1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-25 23:21:54 +03:00
samba-mirror/source3/modules
Ralph Boehme 93b7e05621 vfs_fruit: use ADEDOFF_RFORK_DOT_UND offset macro in ad_convert_move_reso()
We really want the fixed size offset here, not a calculated one. Note
that "ad_getentryoff(ad, ADEID_FINDERI) + ADEDLEN_FINDERI" is equal to
ADEDOFF_RFORK_DOT_UND.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13649

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2018-10-10 22:22:14 +02:00
..
developer.c
getdate.c s3:modules: Generate new getdate.c with bison 2018-04-03 20:20:11 +02:00
getdate.h
getdate.y s3:modules: Update getdate.y to work with newer bison versions 2018-04-03 20:20:11 +02:00
lib_vxfs.c pass 'rdonly' or 'directory' flag to open a directory file. 2018-07-11 02:22:18 +02:00
nfs4_acls.c nfs4acls: Slightly simplify smb_add_ace4 2017-10-22 17:46:15 +02:00
nfs4_acls.h nfs4acls: Fix SMB_ACE4_MAX_TYPE define 2016-10-11 02:17:10 +02:00
nfs4acl_xattr_ndr.c vfs_nfs4acl_xattr: add support for NFS 4.1 ACL flags in the NDR backend 2017-11-08 00:20:08 +01:00
nfs4acl_xattr_ndr.h vfs_nfs4acl_xattr: move the meat of the implementation to a seperate file 2017-11-08 00:20:08 +01:00
nfs4acl_xattr_xdr.c waf: Fix NFS quota support with libtirpc 2018-01-22 17:26:52 +01:00
nfs4acl_xattr_xdr.h vfs_nfs4acl_xattr: add XDR backend 2017-11-08 00:20:08 +01:00
nfs4acl_xattr.h vfs_nfs4acl_xattr: add a runtime configuration object 2017-11-08 00:20:08 +01:00
nfs41acl.x vfs_nfs4acl_xattr: add XDR backend 2017-11-08 00:20:08 +01:00
non_posix_acls.c s3: VFS: Change SMB_VFS_SYS_ACL_BLOB_GET_FILE to use const struct smb_filename * instead of const char *. 2017-05-31 22:50:22 +02:00
non_posix_acls.h s3: VFS: Change SMB_VFS_SYS_ACL_BLOB_GET_FILE to use const struct smb_filename * instead of const char *. 2017-05-31 22:50:22 +02:00
offload_token.c s3/vfs: make SMB_VFS_OFFLOAD_WRITE_SEND offload token based 2017-07-03 19:59:08 +02:00
offload_token.h s3/vfs: make SMB_VFS_OFFLOAD_WRITE_SEND offload token based 2017-07-03 19:59:08 +02:00
perfcount_test.c lib: modules: Change XXX_init interface from XXX_init(void) to XXX_init(TALLOC_CTX *) 2017-04-22 01:17:00 +02:00
posixacl_xattr.c s3:modules: Check correct variable for NULL in posixacl_xattr 2017-10-27 04:54:22 +02:00
posixacl_xattr.h s3: VFS: Change SMB_VFS_SYS_ACL_SET_FILE to use const struct smb_filename * instead of const char *. 2017-05-31 22:50:22 +02:00
README-gpfs-acl.txt
README.nfs4acls.txt
string_replace.c vfs_catia: factor out mapping functions 2017-10-13 17:40:07 +02:00
string_replace.h vfs_catia: factor out mapping functions 2017-10-13 17:40:07 +02:00
vfs_acl_common.c s3: VFS: Remove SMB_VFS_FCHMOD_ACL(). 2018-05-25 18:39:25 +02:00
vfs_acl_common.h s3: VFS: Remove SMB_VFS_FCHMOD_ACL(). 2018-05-25 18:39:25 +02:00
vfs_acl_tdb.c lib: Pass mem_ctx to state_path() 2018-08-17 11:30:11 +02:00
vfs_acl_xattr.c s3: VFS: Remove SMB_VFS_FCHMOD_ACL(). 2018-05-25 18:39:25 +02:00
vfs_afsacl.c vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_aio_fork.c s3: Rename server_event_context() to global_event_context() 2018-09-07 17:26:17 +02:00
vfs_aio_pthread.c vfs_aio_pthread: use event context and threadpool from user_vfs_evg 2018-07-25 17:49:07 +02:00
vfs_aixacl2.c s3:modules: fix the build of vfs_aixacl2.c 2018-04-03 20:18:58 +02:00
