1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-24 21:34:56 +03:00
samba-mirror/source3/modules
Jeremy Allison 5e987e2f40 s3: VFS: Add cmocka test for vfs_full_audit to make sure all arrays are correct.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14343

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Apr 14 17:58:40 UTC 2020 on sn-devel-184
2020-04-14 17:58:40 +00:00
..
developer.c
getdate.c s3:modules: Use #ifdef instead of #if for config.h definitions 2018-11-28 23:19:23 +01:00
getdate.h
getdate.y s3:modules: Use #ifdef instead of #if for config.h definitions 2018-11-28 23:19:23 +01:00
hash_inode.c lib:crypto: Add GNUTLS_FIPS140_SET_(LAX|STRICT)_MODE to helpers 2019-07-09 12:16:11 +00:00
hash_inode.h s3:modules: Add hash_inode() function based on SHA1 2019-07-03 11:19:20 +00:00
lib_vxfs.c pass 'rdonly' or 'directory' flag to open a directory file. 2018-07-11 02:22:18 +02:00
nfs4_acls.c smbd: ignore set NTACL requests which contain S-1-5-88 NFS ACEs 2020-03-03 19:15:10 +00:00
nfs4_acls.h nfs4_acls: Remove unused SMB_ACLTYPE_ defines 2019-07-23 18:27:27 +00:00
nfs4acl_xattr_ndr.c vfs_nfs4acl_xattr: add support for NFS 4.1 ACL flags in the NDR backend 2017-11-08 00:20:08 +01:00
nfs4acl_xattr_ndr.h vfs: Fix the FreeBSD nfs4acl build 2019-08-06 21:49:28 +00:00
nfs4acl_xattr_nfs.c vfs: Fix the nfs4acl build on FreeBSD 2019-08-06 21:49:28 +00:00
nfs4acl_xattr_nfs.h vfs: Fix the FreeBSD nfs4acl build 2019-08-06 21:49:28 +00:00
nfs4acl_xattr_util.c nfs4acl_xattr: move some functions to a seperate file 2019-03-18 19:21:25 +00:00
nfs4acl_xattr_util.h nfs4acl_xattr: move some functions to a seperate file 2019-03-18 19:21:25 +00:00
nfs4acl_xattr_xdr.c nfs4acl: Align integer types 2020-01-14 19:17:28 +00:00
nfs4acl_xattr_xdr.h nfs4acl_xattr: move a define to a common header file 2019-03-18 19:21:25 +00:00
nfs4acl_xattr.h vfs_nfs4acl_xattr: support for NFS 4.0 and 4.1 ACLs from NFS4 mount 2019-03-18 19:21:25 +00:00
nfs41acl.x nfs4acl_xattr: add RFC compliant NFS 4.0 and 4.1 ACL defintions 2019-03-18 19:21:25 +00:00
non_posix_acls.c s3: VFS: Change SMB_VFS_SYS_ACL_BLOB_GET_FILE to use const struct smb_filename * instead of const char *. 2017-05-31 22:50:22 +02:00
non_posix_acls.h s3: VFS: Change SMB_VFS_SYS_ACL_BLOB_GET_FILE to use const struct smb_filename * instead of const char *. 2017-05-31 22:50:22 +02:00
offload_token.c smbd: move files_struct.closing to a bitfield 2020-04-03 19:05:44 +00:00
offload_token.h s3/vfs: make SMB_VFS_OFFLOAD_WRITE_SEND offload token based 2017-07-03 19:59:08 +02:00
perfcount_test.c lib: modules: Change XXX_init interface from XXX_init(void) to XXX_init(TALLOC_CTX *) 2017-04-22 01:17:00 +02:00
posixacl_xattr.c s3-vfs: Use ENOATTR in errno comparison for getxattr 2019-01-23 21:59:10 +01:00
posixacl_xattr.h s3: VFS: Change SMB_VFS_SYS_ACL_SET_FILE to use const struct smb_filename * instead of const char *. 2017-05-31 22:50:22 +02:00
README-gpfs-acl.txt
README.nfs4acls.txt nfs4_acls: Change default of nfs4:acedup to "merge" 2019-07-23 18:27:28 +00:00
test_nfs4_acls.c nfs4_acls: Add test for merging duplicates when mapping from NFS4 ACL to DACL 2019-07-23 18:27:27 +00:00
test_vfs_full_audit.c s3: VFS: Add cmocka test for vfs_full_audit to make sure all arrays are correct. 2020-04-14 17:58:40 +00:00
test_vfs_widelinks.c s3: VFS: Add cmocka tests for pathname parsing in vfs_widelinks. 2020-04-09 19:40:35 +00:00
vfs_acl_common.c smbd: move files_struct.delete_on_close to a bitfield 2020-04-03 19:05:44 +00:00
