1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-24 21:34:56 +03:00
samba-mirror/source3/modules
Björn Jacke 1aa281ecb0 s3: fix the hpux acl module
This was not adopted to the recent VFS acl structure changes.

Autobuild-User(master): Björn Jacke <bj@sernet.de>
Autobuild-Date(master): Fri Sep 14 12:23:23 CEST 2012 on sn-devel-104
2012-09-14 12:23:23 +02:00
..
developer.c lib/util/charset Use top level iconv.c in source3 2011-02-18 18:41:00 +11:00
getdate.c
getdate.h Introduce system MIT krb5 build with --with-system-mitkrb5 option. 2012-05-23 17:51:50 +03:00
getdate.y
gpfs.c s3:vfs_gpfs: Use directory not file to get fileset id 2012-08-29 18:58:33 +02:00
nfs4_acls.c s3-nfs4acls: Remove lookup_sid and sidmap from NFSv4 ACL mapping and check gid first 2012-08-11 01:17:36 +02:00
nfs4_acls.h nfs4_acls: pass ACE_FLAG_INHERITED_ACE up to the client 2011-05-30 17:42:27 +02:00
perfcount_test.c Revert making public of the samba-module library. 2011-12-03 08:36:30 +01:00
README-gpfs-acl.txt
README.nfs4acls.txt
vfs_acl_common.c smbd: Print ACL used to create hash in vfs_xattr_common 2012-09-11 18:19:53 +02:00
vfs_acl_tdb.c s3: Add a "lock_order" argument to db_open 2012-01-18 14:48:04 +01:00
vfs_acl_xattr.c Fix the overwriting of errno before use in a DEBUG statement and use the return value from store_acl_blob_fsp rather than ignoring it. 2012-05-16 03:43:40 +02:00
vfs_afsacl.c Correctly check for errors in strlower_m() returns. 2012-08-09 12:08:18 -07:00
vfs_aio_fork.c s3: Fix warnings in aio_fork.c 2012-09-01 03:33:21 +02:00
vfs_aio_linux.c s3: Add aio_fsync to the aio_linux module 2012-07-18 15:52:52 -07:00
vfs_aio_posix.c s3: Add aio_fsync to the aio_posix module 2012-07-18 15:51:43 -07:00
vfs_aio_pthread.c s3: Move the aio_pthread read/write functionality to vfs_default 2012-07-18 15:46:29 -07:00
vfs_aixacl2.c s3-smbd: Change allocation of smb_acl_t to talloc() 2012-08-15 11:44:43 +10:00
vfs_aixacl_util.c s3: fix the aix acl module 2012-09-14 10:42:17 +02:00
vfs_aixacl_util.h s3-vfs: Put vfs_aixacl_util.c helper functions into a header file 2012-08-14 02:16:11 +02:00
vfs_aixacl.c s3-vfs: Put vfs_aixacl_util.c helper functions into a header file 2012-08-14 02:16:11 +02:00
vfs_audit.c build: Remove SMB_STRUCT_DIR define 2012-04-05 02:39:09 +02:00
vfs_cacheprime.c build: Remove SMB_OFF_T, replace with off_t 2012-04-06 01:47:43 +02:00
vfs_cap.c s3-vfs: Remove unused lremovexattr call from VFS modules, system.c and configure 2012-04-05 13:39:01 +10:00
vfs_catia.c s3-vfs: Remove unused lremovexattr call from VFS modules, system.c and configure 2012-04-05 13:39:01 +10:00
vfs_commit.c build: Remove SMB_OFF_T, replace with off_t 2012-04-06 01:47:43 +02:00
vfs_crossrename.c build: Remove SMB_OFF_T, replace with off_t 2012-04-06 01:47:43 +02:00
vfs_default_quota.c vfs: Make function pointer names consistent. They all end in _fn 2011-12-12 04:58:40 +01:00
vfs_default.c s3:vfs_default: add basic support for durable handle request and reconnect 2012-09-08 19:48:20 +02:00
vfs_dfs_samba4.c loadparm: make the source3/ lp_ functions take an explicit TALLOC_CTX *. 2012-07-18 15:07:23 +09:30
vfs_dirsort.c vfs_dirsort: Remove unnecessary return; statement 2012-08-08 02:17:13 +02:00
vfs_expand_msdfs.c loadparm: make the source3/ lp_ functions take an explicit TALLOC_CTX *. 2012-07-18 15:07:23 +09:30
vfs_extd_audit.c build: Remove SMB_STRUCT_DIR define 2012-04-05 02:39:09 +02:00
vfs_fake_acls.c smbd: Add extra VFS hooks to get the posix ACL as a blob 2012-09-12 07:06:01 +02:00
