSIX ACL operations even if server would support them.</para><para>
The CIFS client can get and set POSIX ACLs (getfacl, setfacl) to Samba servers
version 3.0.10 and later. Setting POSIX ACLs requires enabling both XATTR and
then POSIX support in the CIFS configuration options when building the cifs
module. POSIX ACL support can be disabled on a per mount basis by specifying
"noacl" on mount.</para>
</listitem>
</varlistentry>
<varlistentry>
<term>nocase</term>
<listitem>
<para>Request case insensitive path name matching (case
sensitive is the default if the server suports it).
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>sec=</term>
<listitem>
<para>Security mode. Allowed values are:</para>
<itemizedlist>
<listitem><para>none attempt to connection as a null user (no name) </para></listitem>
<listitem><para>krb5 Use Kerberos version 5 authentication</para></listitem>
<listitem><para>krb5i Use Kerberos authentication and packet signing</para></listitem>
<listitem><para>ntlm Use NTLM password hashing (default)</para></listitem>
<listitem><para>ntlmi Use NTLM password hashing with signing (if
/proc/fs/cifs/PacketSigningEnabled on or if
server requires signing also can be the default)</para></listitem>
<listitem><para>ntlmv2 Use NTLMv2 password hashing</para></listitem>
<listitem><para>ntlmv2i Use NTLMv2 password hashing with packet signing</para></listitem>
</itemizedlist>
<para>[NB This [sec parameter] is under development and expected to be available in cifs kernel module 1.40 and later]
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>nobrl</term>
<listitem>
<para>Do not send byte range lock requests to the server.
This is necessary for certain applications that break
with cifs style mandatory byte range locks (and most
cifs servers do not yet support requesting advisory
byte range locks).
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>sfu</term>
<listitem>
<para>
When the CIFS Unix Extensions are not negotiated, attempt to
create device files and fifos in a format compatible with
Services for Unix (SFU). In addition retrieve bits 10-12
of the mode via the SETFILEBITS extended attribute (as
SFU does). In the future the bottom 9 bits of the mode
mode also will be emulated using queries of the security
descriptor (ACL). [NB: requires version 1.39 or later
of the CIFS VFS. To recognize symlinks and be able
to create symlinks in an SFU interoperable form
requires version 1.40 or later of the CIFS VFS kernel module.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>serverino</term>
<listitem><para>Use inode numbers (unique persistent file identifiers)
returned by the server instead of automatically generating
temporary inode numbers on the client. Although server inode numbers
make it easier to spot hardlinked files (as they will have
the same inode numbers) and inode numbers may be persistent (which is
userful for some sofware),
the server does not guarantee that the inode numbers
are unique if multiple server side mounts are exported under a
single share (since inode numbers on the servers might not
be unique if multiple filesystems are mounted under the same
shared higher level directory). Note that not all
servers support returning server inode numbers, although
those that support the CIFS Unix Extensions, and Windows 2000 and
later servers typically do support this (although not necessarily
on every local server filesystem). Parameter has no effect if
the server lacks support for returning inode numbers or equivalent.
</para></listitem>
</varlistentry>
<varlistentry>
<term>noserverino</term>
<listitem>
<para>
Client generates inode numbers (rather than
using the actual one from the server) by default.
</para>
<para>
See section <emphasis>INODE NUMBERS</emphasis> for
more information.
</para></listitem>
</varlistentry>
<varlistentry>
<term>nounix</term>
<listitem>
<para>
Disable the CIFS Unix Extensions for this mount. This
can be useful in order to turn off multiple settings at once.
This includes POSIX acls, POSIX locks, POSIX paths, symlink
support and retrieving uids/gids/mode from the server. This
can also be useful to work around a bug in a server that
supports Unix Extensions.
</para>
<para>
See section <emphasis>INODE NUMBERS</emphasis> for
more information.
