1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-24 21:34:56 +03:00
samba-mirror/source3/modules
2011-03-30 01:13:06 +02:00
..
charset_macosxfs.c lib/util/charset Use top level iconv.c in source3 2011-02-18 18:41:00 +11:00
CP437.c
CP850.c
developer.c lib/util/charset Use top level iconv.c in source3 2011-02-18 18:41:00 +11:00
getdate.c
getdate.h
getdate.y
gpfs.c s3: FILE_WRITE_DATA & friends have gone from includes.h 2010-10-28 13:37:06 +00:00
nfs4_acls.c If possible (O_DIRECTORY exists) open an fd for a directory open. 2011-02-08 06:34:41 +01:00
nfs4_acls.h
onefs_acl.c s3-security: use shared SECINFO_DACL define. 2010-06-03 11:00:12 +02:00
onefs_cbrl.c s3-modules: Fixed the for-loop code block. 2011-01-26 14:20:37 -08:00
onefs_config.c
onefs_config.h
onefs_dir.c
onefs_notify.c
onefs_open.c Fix bug 7950 - Samba 3.5.x fails BASE-CREATEX_SHAREMODES_DIR smbtorture4 test 2011-02-23 18:24:41 -08:00
onefs_shadow_copy.c
onefs_shadow_copy.h
onefs_streams.c
onefs_system.c Protect the onefs sendfile from EAGAIN/EWOULDBLOCK. 2010-12-15 03:26:43 +01:00
onefs.h s3-proto: remove some prototypes of non-existing functions. 2011-02-23 15:42:35 +01:00
perfcount_onefs.c s3: Remove smbd_server_fd() 2010-08-29 21:55:25 +02:00
perfcount_test.c
README-gpfs-acl.txt
README.nfs4acls.txt
vfs_acl_common.c s3-auth Rename auth_serversupplied_info varaiables: server_info -> session_info 2011-02-22 16:20:10 +11:00
vfs_acl_tdb.c Ensure we have correct parameters to use Windows ACL modules. 2010-10-16 03:36:04 +00:00
vfs_acl_xattr.c Ensure we have correct parameters to use Windows ACL modules. 2010-10-16 03:36:04 +00:00
vfs_afsacl.c If possible (O_DIRECTORY exists) open an fd for a directory open. 2011-02-08 06:34:41 +01:00
vfs_aio_fork.c s3-includes: only include system/shmem.h when needed. 2011-03-30 01:13:06 +02:00
vfs_aixacl2.c
vfs_aixacl_util.c
vfs_aixacl.c
vfs_audit.c s3-includes: only include system/syslog.h when needed. 2011-03-30 01:13:06 +02:00
vfs_cacheprime.c
vfs_cap.c Move the uglyness of #ifdef REALPATH_TAKES_NULL into the vfs_default 2010-11-20 02:15:50 +01:00
vfs_catia.c Move the uglyness of #ifdef REALPATH_TAKES_NULL into the vfs_default 2010-11-20 02:15:50 +01:00
vfs_commit.c
vfs_crossrename.c s3: Fix Coverity ID 585: NEGATIVE_RETURNS 2011-03-27 22:22:10 +02:00
vfs_default_quota.c
vfs_default.c s3: Pass smb_filename through the set_offline vfs op 2011-03-02 18:39:21 +01:00
vfs_dirsort.c Add fdopendir to the VFS. We will use this to reuse a directory fd already open by NtCreateX. 2011-02-09 00:55:22 +01:00
vfs_expand_msdfs.c s3-auth Rename auth_serversupplied_info varaiables: server_info -> session_info 2011-02-22 16:20:10 +11:00
vfs_extd_audit.c s3-includes: only include system/syslog.h when needed. 2011-03-30 01:13:06 +02:00
vfs_fake_perms.c s3-auth Rename auth_serversupplied_info varaiables: server_info -> session_info 2011-02-22 16:20:10 +11:00
vfs_fileid.c
vfs_full_audit.c s3-includes: only include system/syslog.h when needed. 2011-03-30 01:13:06 +02:00
vfs_gpfs.c s3: Pass the aio_force operation through vfs_gpfs 2011-03-02 19:24:27 +01:00
vfs_gpfs.h s3:gpfs: Add support for the gpfs_ftruncate call 2010-10-13 13:34:25 +00:00
vfs_hpuxacl.c s3: Lift smbd_server_conn from file_find_fd 2010-09-28 07:36:18 +02:00
vfs_hpuxacl.h
vfs_irixacl.c
vfs_irixacl.h
vfs_linux_xfs_sgid.c s3: Add vfs_linux_xfs_sgid 2010-06-02 12:30:51 +02:00
vfs_netatalk.c Add fdopendir to the VFS. We will use this to reuse a directory fd already open by NtCreateX. 2011-02-09 00:55:22 +01:00
vfs_notify_fam.c
vfs_onefs_shadow_copy.c s3: Pass smb_filename through the set_offline vfs op 2011-03-02 18:39:21 +01:00
vfs_onefs.c
vfs_posixacl.c
vfs_posixacl.h
vfs_prealloc.c
vfs_preopen.c
vfs_readahead.c
vfs_readonly.c s3-auth Rename auth_serversupplied_info varaiables: server_info -> session_info 2011-02-22 16:20:10 +11:00
vfs_recycle.c s3-auth Rename auth_serversupplied_info varaiables: server_info -> session_info 2011-02-22 16:20:10 +11:00
vfs_scannedonly.c Add fdopendir to the VFS. We will use this to reuse a directory fd already open by NtCreateX. 2011-02-09 00:55:22 +01:00
vfs_shadow_copy2.c s3: Fix the talloc hierarchy in shadow_copy2_connectpath 2011-03-14 19:21:11 +01:00
vfs_shadow_copy.c Add fdopendir to the VFS. We will use this to reuse a directory fd already open by NtCreateX. 2011-02-09 00:55:22 +01:00
vfs_smb_traffic_analyzer.c s3: Fix Coverity ID 2226: RESOURCE_LEAK 2011-03-27 22:22:11 +02:00
vfs_smb_traffic_analyzer.h vfs_smb_traffic_analyzer shall also transfer the clients IP address. 2011-02-19 01:53:18 +01:00
vfs_solarisacl.c
vfs_solarisacl.h
vfs_streams_depot.c Make processing of incoming stream rename paths common between reply_mv and ntrename. Ensure we don't depend on "./" in the streams module. 2011-01-20 16:27:56 -08:00
vfs_streams_xattr.c Rename vfs operation posix_fallocate to just fallocate and add the vfs_fallocate_mode parameter. 2010-12-18 08:59:27 +01:00
vfs_syncops.c s3-vfs: make syncops_connect in modules/vfs_syncops.c static. 2011-02-25 01:08:52 +01:00
vfs_time_audit.c Add fdopendir to the VFS. We will use this to reuse a directory fd already open by NtCreateX. 2011-02-09 00:55:22 +01:00
vfs_tru64acl.c
vfs_tru64acl.h
vfs_tsmsm.c s3: Pass smb_filename through the set_offline vfs op 2011-03-02 18:39:21 +01:00
vfs_xattr_tdb.c s3: Remove superfluous ; 2011-02-02 15:44:21 +01:00
vfs_zfsacl.c s3: On FreeBSD, compile zfsacl if sunacl.h is around 2011-01-30 12:17:48 +01:00
weird.c lib/util/charset Use top level iconv.c in source3 2011-02-18 18:41:00 +11:00
wscript_build s3-waf: use SAMBA3_*() build rules in source3/build 2011-02-18 16:46:41 +11:00