vfs_acl_common.h s3: VFS: Change rmdir_acl_common() to take a files_struct *dirfsp pointer. 2019-10-10 06:09:39 +00:00
vfs_acl_tdb.c vfs: Use dbwrap_delete() in acl_tdb_delete() 2019-11-14 22:26:30 +00:00
vfs_acl_xattr.c s3: VFS: vfs_acl_xattr: Remove rmdir_fn(). No longer used. 2019-10-10 06:09:40 +00:00
vfs_afsacl.c smbd: move files_struct.is_directory to a bitfield 2020-04-03 19:05:44 +00:00
vfs_aio_fork.c s3: Rename server_event_context() to global_event_context() 2018-09-07 17:26:17 +02:00
vfs_aio_pthread.c s3: VFS: vfs_aio_pthread: Make aio opens safe against connection teardown. 2020-03-08 18:07:44 +00:00
vfs_aixacl2.c s3:modules: fix the build of vfs_aixacl2.c 2018-04-03 20:18:58 +02:00
vfs_aixacl_util.c
vfs_aixacl_util.h
vfs_aixacl.c vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_audit.c vfs: remove SMB_VFS_OPENDIR() 2020-03-24 21:23:43 +00:00
vfs_btrfs.c smbd: rename [un]become_user*() to [un]become_user_without_service*() 2019-09-11 19:59:34 +00:00
vfs_cacheprime.c s3: VFS: Remove SMB_VFS_READ() function and all implementations. 2018-05-04 22:34:25 +02:00
vfs_cap.c vfs: remove SMB_VFS_OPENDIR() 2020-03-24 21:23:43 +00:00
vfs_catia.c vfs: remove SMB_VFS_OPENDIR() 2020-03-24 21:23:43 +00:00
vfs_ceph_snapshots.c smbd: move files_struct.is_directory to a bitfield 2020-04-03 19:05:44 +00:00
vfs_ceph.c vfs: remove SMB_VFS_OPENDIR() 2020-03-24 21:23:43 +00:00
vfs_commit.c s3:modules: Use #ifdef instead of #if for config.h definitions 2018-11-28 23:19:23 +01:00
vfs_crossrename.c s3: VFS: vfs_crossrename. Remove rename_fn(). No longer used. 2019-08-16 19:52:36 +00:00
vfs_default_quota.c vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_default.c smbd: move files_struct.use_ofd_locks to a bitfield 2020-04-03 19:05:44 +00:00
vfs_delay_inject.c vfs: Use file_id_str_buf() in vfs_delay_inject_brl_lock_timer() 2019-11-06 21:58:52 +00:00
vfs_dfs_samba4.c s3:param: make "servicename" a substituted option 2019-11-27 10:25:37 +00:00
vfs_dirsort.c vfs: remove SMB_VFS_OPENDIR() 2020-03-24 21:23:43 +00:00
vfs_error_inject.c test: Intercept open in vfs_error_inject 2020-02-20 20:48:29 +00:00
vfs_expand_msdfs.c s3:param: make "servicename" a substituted option 2019-11-27 10:25:37 +00:00
vfs_extd_audit.c vfs: remove SMB_VFS_OPENDIR() 2020-03-24 21:23:43 +00:00
vfs_fake_acls.c s3: VFS: vfs_fake_acls: Remove chown_fn(). 2019-10-15 18:46:37 +00:00
vfs_fake_dfq.c s3: VFS: Add SMB_VFS_RENAMEAT(). 2019-08-16 19:52:32 +00:00
vfs_fake_perms.c vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_fileid.c s3:param: make "servicename" a substituted option 2019-11-27 10:25:37 +00:00
vfs_fruit.c smbd: move files_struct.is_directory to a bitfield 2020-04-03 19:05:44 +00:00
vfs_full_audit.c s3: VFS: full_audit. Add missing fcntl entry in vfs_op_names[] array. 2020-04-14 16:22:28 +00:00
vfs_glusterfs_fuse.c vfs:glusterfs_fuse: ensure fileids are constant across nodes 2019-07-13 22:54:56 +00:00
vfs_glusterfs.c vfs: remove SMB_VFS_OPENDIR() 2020-03-24 21:23:43 +00:00
vfs_gpfs.c smbd: move files_struct.is_sparse to a bitfield 2020-04-03 19:05:44 +00:00
vfs_hpuxacl.c vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_hpuxacl.h vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_io_uring.c s3:modules: add vfs_io_uring module 2020-02-15 11:37:45 +00:00
vfs_linux_xfs_sgid.c s3: VFS: vfs_linux_xfs_sgid. Remove mkdir_fn(). No longer used. 2019-09-11 18:24:31 +00:00
vfs_media_harmony.c vfs: remove SMB_VFS_OPENDIR() 2020-03-24 21:23:43 +00:00
vfs_nfs4acl_xattr.c s3:vfs_nfs4acl_xattr: make use of lp_parm_substituted_string() 2019-11-27 10:25:32 +00:00
