1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-24 21:34:56 +03:00
samba-mirror/source3/modules
Andrew Walker c1a37b4f31 vfs_zfsacl: only grant DELETE_CHILD if ACL tag is special
When ZFS aclmode is set to "passthrough" chmod(2)/fchmod(2) will result
in special entries being modified in a way such that delete, delete_child,
write_named_attr, write_attribute are stripped from the returned ACL entry,
and the kernel / ZFS treats this as having rights equivalent to the desired
POSIX mode. Historically, samba has added delete_child to the NFSv4 ACL, but
this is only really called for in the case of special entries in this
particular circumstance.

Alter circumstances in which delete_child is granted so that it only
is added to special entries. This preserves the intend post-chmod behavior,
but avoids unnecessarily increasing permissions in cases where it's not
intended. Further modification of this behavior may be required so that
we grant a general read or general write permissions set in case of
POSIX read / POSIX write on special entries.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14471

Signed-off-by: Andrew Walker <awalker@ixsystems.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-10-15 19:07:40 +00:00
..
developer.c
getdate.c s3:modules: Use #ifdef instead of #if for config.h definitions 2018-11-28 23:19:23 +01:00
getdate.h
getdate.y s3:modules: Use #ifdef instead of #if for config.h definitions 2018-11-28 23:19:23 +01:00
hash_inode.c lib:crypto: Add GNUTLS_FIPS140_SET_(LAX|STRICT)_MODE to helpers 2019-07-09 12:16:11 +00:00
hash_inode.h s3:modules: Add hash_inode() function based on SHA1 2019-07-03 11:19:20 +00:00
lib_vxfs.c pass 'rdonly' or 'directory' flag to open a directory file. 2018-07-11 02:22:18 +02:00
nfs4_acls.c smbd: ignore set NTACL requests which contain S-1-5-88 NFS ACEs 2020-03-03 19:15:10 +00:00
nfs4_acls.h nfs4_acls: Remove unused SMB_ACLTYPE_ defines 2019-07-23 18:27:27 +00:00
nfs4acl_xattr_ndr.c
nfs4acl_xattr_ndr.h vfs: Fix the FreeBSD nfs4acl build 2019-08-06 21:49:28 +00:00
nfs4acl_xattr_nfs.c vfs: Fix the nfs4acl build on FreeBSD 2019-08-06 21:49:28 +00:00
nfs4acl_xattr_nfs.h vfs: Fix the FreeBSD nfs4acl build 2019-08-06 21:49:28 +00:00
nfs4acl_xattr_util.c nfs4acl_xattr: move some functions to a seperate file 2019-03-18 19:21:25 +00:00
nfs4acl_xattr_util.h nfs4acl_xattr: move some functions to a seperate file 2019-03-18 19:21:25 +00:00
nfs4acl_xattr_xdr.c nfs4acl: Align integer types 2020-01-14 19:17:28 +00:00
nfs4acl_xattr_xdr.h nfs4acl_xattr: move a define to a common header file 2019-03-18 19:21:25 +00:00
nfs4acl_xattr.h vfs_nfs4acl_xattr: support for NFS 4.0 and 4.1 ACLs from NFS4 mount 2019-03-18 19:21:25 +00:00
nfs41acl.x nfs4acl_xattr: add RFC compliant NFS 4.0 and 4.1 ACL defintions 2019-03-18 19:21:25 +00:00
non_posix_acls.c
non_posix_acls.h
offload_token.c smbd: move files_struct.closing to a bitfield 2020-04-03 19:05:44 +00:00
offload_token.h
perfcount_test.c
posixacl_xattr.c s3-vfs: Use ENOATTR in errno comparison for getxattr 2019-01-23 21:59:10 +01:00
posixacl_xattr.h
README-gpfs-acl.txt
README.nfs4acls.txt nfs4_acls: Change default of nfs4:acedup to "merge" 2019-07-23 18:27:28 +00:00
test_nfs4_acls.c nfs4_acls: Add test for merging duplicates when mapping from NFS4 ACL to DACL 2019-07-23 18:27:27 +00:00
test_vfs_full_audit.c s3: VFS: Add cmocka test for vfs_full_audit to make sure all arrays are correct. 2020-04-14 17:58:40 +00:00
