1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-24 21:34:56 +03:00
samba-mirror/source3/modules
Tim Prouty 122dbbf00a s3 vfs: Add a destructor to the fsp extension data API
I'm not certain if the dummy pointer is needed in struct vfs_fsp_data,
but I added it to be consistent with the comment below.
2009-02-09 23:46:12 -08:00
..
charset_macosxfs.c [GLUE] Rsync SAMBA_3_2_0 SVN r25598 in order to create the v3-2-test branch. 2007-10-10 15:34:30 -05:00
CP437.c r23801: The FSF has moved around a lot. This fixes their Mass Ave address. 2007-10-10 12:28:27 -05:00
CP850.c r23801: The FSF has moved around a lot. This fixes their Mass Ave address. 2007-10-10 12:28:27 -05:00
developer.c r23784: use the GPLv3 boilerplate as recommended by the FSF and the license text 2007-10-10 12:28:22 -05:00
getdate.c s3: Fix a few build warnings 2008-12-15 23:30:49 -08:00
getdate.h r23798: updated old Temple Place FSF addresses to new URL 2007-10-10 12:28:26 -05:00
getdate.y s3: Fix a few build warnings 2008-12-15 23:30:49 -08:00
gpfs.c Make use of smbd_gpfs_get_realfilename_path in unix_convert 2008-12-10 23:57:23 +01:00
nfs4_acls.c Apply same logic fix for #4308 Excel save operation corrupts file ACLs 2009-01-22 16:21:02 -08:00
nfs4_acls.h [s3]nfs4_acls: make prototype header match definition for smb_set_nt_acl_nfs4() 2008-11-22 01:53:37 +01:00
onefs_acl.c s3 onefs: Fix onefs ACLs to work with updated ACL syscall 2009-01-30 15:44:07 -08:00
onefs_open.c s3: Add OneFS alternate data streams implementation 2009-01-11 22:13:36 -08:00
onefs_streams.c s3 OneFS: Fake Timestamps 2009-02-09 00:36:39 -08:00
onefs_system.c s3: OneFS unmappable sids support. 2009-01-23 13:49:12 -08:00
onefs.h s3 OneFS: Fake Timestamps 2009-02-09 00:36:39 -08:00
perfcount_onefs.c S3 OneFS: Add in Isilon specific performance counter module 2009-02-09 13:23:44 -08:00
README-gpfs-acl.txt r20089: Put gpfs acl function into vfs_gpfs module. Thanks to Gomati Mohanan 2007-10-10 12:16:24 -05:00
README.nfs4acls.txt r18603: Add in the NFSv4 ACL mapping code from IBM. 2007-10-10 11:51:59 -05:00
vfs_acl_tdb.c s3: Remove an incorrect const 2009-01-15 21:59:20 -08:00
vfs_acl_xattr.c Rename parent_dirname_talloc() to parent_dirname() 2008-12-31 19:33:25 +01:00
vfs_afsacl.c Remove SEC_ACCESS. It's a uint32_t. 2008-10-09 09:49:03 -07:00
vfs_aio_fork.c s3:smbd: convert aio to use tevent_signal 2009-01-27 15:28:09 +01:00
vfs_aixacl2.c Fix logic error in try_chown - we shouldn't arbitrarily chown 2009-01-22 15:57:41 -08:00
vfs_aixacl_util.c r25399: Excise uint - > uint32 (where appropriate) or unsigned int. 2007-10-10 12:31:02 -05:00
vfs_aixacl.c Remove redundant parameter fd from SMB_VFS_SYS_ACL_SET_FD(). 2008-01-08 01:54:19 +01:00
vfs_audit.c Remove redundant parameter fd from SMB_VFS_CLOSE(). 2008-04-21 00:22:42 +02:00
vfs_cacheprime.c s3 vfs: Add a destructor to the fsp extension data API 2009-02-09 23:46:12 -08:00
vfs_cap.c Extend NTIMES to allow setting create_time 2009-01-23 21:05:38 -08:00
vfs_catia.c Extend NTIMES to allow setting create_time 2009-01-23 21:05:38 -08:00
vfs_commit.c s3 vfs: Add a destructor to the fsp extension data API 2009-02-09 23:46:12 -08:00
vfs_default_quota.c r23801: The FSF has moved around a lot. This fixes their Mass Ave address. 2007-10-10 12:28:27 -05:00
vfs_default.c Fix bug #6085 - In vfs_default.c change utime( ) call. 2009-02-03 14:36:50 -08:00