vfs_fake_perms.c vfs: Make function pointer names consistent. They all end in _fn 2011-12-12 04:58:40 +01:00
vfs_fileid.c loadparm: make the source3/ lp_ functions take an explicit TALLOC_CTX *. 2012-07-18 15:07:23 +09:30
vfs_full_audit.c smbd: Add extra VFS hooks to get the posix ACL as a blob 2012-09-12 07:06:01 +02:00
vfs_gpfs.c s3:vfs_gpfs: Use directory not file to get fileset id 2012-08-29 18:58:33 +02:00
vfs_gpfs.h s3:vfs_gpfs: fix some compiler warnings 2012-03-22 20:14:34 +01:00
vfs_hpuxacl.c s3: fix the hpux acl module 2012-09-14 12:23:23 +02:00
vfs_hpuxacl.h
vfs_irixacl.c vfs: Make function pointer names consistent. They all end in _fn 2011-12-12 04:58:40 +01:00
vfs_irixacl.h
vfs_linux_xfs_sgid.c vfs: Make function pointer names consistent. They all end in _fn 2011-12-12 04:58:40 +01:00
vfs_media_harmony.c s3: Fix 64-bit warnings in vfs_media_harmony 2012-09-06 09:08:57 +02:00
vfs_netatalk.c In vfs modules, don't use 'conn->origpath' when we really mean 'conn->cwd'. 2012-09-12 23:45:22 +02:00
vfs_notify_fam.c s3: Pass filters explicitly through vfs notify watch 2012-03-26 17:45:43 +02:00
vfs_posix_eadb.c s3-vfs: Set errno in xattr emulation 2012-08-15 18:05:33 +02:00
vfs_posixacl.c smbd: Remove pre-allocation of ACL array in sys_acl_init() 2012-09-12 05:26:16 +02:00
vfs_posixacl.h
vfs_prealloc.c Check error returns on strnorm(). 2012-08-09 12:07:32 -07:00
vfs_preopen.c In vfs modules, don't use 'conn->origpath' when we really mean 'conn->cwd'. 2012-09-12 23:45:22 +02:00
vfs_readahead.c build: Remove SMB_OFF_T, replace with off_t 2012-04-06 01:47:43 +02:00
vfs_readonly.c s3-vfs: include smbd/smbd.h in vfs modules. 2011-03-30 01:13:08 +02:00
vfs_recycle.c loadparm: make the source3/ lp_ functions take an explicit TALLOC_CTX *. 2012-07-18 15:07:23 +09:30
vfs_scannedonly.c s3:vfs:scannedonly: fix use of non-existent word (existant) 2012-06-12 07:21:43 +02:00
vfs_shadow_copy2.c s3-vfs: Try to be consistent about localtime vs GMT handling in vfs_shadow_copy2 2012-08-28 15:47:37 +10:00
vfs_shadow_copy.c build: Remove SMB_STRUCT_DIR define 2012-04-05 02:39:09 +02:00
vfs_smb_traffic_analyzer.c In vfs modules, don't use 'conn->origpath' when we really mean 'conn->cwd'. 2012-09-12 23:45:22 +02:00
vfs_smb_traffic_analyzer.h Actually make use of the SMBTA_SUBRELEASE define in smb_traffic_analyzer.h. This will allow to introduce new features or fixes into the protocol after the 3.6.0 release. The client software is designed to take care for the subrelease number. 2011-05-24 21:23:22 +02:00
vfs_solarisacl.c s3: Fix the vfs_solarisacl module to compile. 2012-09-14 05:21:29 +02:00
vfs_solarisacl.h
vfs_streams_depot.c In vfs modules, don't use 'conn->origpath' when we really mean 'conn->cwd'. 2012-09-12 23:45:22 +02:00
vfs_streams_xattr.c Check error returns from strupper_m() (in all reasonable places). 2012-08-09 12:06:54 -07:00
vfs_syncops.c vfs: Make function pointer names consistent. They all end in _fn 2011-12-12 04:58:40 +01:00
vfs_time_audit.c smbd: Add extra VFS hooks to get the posix ACL as a blob 2012-09-12 07:06:01 +02:00
vfs_tru64acl.c s3: fix the tru64 acl module 2012-09-14 10:42:17 +02:00
vfs_tru64acl.h
vfs_tsmsm.c s3:vfs_tsmsm only send notifications when file was offline before 2012-08-17 20:05:30 +02:00
vfs_xattr_tdb.c s3-vfs: Remove extra calls to SMB_VFS_HANDLE_GET_DATA 2012-08-22 01:31:57 +02:00
vfs_zfsacl.c vfs: Make function pointer names consistent. They all end in _fn 2011-12-12 04:58:40 +01:00
wscript_build build: Remove unused deps from vfs modules 2012-09-05 03:34:08 +02:00