test_vfs_gpfs.c test_vfs_gpfs: Add test for file id generation 2020-09-08 22:57:03 +00:00
test_vfs_posixacl.c test_vfs_posixacl: Add unit test for Linux POSIX ACL mapping 2020-07-17 17:12:34 +00:00
util_reparse.c vfs: Move reparse point functions to util_reparse.c 2020-06-15 19:25:39 +00:00
util_reparse.h vfs: Move reparse point functions to util_reparse.c 2020-06-15 19:25:39 +00:00
vfs_acl_common.c s3: VFS: acl_common: Change SMB_VFS_GET_NT_ACL() -> SMB_VFS_GET_NT_ACL_AT() in get_nt_acl_common_at(). 2020-05-07 19:27:36 +00:00
vfs_acl_common.h s3: VFS: vfs_common and callers. Change get_nt_acl_common() -> get_nt_acl_common_at(). 2020-05-07 19:27:34 +00:00
vfs_acl_tdb.c s3: VFS: acl_tdb. Remove get_nt_acl_fn(). 2020-05-07 19:27:36 +00:00
vfs_acl_xattr.c s3: VFS: acl_xattr. Remove get_nt_acl_fn(). 2020-05-07 19:27:37 +00:00
vfs_afsacl.c s3: safe_string: do not include string_wrappers.h 2020-08-28 00:56:34 +00:00
vfs_aio_fork.c s3: VFS: aio_fork: Change sys_pwrite() -> sys_pwrite_full() to protect against short writes. 2020-05-12 19:53:44 +00:00
vfs_aio_pthread.c vfs: remove SMB_VFS_OPEN() 2020-05-21 20:38:34 +00:00
vfs_aixacl2.c s3: VFS: aixacl2. Remove get_nt_acl_fn(). 2020-05-07 19:27:37 +00:00
vfs_aixacl_util.c
vfs_aixacl_util.h
vfs_aixacl.c
vfs_audit.c vfs: remove SMB_VFS_OPEN() 2020-05-21 20:38:34 +00:00
vfs_btrfs.c smbd: rename [un]become_user*() to [un]become_user_without_service*() 2019-09-11 19:59:34 +00:00
vfs_cacheprime.c s3: VFS: Remove SMB_VFS_READ() function and all implementations. 2018-05-04 22:34:25 +02:00
vfs_cap.c s3: VFS: cap. Ensure read_dfs_pathat() returns stat info. 2020-06-03 04:54:38 +00:00
vfs_catia.c s3: VFS: catia. Ensure read_dfs_pathat() returns stat info. 2020-06-03 04:54:38 +00:00
vfs_ceph_snapshots.c lib: relicense smb_strtoul(l) under LGPLv3 2020-08-03 22:21:02 +00:00
vfs_ceph.c Revert "vfs_ceph: drop fdopendir handler" 2020-10-05 12:38:34 +00:00
vfs_commit.c vfs: remove SMB_VFS_OPEN() 2020-05-21 20:38:34 +00:00
vfs_crossrename.c s3: VFS: vfs_crossrename. Remove rename_fn(). No longer used. 2019-08-16 19:52:36 +00:00
vfs_default_quota.c
vfs_default.c vfs: remove dirfsp arg from SMB_VFS_CREATE_FILE() 2020-10-02 21:00:05 +00:00
vfs_delay_inject.c vfs: Use file_id_str_buf() in vfs_delay_inject_brl_lock_timer() 2019-11-06 21:58:52 +00:00
vfs_dfs_samba4.c s3:param: make "servicename" a substituted option 2019-11-27 10:25:37 +00:00
vfs_dirsort.c vfs: remove SMB_VFS_OPENDIR() 2020-03-24 21:23:43 +00:00
vfs_error_inject.c vfs: remove SMB_VFS_OPEN() 2020-05-21 20:38:34 +00:00
vfs_expand_msdfs.c s3:param: make "servicename" a substituted option 2019-11-27 10:25:37 +00:00
vfs_extd_audit.c vfs: remove SMB_VFS_OPEN() 2020-05-21 20:38:34 +00:00
vfs_fake_acls.c s3: VFS: vfs_fake_acls: Remove chown_fn(). 2019-10-15 18:46:37 +00:00
vfs_fake_dfq.c s3: VFS: Add SMB_VFS_RENAMEAT(). 2019-08-16 19:52:32 +00:00
vfs_fake_perms.c
vfs_fileid.c smbd: add twrp arg to synthetic_smb_fname() 2020-05-05 19:18:40 +00:00
vfs_fruit.c vfs: remove dirfsp arg from SMB_VFS_CREATE_FILE() 2020-10-02 21:00:05 +00:00
vfs_full_audit.c vfs: remove dirfsp arg from SMB_VFS_CREATE_FILE() 2020-10-02 21:00:05 +00:00
vfs_glusterfs_fuse.c smbd: convert SMB_VFS_GET_REAL_FILENAME() arg path to be a struct smb_filename 2020-05-05 19:18:41 +00:00
vfs_glusterfs.c vfs_glusterfs: Enable caching of selinux xattr by default 2020-06-17 08:23:33 +00:00