</para> </listitem>
</varlistentry>
<varlistentry>
<term>nouser_xattr</term>
<listitem><para>(default) Do not allow getfattr/setfattr to get/set xattrs, even if server would support it otherwise. </para></listitem>
</varlistentry>
<varlistentry>
<term>rsize=<replaceable>arg</replaceable></term>
<listitem><para>default network read size (usually 16K). The client currently
can not use rsize larger than CIFSMaxBufSize. CIFSMaxBufSize
defaults to 16K and may be changed (from 8K to the maximum
kmalloc size allowed by your kernel) at module install time
for cifs.ko. Setting CIFSMaxBufSize to a very large value
will cause cifs to use more memory and may reduce performance
in some cases. To use rsize greater than 127K (the original
cifs protocol maximum) also requires that the server support
a new Unix Capability flag (for very large read) which some
newer servers (e.g. Samba 3.0.26 or later) do. rsize can be
set from a minimum of 2048 to a maximum of 130048 (127K or
CIFSMaxBufSize, whichever is smaller)
</para></listitem>
</varlistentry>
<varlistentry>
<term>wsize=<replaceable>arg</replaceable></term>
<listitem><para>default network write size (default 57344)
maximum wsize currently allowed by CIFS is 57344 (fourteen
4096 byte pages)</para></listitem>
</varlistentry>
<varlistentry>
<term>--verbose</term>
<listitem><para>Print additional debugging information for the mount. Note that this parameter must be specified before the -o. For example:</para><para>mount -t cifs //server/share /mnt --verbose -o user=username</para></listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>SERVICE FORMATTING AND DELIMITERS</title>
<para>
It's generally preferred to use forward slashes (/) as a delimiter in service names. They are considered to be the "universal delimiter" since they are generally not allowed to be embedded within path components on Windows machines and the client can convert them to blackslashes (\) unconditionally. Conversely, backslash characters are allowed by POSIX to be part of a path component, and can't be automatically converted in the same way.
</para>
<para>
mount.cifs will attempt to convert backslashes to forward slashes where it's able to do so, but it cannot do so in any path component following the sharename.
</para>
</refsect1>
<refsect1>
<title>INODE NUMBERS</title>
<para>
When Unix Extensions are enabled, we use the actual inode
number provided by the server in response to the POSIX calls as an
inode number.
</para>
<para>
When Unix Extensions are disabled and "serverino" mount option
is enabled there is no way to get the server inode number. The
client typically maps the server-assigned "UniqueID" onto an inode
number.
</para>
<para>
Note that the UniqueID is a different value from the server
inode number. The UniqueID value is unique over the scope of the entire
server and is often greater than 2 power 32. This value often makes
programs that are not compiled with LFS (Large File Support), to
trigger a glibc EOVERFLOW error as this won't fit in the target
structure field. It is strongly recommended to compile your programs
with LFS support (i.e. with -D_FILE_OFFSET_BITS=64) to prevent this
problem. You can also use "noserverino" mount option to generate inode
numbers smaller than 2 power 32 on the client. But you may not be able
to detect hardlinks properly.
</para>
</refsect1>
<refsect1>
<title>FILE AND DIRECTORY OWNERSHIP AND PERMISSIONS</title>
<para> The core CIFS protocol does not provide unix ownership
information or mode for files and directories. Because of this, files
and directories will generally appear to be owned by whatever values the
uid= or gid= options are set, and will have permissions set to the
default file_mode and dir_mode for the mount. Attempting to change these
values via chmod/chown will return success but have no effect.</para>
<para>When the client and server negotiate unix extensions,
files and directories will be assigned the uid, gid, and mode provided
by the server. Because CIFS mounts are generally single-user, and the
same credentials are used no matter what user accesses the mount, newly
created files and directories will generally be given ownership
corresponding to whatever credentials were used to mount the
share.</para>
<para>If the uid's and gid's being used do not match on the
client and server, the forceuid and forcegid options may be helpful.
Note however, that there is no corresponding option to override the
mode. Permissions assigned to a file when forceuid or forcegid are in
effect may not reflect the the real permissions.</para>
<para>When unix extensions are not negotiated, it's also
possible to emulate them locally on the server using the "dynperm" mount
option. When this mount option is in effect, newly created files and
directories will receive what appear to be proper permissions. These
permissions are not stored on the server however and can disappear at
any time in the future (subject to the whims of the kernel flushing out
the inode cache). In general, this mount option is discouraged.
</para>
<para>It's also possible to override permission checking on the client
altogether via the noperm option. Server-side permission checks cannot be
overriden. The permission checks done by the server will always correspond to
the credentials used to mount the share, and not necessarily to the user who is accessing the share.</para>
</refsect1>
<refsect1>
<title>ENVIRONMENT VARIABLES</title>
<para>
The variable <emphasis>USER</emphasis> may contain the username of the
person to be used to authenticate to the server.
The variable can be used to set both username and
password by using the format username%password.
</para>
<para>
The variable <emphasis>PASSWD</emphasis> may contain the password of the
person using the client.
</para>
<para>
The variable <emphasis>PASSWD_FILE</emphasis> may contain the pathname
of a file to read the password from. A single line of input is
read and used as the password.