Configuring NFS4 ACLs in Samba3
===============================
Created: Peter Somogyi, 2006-JUN-06
Last modified: Peter Somogyi, 2006-JUL-20
Revision no.: 4 
-------------------------------


Parameters in smb.conf:
=======================

Each parameter must have a prefix "nfs4:".
Each one affects the behaviour only when _setting_ an acl on a file/dir:

mode = [simple|special]
- simple: don't use OWNER@ and GROUP@ special IDs in ACEs. - default
- special: use OWNER@ and GROUP@ special IDs in ACEs instead of simple user&group ids.
Note: EVERYONE@ is always processed (if found such an ACE).
Note2: special mode will have side effect when _only_ chown is performed. Later this may be worked out.

Use "simple" mode when the share is used mainly by windows users and unix side is not significant. You will loose unix bits in this case.
It's strongly advised setting "store dos attributes = yes" in smb.conf.

chown = [true|false]
- true => enable changing owner and group - default.
- false => disable support for changing owner or group

acedup = [dontcare|reject|ignore|merge]
- dontcare: copy ACEs as they come, don't care with "duplicate" records. Default.
- reject: stop operation, exit acl setter operation with an error
- ignore: don't include the second matching ACE
- merge: OR 2 ace.flag fields and 2 ace.mask fields of the 2 duplicate ACEs into 1 ACE

Two ACEs are considered here "duplicate" when their type and id fields are matching.

Example:

[smbtest]
path = /tests/psomogyi/smbtest
writable = yes
vfs objects = aixacl2
nfs4: mode = special
nfs4: chown = yes
nfs4: acedup = merge

Configuring AIX ACL support
==============================

Binaries: (default install path is [samba]/lib/vfs/)
- aixacl.so: provides AIXC ACL support only, can be compiled and works on all AIX platforms
- aixacl2.so: provides AIXC and JFS2-NFS4 ACL support, can be compiled and works only under AIX 5.3 and newer.
NFS4 acl currently has support only under JFS2 (ext. attr. format must be set to v2).
aixacl2.so always detects support for NFS4 acls and redirects to POSIX ACL handling automatically when NFS4 is not supported for a path.

Adding "vfs objects = aixacl2" to a share should be done only in case when NFS4 is really supported by the filesystem.
(Otherwise you may get performance loss.)

For configuration see also the example above.

General notes
=============

NFS4 handling logic is separated from AIX/jfs2 ACL parsing.

Samba and its VFS modules dosn't reorder ACEs. Windows clients do that (and the smbcacl tool). MSDN also says deny ACEs must come first.
NFS4 ACL's validity is checked by the system API, not by Samba.
NFS4 ACL rights are enforced by the OS or filesystem, not by Samba.

The flag INHERITED_ACE is never set (not required, as doesn't do WinNT/98/me, only since Win2k).
Win2k GUI behaves strangely when detecting inheritance (sometimes it doesn't detect, 
but after adding an ace it shows that - it's some GUI error).

Unknown (unmappable) SIDs are not accepted.

TODOs
=====
- Creator Owner & Group SID handling (same way as posix)
- the 4 generic rights bits support (GENERIC_RIGHT_READ_ACCESS, WRITE, EXEC, ALL)
- chown & no ACL, but we have ONWER@ and GROUP@
- DIALUP, ANONYMOUS, ... builtin SIDs
- audit & alarm support - in theory it's forwarded so it should work, but currently there's no platform which supports them to test
- support for a real NFS4 client (we don't have an accepted API yet)