1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
samba-mirror/source3/modules
Volker Lendecke 37b3667f65 error_inject: Enable returning EROFS for O_CREAT
Bug: https://bugzilla.samba.org/show_bug.cgi?id=15402
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2023-06-26 15:53:36 +00:00
..
getdate.c
getdate.h
getdate.y
hash_inode.c
hash_inode.h
lib_vxfs.c Cleanup and bug fixes in vxfs vfs code. 2022-09-02 17:40:00 +00:00
nfs4_acls.c nfs4_acl: Add comment for setting ACL as root 2022-12-02 08:02:13 +00:00
nfs4_acls.h
nfs4acl_xattr_ndr.c
nfs4acl_xattr_ndr.h
nfs4acl_xattr_nfs.c vfs: fix the build of nfs4acl_xattr_ without rpc/xdr.h support 2022-11-25 06:07:32 +00:00
nfs4acl_xattr_nfs.h
nfs4acl_xattr_util.c vfs: fix the build of nfs4acl_xattr_ without rpc/xdr.h support 2022-11-25 06:07:32 +00:00
nfs4acl_xattr_util.h
nfs4acl_xattr_xdr.c
nfs4acl_xattr_xdr.h
nfs4acl_xattr.h
nfs41acl.x
non_posix_acls.c s3: VFS: non_posix_acls: Remove non_posix_sys_acl_blob_get_file_helper(). No longer used. 2021-06-09 13:14:31 +00:00
non_posix_acls.h s3: VFS: non_posix_acls: Remove non_posix_sys_acl_blob_get_file_helper(). No longer used. 2021-06-09 13:14:31 +00:00
offload_token.c vfs: add and use a few SMB_VFS_ODX defines 2021-10-08 20:21:21 +00:00
offload_token.h vfs: add and use a few SMB_VFS_ODX defines 2021-10-08 20:21:21 +00:00
posixacl_xattr.c s3: VFS: posixacl_xattr: Remove posixacl_xattr_acl_set_file(). No longer used. 2021-06-23 09:56:00 +00:00
posixacl_xattr.h s3: VFS: posixacl_xattr: Remove posixacl_xattr_acl_set_file(). No longer used. 2021-06-23 09:56:00 +00:00
README-gpfs-acl.txt
README.nfs4acls.txt
test_nfs4_acls.c
test_vfs_full_audit.c
test_vfs_gpfs.c smbd: remove itime and file_id logic and code 2022-03-31 23:01:37 +00:00
test_vfs_posixacl.c
The_New_VFS.org vfs: Remove vfs telldir/seekdir functions 2023-06-14 00:26:55 +00:00
The_New_VFS.txt vfs: Remove vfs telldir/seekdir functions 2023-06-14 00:26:55 +00:00
util_reparse.c smbd: Implement SET_REPARSE_POINT buffer size checks 2022-12-22 19:50:34 +00:00
util_reparse.h smbd: Rename "ctx" to the more common "mem_ctx" in reparse functions 2022-12-22 19:50:34 +00:00
vfs_acl_common.c smbd: Don't set security_descriptor_hash_v4->time 2023-06-21 07:11:56 +00:00
vfs_acl_common.h vfs_acl_xattr: add acl_xattr:security_acl_name option 2022-06-27 15:50:29 +00:00
vfs_acl_tdb.c s3: VFS: acl_tdb: Remove unused get_acl_blob_at(). 2021-06-09 13:14:31 +00:00
vfs_acl_xattr.c vfs_acl_xattr: add acl_xattr:security_acl_name option 2022-06-27 15:50:29 +00:00
vfs_afsacl.c s3: VFS: afsacl: Remove afsacl_sys_acl_blob_get_file(). 2021-06-09 13:14:31 +00:00
vfs_aio_fork.c
vfs_aio_pthread.c vfs_aio_pthread: don't crash without a pthreadpool 2023-06-21 23:24:37 +00:00
vfs_aixacl2.c s3: VFS: aixaxcl2: Remove aixjfs2_sys_acl_blob_get_file(). 2021-06-09 13:14:31 +00:00
vfs_aixacl_util.c vfs: Fix whitespace in vfs_aixacl_util.c 2023-02-13 21:23:43 +00:00
vfs_aixacl_util.h
vfs_aixacl.c s3: VFS: aixacl: Remove aixacl_sys_acl_set_file(). 2021-06-09 13:14:31 +00:00
vfs_aixacl.h vfs_aixacl: add proper header file 2022-02-18 22:17:33 +00:00
vfs_audit.c vfs: change openat propotype to match linux openat2 2022-08-06 01:43:50 +00:00
vfs_btrfs.c vfs_btrfs: fix include order, includes.h or replace.h should be first 2022-08-15 15:03:36 +00:00