vfs_aixacl_util.c
vfs_aixacl_util.h
vfs_aixacl.c vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_audit.c vfs_audit: Extend list of recognized syslog(3) facilities and wrap them into #ifdef's. That list should be comprehensive enough to cover most of the existing OSes. 2018-07-11 08:44:10 +02:00
vfs_btrfs.c vfs_btrfs: make use of become_user_by_fsp() in order to switch between src and dst fsp 2018-06-18 08:59:18 +02:00
vfs_cacheprime.c s3: VFS: Remove SMB_VFS_READ() function and all implementations. 2018-05-04 22:34:25 +02:00
vfs_cap.c s3: vfs: add SMB_VFS_GETXATTRAT_SEND/RECV 2018-07-27 13:07:14 +02:00
vfs_catia.c smbd: use async dos_mode_at_send in smbd_smb2_query_directory_send() 2018-07-27 13:07:15 +02:00
vfs_ceph.c smbd: use async dos_mode_at_send in smbd_smb2_query_directory_send() 2018-07-27 13:07:15 +02:00
vfs_commit.c s3: VFS: Remove SMB_VFS_WRITE() function and all implementations. 2018-05-05 01:38:07 +02:00
vfs_crossrename.c vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_default_quota.c vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_default.c vfs_default: implement SMB_VFS_GET_DOS_ATTRIBUTES_SEND/RECV 2018-07-27 13:07:14 +02:00
vfs_delay_inject.c vfs_delay_inject: adding delay to VFS calls 2018-08-31 22:22:22 +02:00
vfs_dfs_samba4.c samdb: Add remote address to connect 2018-05-10 20:02:23 +02:00
vfs_dirsort.c s3: VFS: Change SMB_VFS_GETWD to return struct smb_filename * instead of char *. 2017-07-01 03:07:11 +02:00
vfs_error_inject.c vfs_error_inject: Add new module 2017-12-15 21:43:19 +01:00
vfs_expand_msdfs.c vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_extd_audit.c vfs_audit: Extend list of recognized syslog(3) facilities and wrap them into #ifdef's. That list should be comprehensive enough to cover most of the existing OSes. 2018-07-11 08:44:10 +02:00
vfs_fake_acls.c s3: vfs_fake_acls: Correctly implement the chmod/fchmod algorithm on fake acls. 2018-05-25 21:29:32 +02:00
vfs_fake_dfq.c s3: VFS: Change SMB_VFS_REALPATH to take and return struct smb_filename * instead of char *. 2017-07-01 03:07:11 +02:00
vfs_fake_perms.c vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_fileid.c vfs_fileid: Fix the 32-bit build 2018-01-21 07:08:23 +01:00
vfs_fruit.c vfs_fruit: use ADEDOFF_RFORK_DOT_UND offset macro in ad_convert_move_reso() 2018-10-10 22:22:14 +02:00
vfs_full_audit.c s3: VFS: vfs_full_audit: Ensure smb_fname_str_do_log() only returns absolute pathnames. 2018-08-27 20:23:55 +02:00
vfs_glusterfs.c smbd: use async dos_mode_at_send in smbd_smb2_query_directory_send() 2018-07-27 13:07:15 +02:00
vfs_gpfs.c vfs_gpfs: Check for GPFS file system on connect 2018-09-19 00:54:23 +02:00
vfs_hpuxacl.c vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_hpuxacl.h vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_linux_xfs_sgid.c s3: VFS: Remove SMB_VFS_CHMOD_ACL(). 2018-05-25 18:39:24 +02:00
vfs_media_harmony.c s3: vfs: add SMB_VFS_GETXATTRAT_SEND/RECV 2018-07-27 13:07:14 +02:00
vfs_netatalk.c s3:vfs_nettalk: Fix size types 2018-03-20 23:16:16 +01:00
vfs_nfs4acl_xattr.c vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_not_implemented.c s3: vfs: add SMB_VFS_GET_DOS_ATTRIBUTES_SEND/RECV 2018-07-27 13:07:14 +02:00
