1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
samba-mirror/source3/modules
Noel Power 82e1402636 VFS: Remove SMB_VFS_SETXATTR, no longer used
---------------
                                  /               \
                                 /      REST       \
                                /        IN         \
                               /        PEACE        \
                              /                       \
                              |                       |
                              |   SMB_VFS_SETXATTR    |
                              |                       |
                              |                       |
                              |       19 February     |
                              |          2021         |
                              |                       |
                              |                       |
                             *|     *  *  *           | *
                    _________)/\\_//(\/(/\)/\//\/\////|_)_______

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>

Signed-off-by: Noel Power <noel.power@suse.com>
2021-03-11 17:50:30 +00:00
..
getdate.c
getdate.h
getdate.y
hash_inode.c
hash_inode.h
lib_vxfs.c
nfs4_acls.c s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path. 2021-02-25 20:46:02 +00:00
nfs4_acls.h
nfs4acl_xattr_ndr.c
nfs4acl_xattr_ndr.h
nfs4acl_xattr_nfs.c
nfs4acl_xattr_nfs.h
nfs4acl_xattr_util.c
nfs4acl_xattr_util.h
nfs4acl_xattr_xdr.c nfs4acl: Align integer types 2020-01-14 19:17:28 +00:00
nfs4acl_xattr_xdr.h
nfs4acl_xattr.h
nfs41acl.x
non_posix_acls.c
non_posix_acls.h
offload_token.c smbd: move files_struct.closing to a bitfield 2020-04-03 19:05:44 +00:00
offload_token.h
perfcount_test.c
posixacl_xattr.c s3/modules: posixacl convert from SMB_VFS_SETXATTR -> SMB_VFS_FSETXATTR 2021-03-11 17:50:30 +00:00
posixacl_xattr.h vfs: add acl type arg to SMB_VFS_SYS_ACL_SET_FD() 2020-12-17 18:56:28 +00:00
README-gpfs-acl.txt
README.nfs4acls.txt
test_nfs4_acls.c
test_vfs_full_audit.c s3: VFS: Add cmocka test for vfs_full_audit to make sure all arrays are correct. 2020-04-14 17:58:40 +00:00
test_vfs_gpfs.c test_vfs_gpfs: Add test for file id generation 2020-09-08 22:57:03 +00:00
test_vfs_posixacl.c test: Fix the FreeBSD build 2020-11-30 23:48:02 +00:00
The_New_VFS.org vfs: update status of SMB_VFS_LISTXATTR 2021-02-26 22:35:04 +00:00
The_New_VFS.txt vfs: update status of SMB_VFS_LISTXATTR 2021-02-26 22:35:04 +00:00
util_reparse.c vfs: Move reparse point functions to util_reparse.c 2020-06-15 19:25:39 +00:00
util_reparse.h vfs: Move reparse point functions to util_reparse.c 2020-06-15 19:25:39 +00:00
vfs_acl_common.c vfs_acl_common: support real dirfsps in acl_common_remove_object() 2021-01-28 08:11:49 +00:00
vfs_acl_common.h vfs_acl_common: add an fsp extension when setting ACL 2020-12-17 18:56:29 +00:00
vfs_acl_tdb.c vfs_acl_tdb: avoid deleting the NT ACL from the tdb 2020-12-17 20:04:22 +00:00
vfs_acl_xattr.c s3/modules: vfs_acl_xattr SMB_VFS_SETXATTR -> SMB_VFS_FSETXATTR 2021-03-11 17:50:30 +00:00
