1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-24 21:34:56 +03:00
samba-mirror/source3/modules
2011-02-09 15:13:37 -08:00
..
charset_macosxfs.c
CP437.c
CP850.c
developer.c
getdate.c
getdate.h
getdate.y
gpfs.c s3: FILE_WRITE_DATA & friends have gone from includes.h 2010-10-28 13:37:06 +00:00
nfs4_acls.c If possible (O_DIRECTORY exists) open an fd for a directory open. 2011-02-08 06:34:41 +01:00
nfs4_acls.h s3-secdesc: remove "typedef struct security_descriptor SEC_DESC". 2010-05-18 12:30:12 +02:00
onefs_acl.c s3-security: use shared SECINFO_DACL define. 2010-06-03 11:00:12 +02:00
onefs_cbrl.c s3-modules: Fixed the for-loop code block. 2011-01-26 14:20:37 -08:00
onefs_config.c
onefs_config.h
onefs_dir.c
onefs_notify.c
onefs_open.c s3-smbd: Migrated to new spoolss functions for printing. 2010-07-27 10:27:13 -04:00
onefs_shadow_copy.c
onefs_shadow_copy.h
onefs_streams.c s3: Add more helpful debugging to some of the streams code 2009-09-24 10:59:33 -07:00
onefs_system.c Protect the onefs sendfile from EAGAIN/EWOULDBLOCK. 2010-12-15 03:26:43 +01:00
onefs.h s3-secdesc: remove "typedef struct security_descriptor SEC_DESC". 2010-05-18 12:30:12 +02:00
perfcount_onefs.c s3: Remove smbd_server_fd() 2010-08-29 21:55:25 +02:00
perfcount_test.c Fix bad use when freeing linked list. Todd Stecher (Original author) please check ! 2010-02-10 16:23:33 -08:00
README-gpfs-acl.txt
README.nfs4acls.txt
vfs_acl_common.c s3: Remove superfluous ; 2011-02-02 15:44:21 +01:00
vfs_acl_tdb.c Ensure we have correct parameters to use Windows ACL modules. 2010-10-16 03:36:04 +00:00
vfs_acl_xattr.c Ensure we have correct parameters to use Windows ACL modules. 2010-10-16 03:36:04 +00:00
vfs_afsacl.c If possible (O_DIRECTORY exists) open an fd for a directory open. 2011-02-08 06:34:41 +01:00
vfs_aio_fork.c s3:vfs aio_fork children do not go away 2011-01-14 09:57:18 +01:00
vfs_aixacl2.c s3-secdesc: remove "typedef struct security_descriptor SEC_DESC". 2010-05-18 12:30:12 +02:00
vfs_aixacl_util.c Fix some warnings in the AIX ACL code. 2009-08-12 10:58:00 -07:00
vfs_aixacl.c
vfs_audit.c Restructure the connect function code to always call 2009-11-30 15:53:04 -08:00
vfs_cacheprime.c Restructure the connect function code to always call 2009-11-30 15:53:04 -08:00
vfs_cap.c Move the uglyness of #ifdef REALPATH_TAKES_NULL into the vfs_default 2010-11-20 02:15:50 +01:00
vfs_catia.c Move the uglyness of #ifdef REALPATH_TAKES_NULL into the vfs_default 2010-11-20 02:15:50 +01:00
vfs_commit.c vfs_commit: print warning when no fsync support is there 2010-01-06 18:28:16 +01:00
vfs_crossrename.c s3: add vfs_crossrename 2010-03-08 17:17:58 +01:00
vfs_default_quota.c
vfs_default.c Correctly plumb in VFS_FDOPENDIR. 2011-02-09 15:13:37 -08:00
vfs_dirsort.c Add fdopendir to the VFS. We will use this to reuse a directory fd already open by NtCreateX. 2011-02-09 00:55:22 +01:00
vfs_expand_msdfs.c s3: Remove smbd_server_fd from expand_msdfs_target 2010-08-26 22:35:52 +02:00
vfs_extd_audit.c Restructure the connect function code to always call 2009-11-30 15:53:04 -08:00
vfs_fake_perms.c
vfs_fileid.c Restructure the connect function code to always call 2009-11-30 15:53:04 -08:00