Configuring NFS4 ACLs in Samba3
===============================
Created: Peter Somogyi, 2006-JUN-06
Last modified: Peter Somogyi, 2006-JUL-20
Revision no.: 4 
-------------------------------


Parameters in smb.conf:
=======================

Each parameter must have a prefix "nfs4:".
Each one affects the behaviour only when _setting_ an acl on a file/dir:

mode = [simple|special]
- simple: don't use OWNER@ and GROUP@ special IDs in ACEs. - default
- special: use OWNER@ and GROUP@ special IDs in ACEs instead of simple user&group ids.
Note: EVERYONE@ is always processed (if found such an ACE).
Note2: special mode will have side effect when _only_ chown is performed. Later this may be worked out.

Use "simple" mode when the share is used mainly by windows users and unix side is not significant. You will loose unix bits in this case.
It's strongly advised setting "store dos attributes = yes" in smb.conf.

chown = [true|false]
- true => enable changing owner and group - default.
- false => disable support for changing owner or group

acedup = [dontcare|reject|ignore|merge]
- dontcare: copy ACEs as they come, don't care with "duplicate" records. Default.
- reject: stop operation, exit acl setter operation with an error
- ignore: don't include the second matching ACE
- merge: OR 2 ace.flag fields and 2 ace.mask fields of the 2 duplicate ACEs into 1 ACE

Two ACEs are considered here "duplicate" when their type and id fields are matching.

Example:

[smbtest]
path = /tests/psomogyi/smbtest
writable = yes
vfs objects = aixacl2
nfs4: mode = special
nfs4: chown = yes
nfs4: acedup = merge

Configuring AIX ACL support
==============================

Binaries: (default install path is [samba]/lib/vfs/)
- aixacl.so: provides AIXC ACL support only, can be compiled and works on all AIX platforms
- aixacl2.so: provides AIXC and JFS2-NFS4 ACL support, can be compiled and works only under AIX 5.3 and newer.
NFS4 acl currently has support only under JFS2 (ext. attr. format must be set to v2).
aixacl2.so always detects support for NFS4 acls and redirects to POSIX ACL handling automatically when NFS4 is not supported for a path.

Adding "vfs objects = aixacl2" to a share should be done only in case when NFS4 is really supported by the filesystem.
(Otherwise you may get performance loss.)

For configuration see also the example above.

General notes
=============

NFS4 handling logic is separated from AIX/jfs2 ACL parsing.

Samba and its VFS modules dosn't reorder ACEs. Windows clients do that (and the smbcacl tool). MSDN also says deny ACEs must come first.
NFS4 ACL's validity is checked by the system API, not by Samba.
NFS4 ACL rights are enforced by the OS or filesystem, not by Samba.

The flag INHERITED_ACE is never set (not required, as doesn't do WinNT/98/me, only since Win2k).
Win2k GUI behaves strangely when detecting inheritance (sometimes it doesn't detect, 
but after adding an ace it shows that - it's some GUI error).

Unknown (unmappable) SIDs are not accepted.

TODOs
=====
- Creator Owner & Group SID handling (same way as posix)
- the 4 generic rights bits support (GENERIC_RIGHT_READ_ACCESS, WRITE, EXEC, ALL)
- chown & no ACL, but we have ONWER@ and GROUP@
- DIALUP, ANONYMOUS, ... builtin SIDs
- audit & alarm support - in theory it's forwarded so it should work, but currently there's no platform which supports them to test
- support for a real NFS4 client (we don't have an accepted API yet)