1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
samba-mirror/source3/modules
David Disseldorp 9d29f7ea17 vfs: add vfs_shell_snap module
The shell_snap VFS module plumbs into the snapshot (aka shadow-copy)
management paths used by Samba's File Server Remote VSS Protocol (FSRVP)
server.
The following shell callouts may be configured in smb.conf:

shell_snap: check path command
	- Called when an FSRVP client wishes to check whether a given
	  share supports snapshot create/delete requests.
	- The command is called with a single <share path> argument.
	- The command must return 0 if <share path> is capable of being
	  snapshotted.

shell_snap: create command
	- Called when an FSRVP client wishes to create a snapshot.
	- The command is called with a single <share path> argument.
	- The command must return 0 status if the snapshot was
	  successfully taken.
	- The command must output the path of the newly created snapshot
	  to stdout.

shell_snap: delete command
	- Called when an FSRVP client wishes to delete a snapshot.
	- The command is called with <base share path> and
	  <snapshot share path> arguments.
	- The command must return 0 status if the snapshot was
	  successfully removed.

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2015-03-31 18:40:25 +02:00
..
developer.c
getdate.c
getdate.h
getdate.y
nfs4_acls.c nfs4: Fix a confusing debug message 2015-02-09 12:25:06 +01:00
nfs4_acls.h vfs: Support NFS control flags in nfs4_acls.c. 2014-04-05 00:50:14 +02:00
non_posix_acls.c vfs: Convert non_posix_sys_acl_blob_get_file_helper to synthetic_smb_fname 2013-04-17 14:49:59 -07:00
non_posix_acls.h vfs: Add helper function for non posix ACL modules 2013-02-04 12:19:30 +01:00
perfcount_test.c perfcount: Fix CID 1035494 Out-of-bounds read 2015-03-05 18:28:44 +01:00
README-gpfs-acl.txt
README.nfs4acls.txt s3: Update README.nfs4acls.txt 2013-05-09 06:18:21 +02:00
vfs_acl_common.c s3:smbd: ignore dacls with MS NFS ACEs 2014-12-04 22:11:08 +01:00
vfs_acl_tdb.c dbwrap: add a dbwrap_flags argument to db_open() 2014-02-07 16:06:06 +01:00
vfs_acl_xattr.c
vfs_afsacl.c s3:vfs_afsacl fix compiler warnings 2014-06-04 22:34:51 +02:00
vfs_aio_fork.c aio_fork: Fix CID 1273291 Uninitialized scalar variable 2015-03-03 17:34:38 +01:00
vfs_aio_linux.c lib: Split out sys_[read|write] & friends 2014-12-07 00:12:07 +01:00
vfs_aio_posix.c lib: Split out sys_[read|write] & friends 2014-12-07 00:12:07 +01:00
vfs_aio_pthread.c s3:vfs:aio_pthread: use smbXsrv_connection for schedule_deferred_open_message_smb 2014-10-23 23:10:35 +02:00
vfs_aixacl2.c s3:modules/vfs_aixacl2 fix compile errors 2013-05-09 06:18:21 +02:00
vfs_aixacl_util.c
vfs_aixacl_util.h
vfs_aixacl.c
vfs_audit.c
vfs_btrfs.c vfs_btrfs: add snapshot create/delete calls 2015-03-31 18:40:25 +02:00
vfs_cacheprime.c vfs: Add missing include for sys_pread() in cacheprime module. 2014-12-08 16:54:51 +01:00
vfs_cap.c s3/vfs: remove unused SMB_VFS_DISK_FREE() small_query parameter 2015-02-17 05:37:20 +01:00
vfs_catia.c vfs_catia: Simplify init_mappings() 2015-02-26 21:22:30 +01:00
vfs_ceph.c vfs_ceph: remove cephwrap_init_stat_ex_from_stat() 2015-03-19 18:02:13 +01:00
vfs_commit.c smbd: Fix bug 9544, part 2 2013-01-15 00:55:51 +01:00
vfs_crossrename.c s3: VFS modules: Ignore EPERM errors on [f]chmod in crossrename module. 2014-07-08 07:49:37 +02:00
vfs_default_quota.c