vfs_offline.c s3: vfs: add SMB_VFS_GET_DOS_ATTRIBUTES_SEND/RECV 2018-07-27 13:07:14 +02:00
vfs_posix_eadb.c s3: vfs: add SMB_VFS_GETXATTRAT_SEND/RECV 2018-07-27 13:07:14 +02:00
vfs_posixacl.c vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_posixacl.h s3: VFS: Change SMB_VFS_SYS_ACL_SET_FILE to use const struct smb_filename * instead of const char *. 2017-05-31 22:50:22 +02:00
vfs_prealloc.c vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_preopen.c s3: Rename server_event_context() to global_event_context() 2018-09-07 17:26:17 +02:00
vfs_readahead.c vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_readonly.c s3: vfs: add user_vfs_evg to connection_struct 2018-07-25 17:49:06 +02:00
vfs_recycle.c vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_shadow_copy2.c s3: vfs: add SMB_VFS_GETXATTRAT_SEND/RECV 2018-07-27 13:07:14 +02:00
vfs_shadow_copy.c vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_shell_snap.c vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_snapper.c s3: vfs: add SMB_VFS_GETXATTRAT_SEND/RECV 2018-07-27 13:07:14 +02:00
vfs_solarisacl.c vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_solarisacl.h vfs_solarisacl: fix build for samba 4.7 and up 2017-10-04 10:06:15 +02:00
vfs_streams_depot.c vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_streams_xattr.c streams_xattr: Make error handling more obvious 2018-09-14 07:49:14 +02:00
vfs_syncops.c s3: VFS: Change SMB_VFS_SYMLINK to use const struct smb_filename * instead of const char *. 2017-06-18 07:03:18 +02:00
vfs_time_audit.c s3: vfs: time_audit: fix handling of token_blob in smb_time_audit_offload_read_recv() 2018-08-13 19:46:08 +02:00
vfs_tru64acl.c vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_tru64acl.h s3: VFS: Change SMB_VFS_SYS_ACL_SET_FILE to use const struct smb_filename * instead of const char *. 2017-05-31 22:50:22 +02:00
vfs_tsmsm.c s3: vfs: add SMB_VFS_GET_DOS_ATTRIBUTES_SEND/RECV 2018-07-27 13:07:14 +02:00
vfs_unityed_media.c s3: vfs: add SMB_VFS_GETXATTRAT_SEND/RECV 2018-07-27 13:07:14 +02:00
vfs_virusfilter_clamav.c Samba-VirusFilter: clamav VFS and man page. 2018-01-24 15:08:59 +01:00
vfs_virusfilter_common.h Samba-VirusFilter: clamav VFS and man page. 2018-01-24 15:08:59 +01:00
vfs_virusfilter_fsav.c vfs_virusfilter_fsav: Initialize stack pointers per README.Coding 2018-05-03 13:42:11 +02:00
vfs_virusfilter_sophos.c s3:modules: Initialize pointers in vfs_virusfilter 2018-05-16 21:30:22 +02:00
vfs_virusfilter_utils.c s3:modules: make virusfilter_io_connect_path() more portable 2018-04-03 16:41:09 +02:00
vfs_virusfilter_utils.h Samba-VirusFilter: common headers and sources. 2018-01-24 10:29:46 +01:00
vfs_virusfilter.c s3:modules: fix the picky-developer build of vfs_virusfilter.c on FreeBSD 11 2018-04-03 16:41:09 +02:00
vfs_vxfs.c s3: vfs: add SMB_VFS_GETXATTRAT_SEND/RECV 2018-07-27 13:07:14 +02:00
vfs_vxfs.h pass 'rdonly' or 'directory' flag to open a directory file. 2018-07-11 02:22:18 +02:00
vfs_worm.c vfs: Use static_decl_vfs in all VFS modules 2017-12-18 13:31:59 +01:00
vfs_xattr_tdb.c lib: Pass mem_ctx to state_path() 2018-08-17 11:30:11 +02:00
vfs_zfsacl.c vfs_zfsacl: return synthesized ACL when ZFS return ENOTSUP 2018-05-18 22:03:21 +02:00
wscript_build build:wafsamba: Build on waf 1.9 2018-09-05 06:37:21 +02:00