</para>
</refsect1>
<refsect1>
<title>NOTES</title>
<para>This command may be used only by root, unless installed setuid, in which case the noeexec and nosuid mount flags are enabled. When installed as a setuid program, the program follows the conventions set forth by the mount program for user mounts.</para>
<para>
Some samba client tools like smbclient(8) honour client-side
configuration parameters present in smb.conf. Unlike those
client tools, <emphasis>mount.cifs</emphasis> ignores smb.conf
completely.
</para>
</refsect1>
<refsect1>
<title>CONFIGURATION</title>
<para>
The primary mechanism for making configuration changes and for reading
debug information for the cifs vfs is via the Linux /proc filesystem.
In the directory <filename>/proc/fs/cifs</filename> are various
configuration files and pseudo files which can display debug information.
There are additional startup options such as maximum buffer size and number
of buffers which only may be set when the kernel cifs vfs (cifs.ko module) is
loaded. These can be seen by running the modinfo utility against the file
cifs.ko which will list the options that may be passed to cifs during module
installation (device driver load).
For more information see the kernel file <filename>fs/cifs/README</filename>.
</para>
</refsect1>
<refsect1>
<title>BUGS</title>
<para>Mounting using the CIFS URL specification is currently not supported.
</para>
<para>The credentials file does not handle usernames or passwords with
leading space.</para>
<para>
Note that the typical response to a bug report is a suggestion
to try the latest version first. So please try doing that first,
and always include which versions you use of relevant software
when reporting bugs (minimum: mount.cifs (try mount.cifs -V), kernel (see /proc/version) and
server type you are trying to contact.
</para>
</refsect1>
<refsect1>
<title>VERSION</title>
<para>This man page is correct for version 1.52 of
the cifs vfs filesystem (roughly Linux kernel 2.6.24).</para>
</refsect1>
<refsect1>
<title>SEE ALSO</title>
<para>
Documentation/filesystems/cifs.txt and fs/cifs/README in the linux kernel
source tree may contain additional options and information.
</para>
<para><citerefentry><refentrytitle>umount.cifs</refentrytitle>
<manvolnum>8</manvolnum></citerefentry></para>
</refsect1>
<refsect1>
<title>AUTHOR</title>
<para>Steve French</para>
<para>The syntax and manpage were loosely based on that of smbmount. It
was converted to Docbook/XML by Jelmer Vernooij.</para>
<para>The maintainer of the Linux cifs vfs and the userspace
tool <emphasis>mount.cifs</emphasis> is <ulink url="mailto:sfrench@samba.org">Steve French</ulink>.
The <ulink url="mailto:linux-cifs-client@lists.samba.org">Linux CIFS Mailing list</ulink>
is the preferred place to ask questions regarding these programs.
</para>
</refsect1>
</refentry>

179
docs-xml/manpages-3/umount.cifs.8.xml
View File

@ -1,179 +0,0 @@
<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
<refentry id="umount.cifs.8">
<refmeta>
<refentrytitle>umount.cifs</refentrytitle>
<manvolnum>8</manvolnum>
<refmiscinfo class="source">Samba</refmiscinfo>
<refmiscinfo class="manual">System Administration tools</refmiscinfo>
<refmiscinfo class="version">3.6</refmiscinfo>
</refmeta>
<refnamediv>
<refname>umount.cifs</refname>
<refpurpose>for normal, non-root users, to unmount their own Common Internet File System (CIFS) mounts</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>umount.cifs</command>
<arg choice="req">mount-point</arg>
<arg choice="opt">-nVvhfle</arg>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>DESCRIPTION</title>
<para>This tool is part of the <citerefentry><refentrytitle>samba</refentrytitle>
<manvolnum>7</manvolnum></citerefentry> suite.</para>
<para>umount.cifs unmounts a Linux CIFS filesystem. It can be invoked
indirectly by the
<citerefentry><refentrytitle>umount</refentrytitle><manvolnum>8</manvolnum></citerefentry> command
when umount.cifs is in /sbin directory, unless you specify the "-i" option to umount. Specifying -i to umount avoids execution of umount helpers such as umount.cifs. The umount.cifs command only works in Linux, and the kernel must
support the cifs filesystem. The CIFS protocol is the successor to the
SMB protocol and is supported by most Windows servers and many other
commercial servers and Network Attached Storage appliances as well as
by the popular Open Source server Samba.
</para>
<para>
The umount.cifs utility detaches the local directory <emphasis>mount-point</emphasis> from the corresponding UNC name (exported network resource) and frees the associated kernel resources.