vfs_expand_msdfs.c Revert erroneous commit. 2008-09-30 15:26:26 -07:00
vfs_extd_audit.c s3/vfs_extd_audit: Don't ignore "syslog = 0". 2009-01-21 18:32:38 +01:00
vfs_fake_perms.c Wrap the unix token info in a unix_user_token in auth_serversupplied_info 2008-06-19 18:51:37 +02:00
vfs_fileid.c s3:vfs_fileid: readd "fileid:algorithm" as option. 2009-01-16 15:16:58 +01:00
vfs_full_audit.c s3: Add a new SMB_VFS_GET_ALLOC_SIZE vfs operation 2009-01-29 15:29:33 -08:00
vfs_gpfs.c Make use of smbd_gpfs_get_realfilename_path in unix_convert 2008-12-10 23:57:23 +01:00
vfs_gpfs.h Merge latest fixes to vfs_gpfs and NFS4 ACLs from Samba 3.0 CTDB branch (from http://samba.org/~tridge/3_0-ctdb) 2008-01-16 12:18:57 +03:00
vfs_hpuxacl.c Fix two uninitialized variables in vfs_hpuxacl.c 2008-01-17 17:22:31 +01:00
vfs_hpuxacl.h Put prototypes of modules/vfs_hpuxacl.c to new modules/vfs_hpuxacl.h. 2008-08-14 11:22:48 +02:00
vfs_irixacl.c Remove redundant parameter fd from SMB_VFS_SYS_ACL_SET_FD(). 2008-01-08 01:54:19 +01:00
vfs_irixacl.h Put prototypes of modules/vfs_irixacl.c to new modules/vfs_irixacl.h. 2008-08-14 11:22:49 +02:00
vfs_netatalk.c Fix all warnings in source3 with gcc4.3. 2008-12-31 18:06:57 -08:00
vfs_notify_fam.c Respect FAMChanged -- attempt to fix bug 5307 2008-03-06 10:07:46 +01:00
vfs_onefs.c s3 OneFS: Fake Timestamps 2009-02-09 00:36:39 -08:00
vfs_posixacl.c Remove redundant parameter fd from SMB_VFS_SYS_ACL_SET_FD(). 2008-01-08 01:54:19 +01:00
vfs_posixacl.h Put prototypes of modules/vfs_posixacl.c into new modules/vfs_posixacl.h. 2008-08-14 11:22:48 +02:00
vfs_prealloc.c s3 vfs: Add a destructor to the fsp extension data API 2009-02-09 23:46:12 -08:00
vfs_readahead.c Combine fsp and fromfd to fromfsp in SMB_VFS_SENDFILE(). 2008-01-11 01:27:05 +01:00
vfs_readonly.c Fix bug #5900 reported by monyo@samba.gr.jp - vfs_readonly.so does not work. 2008-11-17 14:13:20 -08:00
vfs_recycle.c Extend NTIMES to allow setting create_time 2009-01-23 21:05:38 -08:00
vfs_shadow_copy2.c Extend NTIMES to allow setting create_time 2009-01-23 21:05:38 -08:00
vfs_shadow_copy.c RIP BOOL. Convert BOOL -> bool. I found a few interesting 2007-10-18 17:40:25 -07:00
vfs_smb_traffic_analyzer.c Async wrapper for open_socket_out_send/recv 2009-01-04 16:42:40 +01:00
vfs_solarisacl.c Remove forgotton fd from solarisacl_sys_acl_get_fd(). 2008-01-08 01:56:56 +01:00
vfs_solarisacl.h Put prototypes of modules/vfs_solarisacl.c to new modules/vfs_solarisacl.h. 2008-08-14 11:22:48 +02:00
vfs_streams_depot.c s3: Add a new SMB_VFS_GET_ALLOC_SIZE vfs operation 2009-01-29 15:29:33 -08:00
vfs_streams_xattr.c s3 vfs: Add a destructor to the fsp extension data API 2009-02-09 23:46:12 -08:00
vfs_syncops.c Remove redundant parameter fd from SMB_VFS_CLOSE(). 2008-04-21 00:22:42 +02:00
vfs_tru64acl.c Remove redundant parameter fd from SMB_VFS_SYS_ACL_SET_FD(). 2008-01-08 01:54:19 +01:00
vfs_tru64acl.h Put prototypes of modules/vfs_tru64acl.c to new modules/vfs_tru64acl.h. 2008-08-14 11:22:48 +02:00
vfs_tsmsm.c s3:vfs_tsmsm: fix potential segfault (freeing uninitialized buffer) 2008-12-01 06:21:29 +01:00
vfs_xattr_tdb.c s3:vfs_xattr_tdb: don't leak state_path() to talloc_tos in xattr_tdb_init(). 2009-01-16 01:02:21 +01:00
vfs_zfsacl.c [s3]zfsacl: "return" is not a function. 2008-11-25 11:29:41 +01:00
weird.c r23784: use the GPLv3 boilerplate as recommended by the FSF and the license text 2007-10-10 12:28:22 -05:00