vfs_gpfs.c vfs: remove SMB_VFS_OPEN() 2020-05-21 20:38:34 +00:00
vfs_hpuxacl.c
vfs_hpuxacl.h
vfs_io_uring.c vfs_io_uring: retry after a short writes in vfs_io_uring_pwrite_completion() 2020-05-12 19:53:46 +00:00
vfs_linux_xfs_sgid.c vfs_linux_xfs_sgid: use parent_smb_fname() 2020-04-29 16:39:39 +00:00
vfs_media_harmony.c vfs: remove dirfsp arg from SMB_VFS_CREATE_FILE() 2020-10-02 21:00:05 +00:00
vfs_nfs4acl_xattr.c s3: VFS: nfs4acl_xattr. Remove get_nt_acl_fn(). 2020-05-07 19:27:37 +00:00
vfs_not_implemented.c vfs: remove dirfsp arg from SMB_VFS_CREATE_FILE() 2020-10-02 21:00:05 +00:00
vfs_offline.c s3: vfs: add SMB_VFS_GET_DOS_ATTRIBUTES_SEND/RECV 2018-07-27 13:07:14 +02:00
vfs_posix_eadb.c s3: VFS: vfs_posix_eadb: Remove rmdir_fn(). No longer used. 2019-10-10 06:09:41 +00:00
vfs_posixacl.c vfs_posixacl: Remove unnecessary call to acl_set_permset 2020-07-17 18:33:41 +00:00
vfs_posixacl.h s3:VFS: Remove function declaration for vfs_posixacl_init 2020-09-12 06:29:37 +00:00
vfs_prealloc.c vfs: remove SMB_VFS_OPEN() 2020-05-21 20:38:34 +00:00
vfs_preopen.c lib: relicense smb_strtoul(l) under LGPLv3 2020-08-03 22:21:02 +00:00
vfs_readahead.c
vfs_readonly.c Revert "smbd: add an effective connection_struct->user_ev_ctx that holds the event context used for the current user" 2019-01-11 23:11:16 +01:00
vfs_recycle.c smbd: add twrp arg to synthetic_smb_fname() 2020-05-05 19:18:40 +00:00
vfs_shadow_copy2.c vfs_shadow_copy2: Avoid closing snapsdir twice 2020-10-14 10:08:24 +00:00
vfs_shadow_copy.c vfs_shadow_copy: Fix a log message 2020-06-21 15:00:34 +00:00
vfs_shell_snap.c
vfs_snapper.c lib: relicense smb_strtoul(l) under LGPLv3 2020-08-03 22:21:02 +00:00
vfs_solarisacl.c
vfs_solarisacl.h
vfs_streams_depot.c vfs: remove SMB_VFS_OPEN() 2020-05-21 20:38:34 +00:00
vfs_streams_xattr.c vfs: add and use vfs_fake_fd() 2020-10-02 19:39:43 +00:00
vfs_syncops.c vfs: remove SMB_VFS_OPEN() 2020-05-21 20:38:34 +00:00
vfs_time_audit.c vfs: remove dirfsp arg from SMB_VFS_CREATE_FILE() 2020-10-02 21:00:05 +00:00
vfs_tru64acl.c
vfs_tru64acl.h
vfs_tsmsm.c s3:vfs_tsmsm: make use of lp_parm_substituted_string() 2019-11-27 10:25:31 +00:00
vfs_unityed_media.c vfs: remove dirfsp arg from SMB_VFS_CREATE_FILE() 2020-10-02 21:00:05 +00:00
vfs_virusfilter_clamav.c s3: VFS: change connection_struct cwd_fname to cwd_fsp 2019-08-16 19:52:32 +00:00
vfs_virusfilter_common.h
vfs_virusfilter_fsav.c s3: VFS: change connection_struct cwd_fname to cwd_fsp 2019-08-16 19:52:32 +00:00
vfs_virusfilter_sophos.c s3: VFS: change connection_struct cwd_fname to cwd_fsp 2019-08-16 19:52:32 +00:00
vfs_virusfilter_utils.c Fix clang 9 format-nonliteral warnings 2020-05-08 09:31:31 +00:00
vfs_virusfilter_utils.h
vfs_virusfilter.c vfs: remove SMB_VFS_OPEN() 2020-05-21 20:38:34 +00:00
vfs_vxfs.c lib/util: remove extra safe_string.h file 2020-08-28 02:18:40 +00:00
vfs_vxfs.h pass 'rdonly' or 'directory' flag to open a directory file. 2018-07-11 02:22:18 +02:00
vfs_widelinks.c vfs: remove SMB_VFS_OPEN() 2020-05-21 20:38:34 +00:00
vfs_worm.c vfs: remove dirfsp arg from SMB_VFS_CREATE_FILE() 2020-10-02 21:00:05 +00:00
vfs_xattr_tdb.c vfs: Fix a typo 2020-10-02 21:30:33 +00:00
vfs_zfsacl.c vfs_zfsacl: only grant DELETE_CHILD if ACL tag is special 2020-10-15 19:07:40 +00:00
wscript_build selftest: Add unit test for vfs_gpfs 2020-09-08 21:35:41 +00:00

