1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
samba-mirror/source3/modules
Ralph Boehme 0730cb7e1c vfs_acl_common: Windows style default ACL
Reintroduce Windows style default ACL, but this time as an optional
feature, not changing default behaviour.

Original bugreport that got reverted because it changed the default
behaviour: https://bugzilla.samba.org/show_bug.cgi?id=12028

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12177

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-08-30 21:12:26 +02:00
..
developer.c
getdate.c s3/modules/getdate: use HAVE___ATTRIBUTE__ instead of __GNUC__ 2016-03-24 15:13:15 +01:00
getdate.h
getdate.y s3/modules/getdate: use HAVE___ATTRIBUTE__ instead of __GNUC__ 2016-03-24 15:13:15 +01:00
lib_vxfs.c Efficient xattr handling for VxFS Signed-off-by: Abhidnya Joshi <Abhidnya.Joshi@veritas.com> 2016-06-03 07:26:33 +02:00
nfs4_acls.c nfs4acls: Allow nfs4 acl params to be set by callers 2016-08-12 17:15:20 +02:00
nfs4_acls.h nfs4acls: Make smbacl4_vfs_params public 2016-08-12 17:15:20 +02:00
non_posix_acls.c s3: Filenames: Add uint32_t flags parameter to synthetic_smb_fname(). 2016-03-24 22:57:16 +01:00
non_posix_acls.h vfs: Add helper function for non posix ACL modules 2013-02-04 12:19:30 +01:00
perfcount_test.c s3:modules/perfcount_*: make function prototypes available via static_decl_perfcount; 2015-08-20 16:06:21 +02:00
posixacl_xattr.c s3: vfs: generalize functions that set/get posix acl through xattr 2016-07-24 00:23:18 +02:00
posixacl_xattr.h s3: vfs: generalize functions that set/get posix acl through xattr 2016-07-24 00:23:18 +02:00
README-gpfs-acl.txt
README.nfs4acls.txt s3: Update README.nfs4acls.txt 2013-05-09 06:18:21 +02:00
vfs_acl_common.c vfs_acl_common: Windows style default ACL 2016-08-30 21:12:26 +02:00
vfs_acl_tdb.c vfs_acl_tdb|xattr: use a config handle 2016-08-30 21:12:25 +02:00
vfs_acl_xattr.c vfs_acl_tdb|xattr: use a config handle 2016-08-30 21:12:25 +02:00
vfs_afsacl.c s3: vfs: vfs_afsacl. refuse_symlink() means we can always use STAT here. 2016-03-24 22:57:16 +01:00
vfs_aio_fork.c lib: Move msghdr to lib/util/ 2016-06-07 14:34:10 +02:00
vfs_aio_linux.c vfs_aio_linux: call clock_gettime_mono() only on profile-enabled build 2016-03-28 20:45:16 +02:00
vfs_aio_pthread.c lib: Use pthreadpool_pipe instead of pthreadpool 2016-08-24 01:33:48 +02:00
vfs_aixacl2.c nfs4acls: Add "smbacl4_vfs_params" parameter to smb_set_nt_acl_nfs4 2016-08-12 17:15:20 +02:00
vfs_aixacl_util.c
vfs_aixacl_util.h
vfs_aixacl.c
vfs_audit.c VFS: Modify chmod_acl to take a const struct smb_filename * instead of const char * 2016-03-03 09:04:14 +01:00
vfs_btrfs.c s3/vfs_btrfs.c: use sizeof() instead of ARRAY_SIZE() 2016-02-25 22:06:27 +01:00
vfs_cacheprime.c lib: Move sys_rw* to lib/util 2015-10-13 01:23:07 +02:00
vfs_cap.c s3: Filenames: Add uint32_t flags parameter to synthetic_smb_fname(). 2016-03-24 22:57:16 +01:00
vfs_catia.c vfs_catia: Fix bug 11827, memleak 2016-04-11 14:25:59 +02:00
vfs_ceph.c smbd: get a valid file stat to disk_quotas 2016-08-13 01:53:15 +02:00
vfs_commit.c s3/vfs: wrap async io function args inside struct vfs_aio_state 2016-03-02 01:22:13 +01:00
vfs_crossrename.c s3: VFS modules: Ignore EPERM errors on [f]chmod in crossrename module. 2014-07-08 07:49:37 +02:00
vfs_default_quota.c vfs: add path parameter to get_quota 2016-01-26 15:58:12 +01:00
vfs_default.c vfs: Remove link to asys_ 2016-08-24 01:33:49 +02:00
vfs_dfs_samba4.c
vfs_dirsort.c VFS: Modify opendir to take a const struct smb_filename * instead of const char * 2016-03-01 15:25:22 +01:00
vfs_expand_msdfs.c
vfs_extd_audit.c VFS: Modify chmod_acl to take a const struct smb_filename * instead of const char * 2016-03-03 09:04:14 +01:00
vfs_fake_acls.c s3: Filenames: Add uint32_t flags parameter to synthetic_smb_fname(). 2016-03-24 22:57:16 +01:00
vfs_fake_dfq.c vfs_fake_dfq - remove support for generating EDQUOT 2016-06-01 00:57:32 +02:00