Configuring NFS4 ACLs in Samba3
===============================
Created: Peter Somogyi, 2006-JUN-06
Last modified: Peter Somogyi, 2006-JUL-20
Revision no.: 4 
-------------------------------


Parameters in smb.conf:
=======================

Each parameter must have a prefix "nfs4:".
Each one affects the behaviour only when _setting_ an acl on a file/dir:

mode = [simple|special]
- simple: don't use OWNER@ and GROUP@ special IDs in ACEs. - default
- special: use OWNER@ and GROUP@ special IDs in ACEs instead of simple user&group ids.
Note: EVERYONE@ is always processed (if found such an ACE).
Note2: special mode will have side effect when _only_ chown is performed. Later this may be worked out.

Use "simple" mode when the share is used mainly by windows users and unix side is not significant. You will loose unix bits in this case.
It's strongly advised setting "store dos attributes = yes" in smb.conf.

chown = [true|false]
- true => enable changing owner and group - default.
- false => disable support for changing owner or group

acedup = [dontcare|reject|ignore|merge]
- dontcare: copy ACEs as they come, don't care with "duplicate" records. Default.
- reject: stop operation, exit acl setter operation with an error
- ignore: don't include the second matching ACE
- merge: OR 2 ace.flag fields and 2 ace.mask fields of the 2 duplicate ACEs into 1 ACE

Two ACEs are considered here "duplicate" when their type and id fields are matching.

Example:

[smbtest]
path = /tests/psomogyi/smbtest
writable = yes
vfs objects = aixacl2
nfs4: mode = special
nfs4: chown = yes
nfs4: acedup = merge

Configuring AIX ACL support
==============================

Binaries: (default install path is [samba]/lib/vfs/)
- aixacl.so: provides AIXC ACL support only, can be compiled and works on all AIX platforms
- aixacl2.so: provides AIXC and JFS2-NFS4 ACL support, can be compiled and works only under AIX 5.3 and newer.
NFS4 acl currently has support only under JFS2 (ext. attr. format must be set to v2).
aixacl2.so always detects support for NFS4 acls and redirects to POSIX ACL handling automatically when NFS4 is not supported for a path.

Adding "vfs objects = aixacl2" to a share should be done only in case when NFS4 is really supported by the filesystem.
(Otherwise you may get performance loss.)

For configuration see also the example above.

General notes
=============

NFS4 handling logic is separated from AIX/jfs2 ACL parsing.

Samba and its VFS modules dosn't reorder ACEs. Windows clients do that (and the smbcacl tool). MSDN also says deny ACEs must come first.
NFS4 ACL's validity is checked by the system API, not by Samba.
NFS4 ACL rights are enforced by the OS or filesystem, not by Samba.

The flag INHERITED_ACE is never set (not required, as doesn't do WinNT/98/me, only since Win2k).
Win2k GUI behaves strangely when detecting inheritance (sometimes it doesn't detect, 
but after adding an ace it shows that - it's some GUI error).

Unknown (unmappable) SIDs are not accepted.

TODOs
=====
- Creator Owner & Group SID handling (same way as posix)
- the 4 generic rights bits support (GENERIC_RIGHT_READ_ACCESS, WRITE, EXEC, ALL)
- chown & no ACL, but we have ONWER@ and GROUP@
- DIALUP, ANONYMOUS, ... builtin SIDs
- audit & alarm support - in theory it's forwarded so it should work, but currently there's no platform which supports them to test
- support for a real NFS4 client (we don't have an accepted API yet)