vfs_not_implemented.c vfs: remove SMB_VFS_OPENDIR() 2020-03-24 21:23:43 +00:00
vfs_offline.c s3: vfs: add SMB_VFS_GET_DOS_ATTRIBUTES_SEND/RECV 2018-07-27 13:07:14 +02:00
vfs_posix_eadb.c s3: VFS: vfs_posix_eadb: Remove rmdir_fn(). No longer used. 2019-10-10 06:09:41 +00:00
vfs_posixacl.c vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_posixacl.h s3: VFS: Change SMB_VFS_SYS_ACL_SET_FILE to use const struct smb_filename * instead of const char *. 2017-05-31 22:50:22 +02:00
vfs_prealloc.c vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_preopen.c s3: VFS: change connection_struct cwd_fname to cwd_fsp 2019-08-16 19:52:32 +00:00
vfs_readahead.c vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_readonly.c Revert "smbd: add an effective connection_struct->user_ev_ctx that holds the event context used for the current user" 2019-01-11 23:11:16 +01:00
vfs_recycle.c vfs_recycle: prevent flooding the log if we're called on non-existant paths 2020-03-09 14:15:06 +00:00
vfs_shadow_copy2.c smbd: move files_struct.can_write to a bitfield 2020-04-03 19:05:44 +00:00
vfs_shadow_copy.c vfs: remove SMB_VFS_OPENDIR() 2020-03-24 21:23:43 +00:00
vfs_shell_snap.c vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_snapper.c vfs: remove SMB_VFS_OPENDIR() 2020-03-24 21:23:43 +00:00
vfs_solarisacl.c vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_solarisacl.h vfs_solarisacl: fix build for samba 4.7 and up 2017-10-04 10:06:15 +02:00
vfs_streams_depot.c vfs_streams_depot: use OpenDir() in walk_streams() 2020-03-24 19:48:41 +00:00
vfs_streams_xattr.c vfs_streams_xattr: Rename argument of flock function 2020-01-08 00:01:36 +00:00
vfs_syncops.c smbd: move files_struct.can_write to a bitfield 2020-04-03 19:05:44 +00:00
vfs_time_audit.c vfs: remove SMB_VFS_OPENDIR() 2020-03-24 21:23:43 +00:00
vfs_tru64acl.c vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_tru64acl.h s3: VFS: Change SMB_VFS_SYS_ACL_SET_FILE to use const struct smb_filename * instead of const char *. 2017-05-31 22:50:22 +02:00
vfs_tsmsm.c s3:vfs_tsmsm: make use of lp_parm_substituted_string() 2019-11-27 10:25:31 +00:00
vfs_unityed_media.c vfs: remove SMB_VFS_OPENDIR() 2020-03-24 21:23:43 +00:00
vfs_virusfilter_clamav.c s3: VFS: change connection_struct cwd_fname to cwd_fsp 2019-08-16 19:52:32 +00:00
vfs_virusfilter_common.h Samba-VirusFilter: clamav VFS and man page. 2018-01-24 15:08:59 +01:00
vfs_virusfilter_fsav.c s3: VFS: change connection_struct cwd_fname to cwd_fsp 2019-08-16 19:52:32 +00:00
vfs_virusfilter_sophos.c s3: VFS: change connection_struct cwd_fname to cwd_fsp 2019-08-16 19:52:32 +00:00
vfs_virusfilter_utils.c s3:param: make "servicename" a substituted option 2019-11-27 10:25:37 +00:00
vfs_virusfilter_utils.h Samba-VirusFilter: common headers and sources. 2018-01-24 10:29:46 +01:00
vfs_virusfilter.c smbd: move files_struct.is_directory to a bitfield 2020-04-03 19:05:44 +00:00
vfs_vxfs.c s3: vfs: add SMB_VFS_GETXATTRAT_SEND/RECV 2018-07-27 13:07:14 +02:00
vfs_vxfs.h pass 'rdonly' or 'directory' flag to open a directory file. 2018-07-11 02:22:18 +02:00
vfs_widelinks.c VFS: Add vfs_widelinks module. 2020-04-09 19:40:34 +00:00
vfs_worm.c smbd: Make "lease" const in SMB_VFS_CREATE_FILE() 2019-08-09 22:48:46 +00:00
vfs_xattr_tdb.c s3: VFS: vfs_xattr_tdb: Remove rmdir_fn. No longer used. 2019-10-10 06:09:40 +00:00
vfs_zfsacl.c vfs_zfsacl: fix issue with ACL inheritance in zfsacl 2019-12-20 23:24:54 +00:00
wscript_build s3: VFS: Add cmocka test for vfs_full_audit to make sure all arrays are correct. 2020-04-14 17:58:40 +00:00