vfs_full_audit.c Add fdopendir to the VFS. We will use this to reuse a directory fd already open by NtCreateX. 2011-02-09 00:55:22 +01:00
vfs_gpfs.c s3:vfs:gpfs: fix logic when gpfs:winattr is false (the default!) 2011-01-21 10:10:02 +01:00
vfs_gpfs.h s3:gpfs: Add support for the gpfs_ftruncate call 2010-10-13 13:34:25 +00:00
vfs_hpuxacl.c s3: Lift smbd_server_conn from file_find_fd 2010-09-28 07:36:18 +02:00
vfs_hpuxacl.h s3: Attempt to fix hpuxacl module 2009-07-29 10:12:23 -07:00
vfs_irixacl.c
vfs_irixacl.h
vfs_linux_xfs_sgid.c s3: Add vfs_linux_xfs_sgid 2010-06-02 12:30:51 +02:00
vfs_netatalk.c Add fdopendir to the VFS. We will use this to reuse a directory fd already open by NtCreateX. 2011-02-09 00:55:22 +01:00
vfs_notify_fam.c s3-build: fix the build of vfs_notify_fam. 2010-05-06 10:28:31 +02:00
vfs_onefs_shadow_copy.c Move the uglyness of #ifdef REALPATH_TAKES_NULL into the vfs_default 2010-11-20 02:15:50 +01:00
vfs_onefs.c Restructure the connect function code to always call 2009-11-30 15:53:04 -08:00
vfs_posixacl.c
vfs_posixacl.h
vfs_prealloc.c Restructure the connect function code to always call 2009-11-30 15:53:04 -08:00
vfs_preopen.c Revert "s3: Make the implicit reference to Protocol in is_in_path() explicit" 2009-11-23 16:35:00 +01:00
vfs_readahead.c Restructure the connect function code to always call 2009-11-30 15:53:04 -08:00
vfs_readonly.c Remove the bool admin_user from conn struct. We no longer look at this to make access decisions. 2010-03-15 15:39:41 -07:00
vfs_recycle.c s3-netlogon: remove global include of netlogon.h. 2010-08-06 15:46:16 +02:00
vfs_scannedonly.c Add fdopendir to the VFS. We will use this to reuse a directory fd already open by NtCreateX. 2011-02-09 00:55:22 +01:00
vfs_shadow_copy2.c s3:vfs:shadow_copy2: fix indentation in _SHADOW2_NEXT_SMB_FNAME 2011-01-21 10:57:45 +01:00
vfs_shadow_copy.c Add fdopendir to the VFS. We will use this to reuse a directory fd already open by NtCreateX. 2011-02-09 00:55:22 +01:00
vfs_smb_traffic_analyzer.c libcli/security Provide a common, top level libcli/security/security.h 2010-10-12 05:54:10 +00:00
vfs_smb_traffic_analyzer.h s3: vfs_smb_traffic_analyzer.c: add VFS functions for file open and close 2010-03-16 09:52:10 -04:00
vfs_solarisacl.c Cleanup patch after "new VFS" 2009-07-25 13:12:08 -04:00
vfs_solarisacl.h
vfs_streams_depot.c Make processing of incoming stream rename paths common between reply_mv and ntrename. Ensure we don't depend on "./" in the streams module. 2011-01-20 16:27:56 -08:00
vfs_streams_xattr.c Rename vfs operation posix_fallocate to just fallocate and add the vfs_fallocate_mode parameter. 2010-12-18 08:59:27 +01:00
vfs_syncops.c s3:vfs:syncops add option to disable module per share 2010-10-13 12:53:16 +00:00
vfs_time_audit.c Add fdopendir to the VFS. We will use this to reuse a directory fd already open by NtCreateX. 2011-02-09 00:55:22 +01:00
vfs_tru64acl.c
vfs_tru64acl.h
vfs_tsmsm.c s3/vfs_tsmsm: remove unneeded cast to off_t 2010-11-18 14:47:59 +00:00
vfs_xattr_tdb.c s3: Remove superfluous ; 2011-02-02 15:44:21 +01:00
vfs_zfsacl.c s3: On FreeBSD, compile zfsacl if sunacl.h is around 2011-01-30 12:17:48 +01:00
weird.c
wscript_build s3-waf: On FreeBSD, compile zfsacl if sunacl.h is around. 2011-01-31 10:51:10 +01:00