vfs_cacheprime.c
vfs_cap.c vfs: Remove "sbuf" from readdir_fn() 2023-06-23 18:29:40 +00:00
vfs_catia.c vfs: change openat propotype to match linux openat2 2022-08-06 01:43:50 +00:00
vfs_ceph_snapshots.c smbd: Remove unused "sbuf" argument from ReadDirName() 2023-06-23 17:34:30 +00:00
vfs_ceph.c vfs: Remove "sbuf" from readdir_fn() 2023-06-23 18:29:40 +00:00
vfs_commit.c vfs: change openat propotype to match linux openat2 2022-08-06 01:43:50 +00:00
vfs_crossrename.c s3: smbd: Add src_dirfsp and dst_dirfsp parameters to copy_internals(). 2022-08-02 19:49:32 +00:00
vfs_default_quota.c
vfs_default.c vfs: Remove "sbuf" from readdir_fn() 2023-06-23 18:29:40 +00:00
vfs_delay_inject.c s3: VFS: delay_inject: Remove SMB_VFS_NTIMES() 2021-04-19 12:28:30 +00:00
vfs_dfs_samba4.c vfs: Fix a copy&paste error 2022-08-26 18:54:37 +00:00
vfs_dirsort.c vfs: Remove "sbuf" from readdir_fn() 2023-06-23 18:29:40 +00:00
vfs_error_inject.c error_inject: Enable returning EROFS for O_CREAT 2023-06-26 15:53:36 +00:00
vfs_expand_msdfs.c source3: move lib/substitute.c functions out of proto.h 2021-11-11 13:49:32 +00:00
vfs_extd_audit.c vfs: change openat propotype to match linux openat2 2022-08-06 01:43:50 +00:00
vfs_fake_acls.c smbd: Introduce metadata_fsp() 2022-02-11 20:54:37 +00:00
vfs_fake_dfq.c
vfs_fake_perms.c
vfs_fileid.c s3:vfs_fileid: add 'fileid:nolock_all_inodes = BOOL' 2022-07-05 15:09:35 +00:00
vfs_fruit.c smbd: Remove unused "sbuf" argument from ReadDirName() 2023-06-23 17:34:30 +00:00
vfs_full_audit.c vfs: Remove "sbuf" from readdir_fn() 2023-06-23 18:29:40 +00:00
vfs_glusterfs_fuse.c vfs: Remove name-based SMB_VFS_GET_REAL_FILENAME() 2022-04-28 13:12:33 +00:00
vfs_glusterfs.c vfs: Remove "sbuf" from readdir_fn() 2023-06-23 18:29:40 +00:00
vfs_gpfs.c vfs_gpfs: Move call to load GPFS library 2023-06-25 16:06:37 +00:00
vfs_hpuxacl.c s3: VFS: hpuxacl: Fix the funtion signature for hpuxacl_sys_acl_set_fd() 2021-06-09 13:14:31 +00:00
vfs_hpuxacl.h s3: VFS: hpuxacl: Remove hpuxacl_sys_acl_delete_def_file(). 2021-05-18 17:29:34 +00:00
vfs_io_uring.c s4:modules: Move structs with dynamic arrays to end of struct 2023-02-06 22:51:31 +00:00
vfs_linux_xfs_sgid.c s3: VFS: linux_xfs_sgid. parent_smb_fname() -> SMB_VFS_PARENT_PATHNAME(). 2021-06-02 05:39:30 +00:00
vfs_media_harmony.c vfs: Remove "sbuf" from readdir_fn() 2023-06-23 18:29:40 +00:00
vfs_nfs4acl_xattr.c s3: VFS: nfs4acl_xattr: Remove call to nfs4acl_xattr_fail__sys_acl_blob_get_file(). 2021-06-09 13:14:31 +00:00
vfs_not_implemented.c vfs: Remove "sbuf" from readdir_fn() 2023-06-23 18:29:40 +00:00
vfs_offline.c
vfs_posix_eadb.c s3: VFS: posix_eadb: Remove posix_eadb_getxattr. 2021-07-04 17:15:35 +00:00
vfs_posixacl.c s3: VFS: posixacl: Remove posixacl_sys_acl_set_file(). 2021-06-09 13:14:31 +00:00
vfs_posixacl.h s3: VFS: posixacl: Remove posixacl_sys_acl_set_file(). 2021-06-09 13:14:31 +00:00
vfs_prealloc.c vfs: change openat propotype to match linux openat2 2022-08-06 01:43:50 +00:00
vfs_preopen.c vfs: change openat propotype to match linux openat2 2022-08-06 01:43:50 +00:00
vfs_readahead.c
vfs_readonly.c
vfs_recycle.c source3: move lib/substitute.c functions out of proto.h 2021-11-11 13:49:32 +00:00
vfs_shadow_copy2.c vfs: Remove "sbuf" from readdir_fn() 2023-06-23 18:29:40 +00:00