vfs_default.c vfs: add snapshot create/delete hooks 2015-03-31 18:40:24 +02:00
vfs_dfs_samba4.c
vfs_dirsort.c s3: smbd: vfs_dirsort module. 2014-09-03 19:59:54 +02:00
vfs_expand_msdfs.c
vfs_extd_audit.c
vfs_fake_acls.c vfs: Convert fake_acls_sys_acl_delete_def_file to synthetic_smb_fname 2013-04-17 14:49:58 -07:00
vfs_fake_perms.c vfs_fake_perms: Fix bug 9775, segfault for "artificial" conn_structs 2013-04-10 00:12:06 +02:00
vfs_fileid.c
vfs_fruit.c vfs_fruit: enhance handling of malformed AppleDouble files 2015-03-26 12:39:01 +01:00
vfs_full_audit.c vfs: add snapshot create/delete hooks 2015-03-31 18:40:24 +02:00
vfs_glusterfs.c s3/vfs: change fallocate mode flags from enum->uint32_t 2015-03-09 21:27:07 +01:00
vfs_gpfs.c vfs_gpfs: Remove warning after failure of get_gpfs_fset_id 2015-03-30 11:04:15 +02:00
vfs_hpuxacl.c vfs: Convert hpuxacl_sys_acl_set_file to synthetic_smb_fname 2013-04-17 14:49:57 -07:00
vfs_hpuxacl.h
vfs_linux_xfs_sgid.c
vfs_media_harmony.c s3:vfs: add create tags to SMB_VFS_CREATEFILE 2014-12-04 22:11:07 +01:00
vfs_netatalk.c
vfs_nfs4acl_xattr.c vfs: Add inheritance emulation to vfs_nfs4acl_xattr. 2013-05-09 06:18:21 +02:00
vfs_notify_fam.c s3:modules: s/event_add_fd/tevent_add_fd and s/EVENT_FD_/TEVENT_FD_ 2013-02-19 23:48:00 +01:00
vfs_posix_eadb.c lib: Remove tdb_compat 2015-03-17 11:30:52 +01:00
vfs_posixacl.c vfs_posixacl: catch ACL_EVERYONE on FreeBSD 2014-10-12 00:22:19 +02:00
vfs_posixacl.h
vfs_prealloc.c vfs_prealloc: Remove call to gpfs_prealloc 2015-02-11 02:03:08 +01:00
vfs_preopen.c lib: Split out write_data[_iov] 2014-12-07 00:12:07 +01:00
vfs_readahead.c
vfs_readonly.c Add uint32_t share_access to vuid_cache_entry. 2013-01-09 15:28:48 +11:00
vfs_recycle.c vfs: Convert recycle_unlink to synthetic_smb_fname 2013-04-17 14:49:58 -07:00
vfs_scannedonly.c scannedonly: Fix CID 242109 Unchecked return value from library 2013-12-17 01:57:12 +01:00
vfs_shadow_copy2.c source3: Replace ccan hash calls with tdb_jenkins_hash 2015-03-17 11:30:52 +01:00
vfs_shadow_copy.c
vfs_shell_snap.c vfs: add vfs_shell_snap module 2015-03-31 18:40:25 +02:00
vfs_smb_traffic_analyzer.c lib: Split out write_data[_iov] 2014-12-07 00:12:07 +01:00
vfs_smb_traffic_analyzer.h
vfs_snapper.c vfs_snapper: create/delete snapshot support 2015-03-31 18:40:25 +02:00
vfs_solarisacl.c vfs: Fix compilation of solaris ACL module 2013-01-10 18:46:22 +11:00
vfs_solarisacl.h
vfs_streams_depot.c s3: modules: streaminfo: As we have no VFS function SMB_VFS_LLISTXATTR we can't cope with a symlink when lp_posix_pathnames() is true. 2014-02-08 00:01:16 +01:00
vfs_streams_xattr.c s3/vfs: change fallocate mode flags from enum->uint32_t 2015-03-09 21:27:07 +01:00
vfs_syncops.c
vfs_time_audit.c vfs: add snapshot create/delete hooks 2015-03-31 18:40:24 +02:00
vfs_tru64acl.c
vfs_tru64acl.h
vfs_tsmsm.c
vfs_unityed_media.c vfs_unityed_media: VFS module for sharing AVID projects 2015-01-10 04:15:04 +01:00
vfs_vxfs.c s3: vfs module: Adding new vfs module for Symantec VxFS. 2014-09-18 02:30:06 +02:00
vfs_worm.c s3:vfs: add create tags to SMB_VFS_CREATEFILE 2014-12-04 22:11:07 +01:00
vfs_xattr_tdb.c dbwrap: add a dbwrap_flags argument to db_open() 2014-02-07 16:06:06 +01:00
vfs_zfsacl.c vfs: Allow CREATOR GROUP to be used with vfs_zfsacl 2013-05-09 06:18:21 +02:00
wscript_build vfs: add vfs_shell_snap module 2015-03-31 18:40:25 +02:00