Configuring NFS4 ACLs in Samba3
===============================
Created: Peter Somogyi, 2006-JUN-06
Last modified: Peter Somogyi, 2006-JUL-20
Revision no.: 4 
-------------------------------


Parameters in smb.conf:
=======================

Each parameter must have a prefix "nfs4:".
Each one affects the behaviour only when _setting_ an acl on a file/dir:

mode = [simple|special]
- simple: don't use OWNER@ and GROUP@ special IDs in ACEs. - default
- special: use OWNER@ and GROUP@ special IDs in ACEs instead of simple user&group ids.
Note: EVERYONE@ is always processed (if found such an ACE).
Note2: special mode will have side effect when _only_ chown is performed. Later this may be worked out.

Use "simple" mode when the share is used mainly by windows users and unix side is not significant. You will loose unix bits in this case.
It's strongly advised setting "store dos attributes = yes" in smb.conf.

chown = [true|false]
- true => enable changing owner and group - default.
- false => disable support for changing owner or group

acedup = [dontcare|reject|ignore|merge]
- dontcare: copy ACEs as they come, don't care with "duplicate" records. Default.
- reject: stop operation, exit acl setter operation with an error
- ignore: don't include the second matching ACE
- merge: OR 2 ace.flag fields and 2 ace.mask fields of the 2 duplicate ACEs into 1 ACE

Two ACEs are considered here "duplicate" when their type and id fields are matching.

Example:

[smbtest]
path = /tests/psomogyi/smbtest
writable = yes
vfs objects = aixacl2
nfs4: mode = special
nfs4: chown = yes
nfs4: acedup = merge

Configuring AIX ACL support
==============================

Binaries: (default install path is [samba]/lib/vfs/)
- aixacl.so: provides AIXC ACL support only, can be compiled and works on all AIX platforms
- aixacl2.so: provides AIXC and JFS2-NFS4 ACL support, can be compiled and works only under AIX 5.3 and newer.
NFS4 acl currently has support only under JFS2 (ext. attr. format must be set to v2).
aixacl2.so always detects support for NFS4 acls and redirects to POSIX ACL handling automatically when NFS4 is not supported for a path.

Adding "vfs objects = aixacl2" to a share should be done only in case when NFS4 is really supported by the filesystem.
(Otherwise you may get performance loss.)

For configuration see also the example above.

General notes
=============

NFS4 handling logic is separated from AIX/jfs2 ACL parsing.

Samba and its VFS modules dosn't reorder ACEs. Windows clients do that (and the smbcacl tool). MSDN also says deny ACEs must come first.
NFS4 ACL's validity is checked by the system API, not by Samba.
NFS4 ACL rights are enforced by the OS or filesystem, not by Samba.

The flag INHERITED_ACE is never set (not required, as doesn't do WinNT/98/me, only since Win2k).
Win2k GUI behaves strangely when detecting inheritance (sometimes it doesn't detect, 
but after adding an ace it shows that - it's some GUI error).

Unknown (unmappable) SIDs are not accepted.

TODOs
=====
- Creator Owner & Group SID handling (same way as posix)
- the 4 generic rights bits support (GENERIC_RIGHT_READ_ACCESS, WRITE, EXEC, ALL)
- chown & no ACL, but we have ONWER@ and GROUP@
- DIALUP, ANONYMOUS, ... builtin SIDs
- audit & alarm support - in theory it's forwarded so it should work, but currently there's no platform which supports them to test
- support for a real NFS4 client (we don't have an accepted API yet)