Configuring NFS4 ACLs in Samba3
===============================
Created: Peter Somogyi, 2006-JUN-06
Last modified: Alexander Werth, 2013-MAY-02
Revision no.: 4 
-------------------------------


Parameters in smb.conf:
=======================

Each parameter must have a prefix "nfs4:".
Each one affects the behaviour only when _setting_ an acl on a file/dir:

mode = [simple|special]
- simple: Use OWNER@ and GROUP@ special IDs for non inheriting ACEs only.
  This mode is the default.
- special: use OWNER@ and GROUP@ special IDs in ACEs instead of simple
  user&group ids. This mode is deprecated.

Note1: EVERYONE@ is always processed (if found such an ACE).
Note2: There is a side effect when _only_ chown is performed.
       Later this may be worked out.
Note3: Mode special inherits incorrect ACL entries when the user creating
       a file is different from the owner of the caurrent folder.
Note4: Mode simple uses inheriting OWNER@ and GROUP@ special IDs to
       support Creator Owner and Creator Group.

It's strongly advised to set "store dos attributes = yes" in smb.conf.

chown = [true|false]
- true => enable changing owner and group - default.
- false => disable support for changing owner or group

acedup = [dontcare|reject|ignore|merge]
- dontcare: copy ACEs as they come, don't care with "duplicate" records.
- reject: stop operation, exit acl setter operation with an error. (deprecated)
- ignore: don't include the second matching ACE. (deprecated)
- merge: OR 2 ace.flag fields and 2 ace.mask fields of the 2 duplicate ACEs into 1 ACE (default)

Two ACEs are considered here "duplicate" when their type and id fields are matching.

Example:

[smbtest]
path = /tests/psomogyi/smbtest
writable = yes
vfs objects = aixacl2
nfs4: mode = special
nfs4: chown = yes
nfs4: acedup = merge

Configuring AIX ACL support
==============================

Binaries: (default install path is [samba]/lib/vfs/)
- aixacl.so: provides AIXC ACL support only, can be compiled and works on all AIX platforms
- aixacl2.so: provides AIXC and JFS2-NFS4 ACL support, can be compiled and works only under AIX 5.3 and newer.
NFS4 acl currently has support only under JFS2 (ext. attr. format must be set to v2).
aixacl2.so always detects support for NFS4 acls and redirects to POSIX ACL handling automatically when NFS4 is not supported for a path.

Adding "vfs objects = aixacl2" to a share should be done only in case when NFS4 is really supported by the filesystem.
(Otherwise you may get performance loss.)

For configuration see also the example above.

General notes
=============

NFS4 handling logic is separated from AIX/jfs2 ACL parsing.

Samba and its VFS modules dosn't reorder ACEs. Windows clients do that (and the smbcacl tool). MSDN also says deny ACEs must come first.
NFS4 ACL's validity is checked by the system API, not by Samba.
NFS4 ACL rights are enforced by the OS or filesystem, not by Samba.

The flag INHERITED_ACE is never set (not required, as doesn't do WinNT/98/me, only since Win2k).
Win2k GUI behaves strangely when detecting inheritance (sometimes it doesn't detect, 
but after adding an ace it shows that - it's some GUI error).

Unknown (unmappable) SIDs are not accepted.

TODOs
=====
- Creator Owner & Group SID handling (same way as posix)
- the 4 generic rights bits support (GENERIC_RIGHT_READ_ACCESS, WRITE, EXEC, ALL)
- chown & no ACL, but we have ONWER@ and GROUP@
- DIALUP, ANONYMOUS, ... builtin SIDs
- audit & alarm support - in theory it's forwarded so it should work, but currently there's no platform which supports them to test
- support for a real NFS4 client (we don't have an accepted API yet)