Configuring NFS4 ACLs in Samba3
===============================
Created: Peter Somogyi, 2006-JUN-06
Last modified: Alexander Werth, 2013-MAY-02
Revision no.: 4 
-------------------------------


Parameters in smb.conf:
=======================

Each parameter must have a prefix "nfs4:".
Each one affects the behaviour only when _setting_ an acl on a file/dir:

mode = [simple|special]
- simple: Use OWNER@ and GROUP@ special IDs for non inheriting ACEs only.
  This mode is the default.
- special: use OWNER@ and GROUP@ special IDs in ACEs instead of simple
  user&group ids. This mode is deprecated.

Note1: EVERYONE@ is always processed (if found such an ACE).
Note2: There is a side effect when _only_ chown is performed.
       Later this may be worked out.
Note3: Mode special inherits incorrect ACL entries when the user creating
       a file is different from the owner of the caurrent folder.
Note4: Mode simple uses inheriting OWNER@ and GROUP@ special IDs to
       support Creator Owner and Creator Group.

It's strongly advised to set "store dos attributes = yes" in smb.conf.

chown = [true|false]
- true => enable changing owner and group - default.
- false => disable support for changing owner or group

acedup = [dontcare|reject|ignore|merge]
- dontcare: copy ACEs as they come, don't care with "duplicate" records. Default.
- reject: stop operation, exit acl setter operation with an error
- ignore: don't include the second matching ACE
- merge: OR 2 ace.flag fields and 2 ace.mask fields of the 2 duplicate ACEs into 1 ACE

Two ACEs are considered here "duplicate" when their type and id fields are matching.

Example:

[smbtest]
path = /tests/psomogyi/smbtest
writable = yes
vfs objects = aixacl2
nfs4: mode = special
nfs4: chown = yes
nfs4: acedup = merge

Configuring AIX ACL support
==============================

Binaries: (default install path is [samba]/lib/vfs/)
- aixacl.so: provides AIXC ACL support only, can be compiled and works on all AIX platforms
- aixacl2.so: provides AIXC and JFS2-NFS4 ACL support, can be compiled and works only under AIX 5.3 and newer.
NFS4 acl currently has support only under JFS2 (ext. attr. format must be set to v2).
aixacl2.so always detects support for NFS4 acls and redirects to POSIX ACL handling automatically when NFS4 is not supported for a path.

Adding "vfs objects = aixacl2" to a share should be done only in case when NFS4 is really supported by the filesystem.
(Otherwise you may get performance loss.)

For configuration see also the example above.

General notes
=============

NFS4 handling logic is separated from AIX/jfs2 ACL parsing.

Samba and its VFS modules dosn't reorder ACEs. Windows clients do that (and the smbcacl tool). MSDN also says deny ACEs must come first.
NFS4 ACL's validity is checked by the system API, not by Samba.
NFS4 ACL rights are enforced by the OS or filesystem, not by Samba.

The flag INHERITED_ACE is never set (not required, as doesn't do WinNT/98/me, only since Win2k).
Win2k GUI behaves strangely when detecting inheritance (sometimes it doesn't detect, 
but after adding an ace it shows that - it's some GUI error).

Unknown (unmappable) SIDs are not accepted.

TODOs
=====
- Creator Owner & Group SID handling (same way as posix)
- the 4 generic rights bits support (GENERIC_RIGHT_READ_ACCESS, WRITE, EXEC, ALL)
- chown & no ACL, but we have ONWER@ and GROUP@
- DIALUP, ANONYMOUS, ... builtin SIDs
- audit & alarm support - in theory it's forwarded so it should work, but currently there's no platform which supports them to test
- support for a real NFS4 client (we don't have an accepted API yet)