vfs_afsacl.c smbd: use fsp_get_pathref_fd() for fstat() calls 2020-12-16 09:08:30 +00:00
vfs_aio_fork.c lib: give global_contexts.c its own header file 2021-01-08 20:31:33 +00:00
vfs_aio_pthread.c smbd: use fsp_get_io_fd() when accessing a file or it's associated metadata 2020-12-16 09:08:30 +00:00
vfs_aixacl2.c vfs_aixacl2: Fix "mem_ctx" and "ppdesc" smb_fget_nt_acl_nfs4 args 2021-03-03 12:36:13 +00:00
vfs_aixacl_util.c
vfs_aixacl_util.h
vfs_aixacl.c vfs: restore platform specific POSIX sys_acl_set_file() functions 2021-01-28 15:21:02 +00:00
vfs_audit.c vfs_audit: support real dirfsps in audit_unlinkat() 2021-01-28 08:11:49 +00:00
vfs_btrfs.c vfs: SMB_VFS_GET_COMPRESSION() -> SMB_VFS_FGET_COMPRESSION() 2020-12-16 09:08:32 +00:00
vfs_cacheprime.c smbd: use fsp_get_io_fd() when accessing a file or it's associated metadata 2020-12-16 09:08:30 +00:00
vfs_cap.c VFS: Remove SMB_VFS_SETXATTR, no longer used 2021-03-11 17:50:30 +00:00
vfs_catia.c VFS: Remove SMB_VFS_SETXATTR, no longer used 2021-03-11 17:50:30 +00:00
vfs_ceph_snapshots.c VFS: Remove SMB_VFS_SETXATTR, no longer used 2021-03-11 17:50:30 +00:00
vfs_ceph.c VFS: Remove SMB_VFS_SETXATTR, no longer used 2021-03-11 17:50:30 +00:00
vfs_commit.c smbd: use fh_[get|set]_pos() and fh_[get|set]_position_information() 2020-12-16 09:08:30 +00:00
vfs_crossrename.c
vfs_default_quota.c
vfs_default.c VFS: Remove SMB_VFS_SETXATTR, no longer used 2021-03-11 17:50:30 +00:00
vfs_delay_inject.c lib: give global_contexts.c its own header file 2021-01-08 20:31:33 +00:00
vfs_dfs_samba4.c s3:param: make "servicename" a substituted option 2019-11-27 10:25:37 +00:00
vfs_dirsort.c vfs: Add dirfsp arg to SMB_VFS_READDIR() 2020-12-16 09:08:31 +00:00
vfs_error_inject.c vfs_error_inject: add unlinkat hook 2021-01-26 02:55:28 +00:00
vfs_expand_msdfs.c s3: VFS: expand_msdfs: Since we moved to SMB_VFS_READ_DFS_PATHAT() this module has looked at the wrong function. 2021-02-13 00:17:31 +00:00
vfs_extd_audit.c vfs_extd_audit.c: support real dirfsps in audit_unlinkat() 2021-01-28 08:11:49 +00:00
vfs_fake_acls.c s3/modules: fake_acls_lchown use SMB_VFS_NEXT_FSET 2021-03-11 17:50:30 +00:00
vfs_fake_dfq.c
vfs_fake_perms.c
vfs_fileid.c smbd: add twrp arg to synthetic_smb_fname() 2020-05-05 19:18:40 +00:00
vfs_fruit.c s3/libadouble: remove dirfsp arg from ad_convert() 2021-01-28 08:11:49 +00:00
vfs_full_audit.c VFS: Remove SMB_VFS_SETXATTR, no longer used 2021-03-11 17:50:30 +00:00
vfs_glusterfs_fuse.c smbd: convert SMB_VFS_GET_REAL_FILENAME() arg path to be a struct smb_filename 2020-05-05 19:18:41 +00:00
vfs_glusterfs.c VFS: Remove SMB_VFS_SETXATTR, no longer used 2021-03-11 17:50:30 +00:00
vfs_gpfs.c vfs_gpfs:Logging filename for smbd_gpfs_set_times_path() 2020-12-30 10:21:08 +00:00
vfs_hpuxacl.c vfs: RIP SMB_VFS_SYS_ACL_SET_FILE() 2020-12-17 18:56:29 +00:00
vfs_hpuxacl.h
vfs_io_uring.c smbd: use fsp_get_io_fd() when accessing a file or it's associated metadata 2020-12-16 09:08:30 +00:00
vfs_linux_xfs_sgid.c vfs_linux_xfs_sgid: support real dirfsps in linux_xfs_sgid_mkdirat() 2020-12-17 18:56:29 +00:00