vfs_fake_perms.c vfs_fake_perms: Fix bug 9775, segfault for "artificial" conn_structs 2013-04-10 00:12:06 +02:00
vfs_fileid.c vfs_fileid: Fix a signed/unsigned mixup 2016-05-19 20:20:20 +02:00
vfs_fruit.c AddressSanitizer: Initialize for vfs_fruit.c 2016-07-25 13:56:11 +02:00
vfs_full_audit.c vfs_full_audit: Assert that all VFS functions are implemented 2016-04-06 00:15:17 +02:00
vfs_glusterfs.c s3: vfs: generalize functions that set/get posix acl through xattr 2016-07-24 00:23:18 +02:00
vfs_gpfs.c vfs_gpfs: Load nfs4 acl params at tcon time 2016-08-12 21:03:36 +02:00
vfs_hpuxacl.c s3: Filenames: Add uint32_t flags parameter to synthetic_smb_fname(). 2016-03-24 22:57:16 +01:00
vfs_hpuxacl.h
vfs_linux_xfs_sgid.c VFS: Modify chmod_acl to take a const struct smb_filename * instead of const char * 2016-03-03 09:04:14 +01:00
vfs_media_harmony.c s3: Filenames: Add uint32_t flags parameter to synthetic_smb_fname(). 2016-03-24 22:57:16 +01:00
vfs_netatalk.c VFS: Modify lchown to take a const struct smb_filename * instead of const char * 2016-03-05 09:39:18 +01:00
vfs_nfs4acl_xattr.c nfs4acls: Add "smbacl4_vfs_params" parameter to smb_set_nt_acl_nfs4 2016-08-12 17:15:20 +02:00
vfs_offline.c vfs_offline: add vfs_offline module 2015-11-04 22:15:24 +01:00
vfs_posix_eadb.c s3: smbd: Remove many common uses of lp_posix_pathnames(). 2016-03-24 22:57:16 +01:00
vfs_posixacl.c vfs_posixacl: catch ACL_EVERYONE on FreeBSD 2014-10-12 00:22:19 +02:00
vfs_posixacl.h
vfs_prealloc.c vfs_prealloc: Remove call to gpfs_prealloc 2015-02-11 02:03:08 +01:00
vfs_preopen.c s3:vfs:preopen: fix O3 error unused result of write 2016-05-13 00:16:16 +02:00
vfs_readahead.c
vfs_readonly.c Add uint32_t share_access to vuid_cache_entry. 2013-01-09 15:28:48 +11:00
vfs_recycle.c s3: vfs: recycle. Remove use of vfs_stat_smb_basename(). 2016-03-24 22:57:17 +01:00
vfs_shadow_copy2.c vfs_shadow_copy: handle non-existant files and wildcards 2016-08-25 05:35:29 +02:00
vfs_shadow_copy.c s3: Filenames: Add uint32_t flags parameter to synthetic_smb_fname(). 2016-03-24 22:57:16 +01:00
vfs_shell_snap.c vfs: add vfs_shell_snap module 2015-03-31 18:40:25 +02:00
vfs_snapper.c s3: vfs: snapper: Fix snapper_gmt_strip_snapshot() function to strip @GMT token identically to shadow_copy2.c:shadow_copy2_strip_snapshot() 2016-08-18 06:43:02 +02:00
vfs_solarisacl.c s3: vfs: Fix compilation error on Solaris. 2016-08-25 01:38:28 +02:00
vfs_solarisacl.h
vfs_streams_depot.c s3: smbd: Remove many common uses of lp_posix_pathnames(). 2016-03-24 22:57:16 +01:00
vfs_streams_xattr.c s3: smbd: Modify vfs_stat_smb_basename() to take a const struct smb_filename * instead of const char *. 2016-03-24 22:57:17 +01:00
vfs_syncops.c VFS: Modify rmdir to take a const struct smb_filename * instead of const char * 2016-02-25 20:46:49 +01:00
vfs_time_audit.c vfs_time_audit: Assert that all VFS functions are implemented 2016-04-06 00:15:17 +02:00
vfs_tru64acl.c
vfs_tru64acl.h
vfs_tsmsm.c s3/vfs: wrap async io function args inside struct vfs_aio_state 2016-03-02 01:22:13 +01:00
vfs_unityed_media.c s3: Filenames: Add uint32_t flags parameter to synthetic_smb_fname(). 2016-03-24 22:57:16 +01:00
vfs_vxfs.c Efficient xattr handling for VxFS Signed-off-by: Abhidnya Joshi <Abhidnya.Joshi@veritas.com> 2016-06-03 07:26:33 +02:00
vfs_vxfs.h Efficient xattr handling for VxFS Signed-off-by: Abhidnya Joshi <Abhidnya.Joshi@veritas.com> 2016-06-03 07:26:33 +02:00
vfs_worm.c s3:vfs: add create tags to SMB_VFS_CREATEFILE 2014-12-04 22:11:07 +01:00
vfs_xattr_tdb.c s3: smbd: vfs: Remove any stale xattr values during file/directory create in vfs_xattr_tdb() 2016-07-23 06:04:11 +02:00
vfs_zfsacl.c nfs4acls: Add "smbacl4_vfs_params" parameter to smb_set_nt_acl_nfs4 2016-08-12 17:15:20 +02:00
wscript_build buildscripts: Fix the regression with --without-acl-support. 2016-08-08 21:27:46 +02:00