Configuring NFS4 ACLs in Samba3
===============================
Created: Peter Somogyi, 2006-JUN-06
Last modified: Alexander Werth, 2013-MAY-02
Revision no.: 4 
-------------------------------


Parameters in smb.conf:
=======================

Each parameter must have a prefix "nfs4:".
Each one affects the behaviour only when _setting_ an acl on a file/dir:

mode = [simple|special]
- simple: Use OWNER@ and GROUP@ special IDs for non inheriting ACEs only.
  This mode is the default.
- special: use OWNER@ and GROUP@ special IDs in ACEs instead of simple
  user&group ids. This mode is deprecated.

Note1: EVERYONE@ is always processed (if found such an ACE).
Note2: There is a side effect when _only_ chown is performed.
       Later this may be worked out.
Note3: Mode special inherits incorrect ACL entries when the user creating
       a file is different from the owner of the caurrent folder.
Note4: Mode simple uses inheriting OWNER@ and GROUP@ special IDs to
       support Creator Owner and Creator Group.

It's strongly advised to set "store dos attributes = yes" in smb.conf.

chown = [true|false]
- true => enable changing owner and group - default.
- false => disable support for changing owner or group

acedup = [dontcare|reject|ignore|merge]
- dontcare: copy ACEs as they come, don't care with "duplicate" records.
- reject: stop operation, exit acl setter operation with an error. (deprecated)
- ignore: don't include the second matching ACE. (deprecated)
- merge: OR 2 ace.flag fields and 2 ace.mask fields of the 2 duplicate ACEs into 1 ACE (default)

Two ACEs are considered here "duplicate" when their type and id fields are matching.

Example:

[smbtest]
path = /tests/psomogyi/smbtest
writable = yes
vfs objects = aixacl2
nfs4: mode = special
nfs4: chown = yes
nfs4: acedup = merge

Configuring AIX ACL support
==============================

Binaries: (default install path is [samba]/lib/vfs/)
- aixacl.so: provides AIXC ACL support only, can be compiled and works on all AIX platforms
- aixacl2.so: provides AIXC and JFS2-NFS4 ACL support, can be compiled and works only under AIX 5.3 and newer.
NFS4 acl currently has support only under JFS2 (ext. attr. format must be set to v2).
aixacl2.so always detects support for NFS4 acls and redirects to POSIX ACL handling automatically when NFS4 is not supported for a path.

Adding "vfs objects = aixacl2" to a share should be done only in case when NFS4 is really supported by the filesystem.
(Otherwise you may get performance loss.)

For configuration see also the example above.

General notes
=============

NFS4 handling logic is separated from AIX/jfs2 ACL parsing.

Samba and its VFS modules dosn't reorder ACEs. Windows clients do that (and the smbcacl tool). MSDN also says deny ACEs must come first.
NFS4 ACL's validity is checked by the system API, not by Samba.
NFS4 ACL rights are enforced by the OS or filesystem, not by Samba.

The flag INHERITED_ACE is never set (not required, as doesn't do WinNT/98/me, only since Win2k).
Win2k GUI behaves strangely when detecting inheritance (sometimes it doesn't detect, 
but after adding an ace it shows that - it's some GUI error).

Unknown (unmappable) SIDs are not accepted.

TODOs
=====
- Creator Owner & Group SID handling (same way as posix)
- the 4 generic rights bits support (GENERIC_RIGHT_READ_ACCESS, WRITE, EXEC, ALL)
- chown & no ACL, but we have ONWER@ and GROUP@
- DIALUP, ANONYMOUS, ... builtin SIDs
- audit & alarm support - in theory it's forwarded so it should work, but currently there's no platform which supports them to test
- support for a real NFS4 client (we don't have an accepted API yet)