vfs_media_harmony.c VFS: Remove SMB_VFS_SETXATTR, no longer used 2021-03-11 17:50:30 +00:00
vfs_nfs4acl_xattr.c s2/modules: nfs4acl_smb4acl_set_fn SMB_VFS_NEXT_SETXATTR -> SMB_VFS_NEXT_FFSETXATTR 2021-03-11 17:50:30 +00:00
vfs_not_implemented.c VFS: Remove SMB_VFS_SETXATTR, no longer used 2021-03-11 17:50:30 +00:00
vfs_offline.c vfs: RIP SMB_VFS_GET_DOS_ATTRIBUTES() 2020-12-16 09:08:32 +00:00
vfs_posix_eadb.c VFS: Remove SMB_VFS_SETXATTR, no longer used 2021-03-11 17:50:30 +00:00
vfs_posixacl.c vfs: RIP SMB_VFS_SYS_ACL_SET_FILE() 2020-12-17 18:56:29 +00:00
vfs_posixacl.h vfs: add acl type arg to SMB_VFS_SYS_ACL_SET_FD() 2020-12-17 18:56:28 +00:00
vfs_prealloc.c smbd: use fsp_get_io_fd() when accessing a file or it's associated metadata 2020-12-16 09:08:30 +00:00
vfs_preopen.c lib: give global_contexts.c its own header file 2021-01-08 20:31:33 +00:00
vfs_readahead.c smbd: use fsp_get_io_fd() when accessing a file or it's associated metadata 2020-12-16 09:08:30 +00:00
vfs_readonly.c
vfs_recycle.c vfs_recycle: support real dirfsps in recycle_unlinkat() 2021-01-28 08:11:49 +00:00
vfs_shadow_copy2.c VFS: Remove SMB_VFS_SETXATTR, no longer used 2021-03-11 17:50:30 +00:00
vfs_shadow_copy.c vfs: Add dirfsp arg to SMB_VFS_READDIR() 2020-12-16 09:08:31 +00:00
vfs_shell_snap.c
vfs_snapper.c VFS: Remove SMB_VFS_SETXATTR, no longer used 2021-03-11 17:50:30 +00:00
vfs_solarisacl.c vfs: restore platform specific POSIX sys_acl_set_file() functions 2021-01-28 15:21:02 +00:00
vfs_solarisacl.h
vfs_streams_depot.c s3/modules: stream_dir make sure mark_file_valid is called with fsp 2021-03-11 17:50:30 +00:00
vfs_streams_xattr.c s3/modules: streams_xattr_renameat SMB_VFS_SETXATTR -> SMB_VFS_FSETXATTR 2021-03-11 17:50:30 +00:00
vfs_syncops.c s3: VFS: syncops: Fix syncops_linkat() to cope with real directory fsps. 2021-02-09 00:10:29 +00:00
vfs_time_audit.c VFS: Remove SMB_VFS_SETXATTR, no longer used 2021-03-11 17:50:30 +00:00
vfs_tru64acl.c vfs: restore platform specific POSIX sys_acl_set_file() functions 2021-01-28 15:21:02 +00:00
vfs_tru64acl.h
vfs_tsmsm.c vfs: RIP SMB_VFS_GET_DOS_ATTRIBUTES() 2020-12-16 09:08:32 +00:00
vfs_unityed_media.c VFS: Remove SMB_VFS_SETXATTR, no longer used 2021-03-11 17:50:30 +00:00
vfs_virusfilter_clamav.c
vfs_virusfilter_common.h
vfs_virusfilter_fsav.c
vfs_virusfilter_sophos.c
vfs_virusfilter_utils.c Fix clang 9 format-nonliteral warnings 2020-05-08 09:31:31 +00:00
vfs_virusfilter_utils.h
vfs_virusfilter.c s3:modules:vfs_virusfilter: Recent talloc changes cause infinite start-up failure 2021-03-01 21:44:55 +00:00
vfs_vxfs.c VFS: Remove SMB_VFS_SETXATTR, no longer used 2021-03-11 17:50:30 +00:00
vfs_vxfs.h
vfs_widelinks.c vfs: Add dirfsp arg to SMB_VFS_READDIR() 2020-12-16 09:08:31 +00:00
vfs_worm.c vfs: remove dirfsp arg from SMB_VFS_CREATE_FILE() 2020-10-02 21:00:05 +00:00
vfs_xattr_tdb.c VFS: Remove SMB_VFS_SETXATTR, no longer used 2021-03-11 17:50:30 +00:00
vfs_zfsacl.c vfs: Fix the FreeBSD build 2021-01-25 12:16:11 +00:00
wscript_build s3:modules: Do not install vfs modules only used for testing 2020-10-23 14:09:43 +00:00