Configuring NFS4 ACLs in Samba3
===============================
Created: Peter Somogyi, 2006-JUN-06
Last modified: Alexander Werth, 2013-MAY-02
Revision no.: 4 
-------------------------------


Parameters in smb.conf:
=======================

Each parameter must have a prefix "nfs4:".
Each one affects the behaviour only when _setting_ an acl on a file/dir:

mode = [simple|special]
- simple: Use OWNER@ and GROUP@ special IDs for non inheriting ACEs only.
  This mode is the default.
- special: use OWNER@ and GROUP@ special IDs in ACEs instead of simple
  user&group ids. This mode is deprecated.

Note1: EVERYONE@ is always processed (if found such an ACE).
Note2: There is a side effect when _only_ chown is performed.
       Later this may be worked out.
Note3: Mode special inherits incorrect ACL entries when the user creating
       a file is different from the owner of the caurrent folder.
Note4: Mode simple uses inheriting OWNER@ and GROUP@ special IDs to
       support Creator Owner and Creator Group.

It's strongly advised to set "store dos attributes = yes" in smb.conf.

chown = [true|false]
- true => enable changing owner and group - default.
- false => disable support for changing owner or group

acedup = [dontcare|reject|ignore|merge]
- dontcare: copy ACEs as they come, don't care with "duplicate" records. Default.
- reject: stop operation, exit acl setter operation with an error
- ignore: don't include the second matching ACE
- merge: OR 2 ace.flag fields and 2 ace.mask fields of the 2 duplicate ACEs into 1 ACE

Two ACEs are considered here "duplicate" when their type and id fields are matching.

Example:

[smbtest]
path = /tests/psomogyi/smbtest
writable = yes
vfs objects = aixacl2
nfs4: mode = special
nfs4: chown = yes
nfs4: acedup = merge

Configuring AIX ACL support
==============================

Binaries: (default install path is [samba]/lib/vfs/)
- aixacl.so: provides AIXC ACL support only, can be compiled and works on all AIX platforms
- aixacl2.so: provides AIXC and JFS2-NFS4 ACL support, can be compiled and works only under AIX 5.3 and newer.
NFS4 acl currently has support only under JFS2 (ext. attr. format must be set to v2).
aixacl2.so always detects support for NFS4 acls and redirects to POSIX ACL handling automatically when NFS4 is not supported for a path.

Adding "vfs objects = aixacl2" to a share should be done only in case when NFS4 is really supported by the filesystem.
(Otherwise you may get performance loss.)

For configuration see also the example above.

General notes
=============

NFS4 handling logic is separated from AIX/jfs2 ACL parsing.

Samba and its VFS modules dosn't reorder ACEs. Windows clients do that (and the smbcacl tool). MSDN also says deny ACEs must come first.
NFS4 ACL's validity is checked by the system API, not by Samba.
NFS4 ACL rights are enforced by the OS or filesystem, not by Samba.

The flag INHERITED_ACE is never set (not required, as doesn't do WinNT/98/me, only since Win2k).
Win2k GUI behaves strangely when detecting inheritance (sometimes it doesn't detect, 
but after adding an ace it shows that - it's some GUI error).

Unknown (unmappable) SIDs are not accepted.

TODOs
=====
- Creator Owner & Group SID handling (same way as posix)
- the 4 generic rights bits support (GENERIC_RIGHT_READ_ACCESS, WRITE, EXEC, ALL)
- chown & no ACL, but we have ONWER@ and GROUP@
- DIALUP, ANONYMOUS, ... builtin SIDs
- audit & alarm support - in theory it's forwarded so it should work, but currently there's no platform which supports them to test
- support for a real NFS4 client (we don't have an accepted API yet)