Configuring NFS4 ACLs in Samba3
===============================
Created: Peter Somogyi, 2006-JUN-06
Last modified: Alexander Werth, 2013-MAY-02
Revision no.: 4 
-------------------------------


Parameters in smb.conf:
=======================

Each parameter must have a prefix "nfs4:".
Each one affects the behaviour only when _setting_ an acl on a file/dir:

mode = [simple|special]
- simple: Use OWNER@ and GROUP@ special IDs for non inheriting ACEs only.
  This mode is the default.
- special: use OWNER@ and GROUP@ special IDs in ACEs instead of simple
  user&group ids. This mode is deprecated.

Note1: EVERYONE@ is always processed (if found such an ACE).
Note2: There is a side effect when _only_ chown is performed.
       Later this may be worked out.
Note3: Mode special inherits incorrect ACL entries when the user creating
       a file is different from the owner of the caurrent folder.
Note4: Mode simple uses inheriting OWNER@ and GROUP@ special IDs to
       support Creator Owner and Creator Group.

It's strongly advised to set "store dos attributes = yes" in smb.conf.

chown = [true|false]
- true => enable changing owner and group - default.
- false => disable support for changing owner or group

acedup = [dontcare|reject|ignore|merge]
- dontcare: copy ACEs as they come, don't care with "duplicate" records. Default.
- reject: stop operation, exit acl setter operation with an error
- ignore: don't include the second matching ACE
- merge: OR 2 ace.flag fields and 2 ace.mask fields of the 2 duplicate ACEs into 1 ACE

Two ACEs are considered here "duplicate" when their type and id fields are matching.

Example:

[smbtest]
path = /tests/psomogyi/smbtest
writable = yes
vfs objects = aixacl2
nfs4: mode = special
nfs4: chown = yes
nfs4: acedup = merge

Configuring AIX ACL support
==============================

Binaries: (default install path is [samba]/lib/vfs/)
- aixacl.so: provides AIXC ACL support only, can be compiled and works on all AIX platforms
- aixacl2.so: provides AIXC and JFS2-NFS4 ACL support, can be compiled and works only under AIX 5.3 and newer.
NFS4 acl currently has support only under JFS2 (ext. attr. format must be set to v2).
aixacl2.so always detects support for NFS4 acls and redirects to POSIX ACL handling automatically when NFS4 is not supported for a path.

Adding "vfs objects = aixacl2" to a share should be done only in case when NFS4 is really supported by the filesystem.
(Otherwise you may get performance loss.)

For configuration see also the example above.

General notes
=============

NFS4 handling logic is separated from AIX/jfs2 ACL parsing.

Samba and its VFS modules dosn't reorder ACEs. Windows clients do that (and the smbcacl tool). MSDN also says deny ACEs must come first.
NFS4 ACL's validity is checked by the system API, not by Samba.
NFS4 ACL rights are enforced by the OS or filesystem, not by Samba.

The flag INHERITED_ACE is never set (not required, as doesn't do WinNT/98/me, only since Win2k).
Win2k GUI behaves strangely when detecting inheritance (sometimes it doesn't detect, 
but after adding an ace it shows that - it's some GUI error).

Unknown (unmappable) SIDs are not accepted.

TODOs
=====
- Creator Owner & Group SID handling (same way as posix)
- the 4 generic rights bits support (GENERIC_RIGHT_READ_ACCESS, WRITE, EXEC, ALL)
- chown & no ACL, but we have ONWER@ and GROUP@
- DIALUP, ANONYMOUS, ... builtin SIDs
- audit & alarm support - in theory it's forwarded so it should work, but currently there's no platform which supports them to test
- support for a real NFS4 client (we don't have an accepted API yet)