It is possible to set the mode for umount.cifs to
setuid root (or equivalently update the /etc/permissions file) to allow non-root users to umount shares to directories for which they have write permission. The umount.cifs utility is typically
not needed if unmounts need only be performed by root users, or if user mounts and unmounts
can rely on specifying explicit entries in /etc/fstab See</para>
<para><citerefentry><refentrytitle>fstab</refentrytitle>
<manvolnum>5</manvolnum></citerefentry></para>
</refsect1>
<refsect1>
<title>OPTIONS</title>
<variablelist>
<varlistentry>
<term>-V</term>
<listitem><para>Print version and exit.</para></listitem>
</varlistentry>
<varlistentry>
<term>-h</term>
<listitem><para>Print help message and exit.</para></listitem>
</varlistentry>
<varlistentry>
<term>-r</term>
<listitem><para>In case unmounting fails, try to remount
read-only.</para></listitem>
</varlistentry>
<varlistentry>
<term>-d</term>
<listitem><para>In case the unmounted device was a loop device,
also free this loop device.</para></listitem>
</varlistentry>
<varlistentry>
<term>-f</term>
<listitem><para>Force unmount (in case of an unreachable
server).</para></listitem>
</varlistentry>
<varlistentry>
<term>-l</term>
<listitem><para>Lazy unmount. Detach the filesystem from
the filesysetm hierarchy now, and
cleanup all references to the filesystem
as soon as it is not busy anymore.</para></listitem>
</varlistentry>
<varlistentry>
<term>-e</term>
<listitem><para>Mark the mount point as expired. If a mount
point is not currently in use, then an initial
call to unmount with this flag fails with the
error EAGAIN, but marks the mount point as
expired. The mount point remains expired as
long as it isn't accessed by any process.
A second unmount call specifying -e unmounts
an expired mount point. This flag cannot be
specified with either -f or -l</para></listitem>
</varlistentry>
<varlistentry>
<term>-v|--verbose</term>
<listitem><para>Verbose Mode. Print additional debugging information</para></listitem>
</varlistentry>
<varlistentry>
<term>-n|--no-mtab</term>
<listitem><para>Do not update the mtab even if unmount completes successfully (/proc/mounts will still display the correct information)</para></listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>NOTES</title>
<para>This command is normally intended to be installed setuid (since root users can already run unmount). An alternative to using umount.cifs is to add specfic entries for the user mounts that you wish a particular user or users to mount and unmount to /etc/fstab</para>
</refsect1>
<refsect1>
<title>CONFIGURATION</title>
<para>
The primary mechanism for making configuration changes and for reading
debug information for the cifs vfs is via the Linux /proc filesystem.
In the directory <filename>/proc/fs/cifs</filename> are various
configuration files and pseudo files which can display debug information.
For more information see the kernel file <filename>fs/cifs/README</filename>.
</para>
</refsect1>
<refsect1>
<title>BUGS</title>
<para>At this time umount.cifs does not lock the mount table using the same lock as the umount utility does, so do not attempt to do multiple unmounts from different processes (and in particular unmounts of a cifs mount and another type of filesystem mount at the same time).
</para>
<para>If the same mount point is mounted multiple times by cifs, umount.cifs will remove all of the matching entries from the mount table (although umount.cifs will actually only unmount the last one), rather than only removing the last matching entry in /etc/mtab. The pseudofile /proc/mounts will display correct information though, and the lack of an entry in /etc/mtab does not prevent subsequent unmounts.</para>
<para>
Note that the typical response to a bug report is a suggestion
to try the latest version first. So please try doing that first,
and always include which versions you use of relevant software
when reporting bugs (minimum: umount.cifs (try umount.cifs -V), kernel (see /proc/version) and
server type you are trying to contact.
</para>
</refsect1>
<refsect1>
<title>VERSION</title>
<para>This man page is correct for version 1.34 of
the cifs vfs filesystem (roughly Linux kernel 2.6.12).</para>
</refsect1>
<refsect1>
<title>SEE ALSO</title>
<para>
Documentation/filesystems/cifs.txt and fs/cifs/README in the linux kernel
source tree may contain additional options and information.
</para>
<para><citerefentry><refentrytitle>mount.cifs</refentrytitle>
<manvolnum>8</manvolnum></citerefentry></para>
</refsect1>
<refsect1>
<title>AUTHOR</title>
<para>Steve French</para>
<para>The syntax was loosely based on the umount utility and the manpage was loosely based on that of mount.cifs.8. The man page was created by Steve French</para>
<para>The maintainer of the Linux cifs vfs and the userspace
tool <emphasis>umount.cifs</emphasis> is <ulink url="mailto:sfrench@samba.org">Steve French</ulink>.
The <ulink url="mailto:linux-cifs-client@lists.samba.org">Linux CIFS Mailing list</ulink>
is the preferred place to ask questions regarding these programs.
</para>
</refsect1>
</refentry>