Configuring NFS4 ACLs in Samba3
===============================
Created: Peter Somogyi, 2006-JUN-06
Last modified: Alexander Werth, 2013-MAY-02
Revision no.: 4 
-------------------------------


Parameters in smb.conf:
=======================

Each parameter must have a prefix "nfs4:".
Each one affects the behaviour only when _setting_ an acl on a file/dir:

mode = [simple|special]
- simple: Use OWNER@ and GROUP@ special IDs for non inheriting ACEs only.
  This mode is the default.
- special: use OWNER@ and GROUP@ special IDs in ACEs instead of simple
  user&group ids. This mode is deprecated.

Note1: EVERYONE@ is always processed (if found such an ACE).
Note2: There is a side effect when _only_ chown is performed.
       Later this may be worked out.
Note3: Mode special inherits incorrect ACL entries when the user creating
       a file is different from the owner of the caurrent folder.
Note4: Mode simple uses inheriting OWNER@ and GROUP@ special IDs to
       support Creator Owner and Creator Group.

It's strongly advised to set "store dos attributes = yes" in smb.conf.

chown = [true|false]
- true => enable changing owner and group - default.
- false => disable support for changing owner or group

acedup = [dontcare|reject|ignore|merge]
- dontcare: copy ACEs as they come, don't care with "duplicate" records.
- reject: stop operation, exit acl setter operation with an error. (deprecated)
- ignore: don't include the second matching ACE. (deprecated)
- merge: OR 2 ace.flag fields and 2 ace.mask fields of the 2 duplicate ACEs into 1 ACE (default)

Two ACEs are considered here "duplicate" when their type and id fields are matching.

Example:

[smbtest]
path = /tests/psomogyi/smbtest
writable = yes
vfs objects = aixacl2
nfs4: mode = special
nfs4: chown = yes
nfs4: acedup = merge

Configuring AIX ACL support
==============================

Binaries: (default install path is [samba]/lib/vfs/)
- aixacl.so: provides AIXC ACL support only, can be compiled and works on all AIX platforms
- aixacl2.so: provides AIXC and JFS2-NFS4 ACL support, can be compiled and works only under AIX 5.3 and newer.
NFS4 acl currently has support only under JFS2 (ext. attr. format must be set to v2).
aixacl2.so always detects support for NFS4 acls and redirects to POSIX ACL handling automatically when NFS4 is not supported for a path.

Adding "vfs objects = aixacl2" to a share should be done only in case when NFS4 is really supported by the filesystem.
(Otherwise you may get performance loss.)

For configuration see also the example above.

General notes
=============

NFS4 handling logic is separated from AIX/jfs2 ACL parsing.

Samba and its VFS modules dosn't reorder ACEs. Windows clients do that (and the smbcacl tool). MSDN also says deny ACEs must come first.
NFS4 ACL's validity is checked by the system API, not by Samba.
NFS4 ACL rights are enforced by the OS or filesystem, not by Samba.

The flag INHERITED_ACE is never set (not required, as doesn't do WinNT/98/me, only since Win2k).
Win2k GUI behaves strangely when detecting inheritance (sometimes it doesn't detect, 
but after adding an ace it shows that - it's some GUI error).

Unknown (unmappable) SIDs are not accepted.

TODOs
=====
- Creator Owner & Group SID handling (same way as posix)
- the 4 generic rights bits support (GENERIC_RIGHT_READ_ACCESS, WRITE, EXEC, ALL)
- chown & no ACL, but we have ONWER@ and GROUP@
- DIALUP, ANONYMOUS, ... builtin SIDs
- audit & alarm support - in theory it's forwarded so it should work, but currently there's no platform which supports them to test
- support for a real NFS4 client (we don't have an accepted API yet)