vfs_shadow_copy.c vfs: Remove "sbuf" from readdir_fn() 2023-06-23 18:29:40 +00:00
vfs_shell_snap.c
vfs_snapper.c vfs: change openat propotype to match linux openat2 2022-08-06 01:43:50 +00:00
vfs_solarisacl.c s3: VFS: solarisacl: Fix compile error (missed variable rename). 2021-08-06 17:19:57 +00:00
vfs_solarisacl.h acl: fix function arguments for AIX' and Solaris' sys_acl_get_fd() 2022-02-18 22:17:33 +00:00
vfs_streams_depot.c smbd: Remove unused "sbuf" argument from ReadDirName() 2023-06-23 17:34:30 +00:00
vfs_streams_xattr.c streams_xattr: Avoid a talloc_strdup 2022-09-19 17:23:31 +00:00
vfs_syncops.c vfs: change openat propotype to match linux openat2 2022-08-06 01:43:50 +00:00
vfs_time_audit.c vfs: Remove "sbuf" from readdir_fn() 2023-06-23 18:29:40 +00:00
vfs_tsmsm.c VFS: Remove SMB_VFS_SET_DOS_ATTRIBUTE, no longer used 2021-04-08 18:38:40 +00:00
vfs_unityed_media.c vfs: Remove "sbuf" from readdir_fn() 2023-06-23 18:29:40 +00:00
vfs_virusfilter_clamav.c
vfs_virusfilter_common.h smbd: Remove a few "extern userdom_struct current_user_info" 2022-12-12 22:14:20 +00:00
vfs_virusfilter_dummy.c s3:modules: Implement dummy virus scanner that uses filename matching 2022-02-10 21:14:32 +00:00
vfs_virusfilter_fsav.c
vfs_virusfilter_sophos.c
vfs_virusfilter_utils.c lib: Add get_current_user_info_domain() 2022-12-12 21:16:33 +00:00
vfs_virusfilter_utils.h
vfs_virusfilter.c vfs: change openat propotype to match linux openat2 2022-08-06 01:43:50 +00:00
vfs_vxfs.c Cleanup and bug fixes in vxfs vfs code. 2022-09-02 17:40:00 +00:00
vfs_vxfs.h Cleanup and bug fixes in vxfs vfs code. 2022-09-02 17:40:00 +00:00
vfs_widelinks.c vfs: Remove "sbuf" from readdir_fn() 2023-06-23 18:29:40 +00:00
vfs_worm.c Revert "vfs: remove dirfsp arg from SMB_VFS_CREATE_FILE()" 2022-04-28 13:12:33 +00:00
vfs_xattr_tdb.c vfs: Simplify xattr_tdb_mkdirat() 2022-09-19 17:23:31 +00:00
vfs_zfsacl.c vfs_zfsacl: fix mixed declaration and code error 2022-12-09 23:11:38 +00:00
wscript_build modules: Remove perfcount_test module 2023-06-05 17:17:35 +00:00

Configuring NFS4 ACLs in Samba3
===============================
Created: Peter Somogyi, 2006-JUN-06
Last modified: Alexander Werth, 2013-MAY-02
Revision no.: 4 
-------------------------------


Parameters in smb.conf:
=======================

Each parameter must have a prefix "nfs4:".
Each one affects the behaviour only when _setting_ an acl on a file/dir:

mode = [simple|special]
- simple: Use OWNER@ and GROUP@ special IDs for non inheriting ACEs only.
  This mode is the default.
- special: use OWNER@ and GROUP@ special IDs in ACEs instead of simple
  user&group ids. This mode is deprecated.

Note1: EVERYONE@ is always processed (if found such an ACE).
Note2: There is a side effect when _only_ chown is performed.
       Later this may be worked out.
Note3: Mode special inherits incorrect ACL entries when the user creating
       a file is different from the owner of the caurrent folder.
Note4: Mode simple uses inheriting OWNER@ and GROUP@ special IDs to
       support Creator Owner and Creator Group.

It's strongly advised to set "store dos attributes = yes" in smb.conf.

chown = [true|false]
- true => enable changing owner and group - default.
- false => disable support for changing owner or group

acedup = [dontcare|reject|ignore|merge]
- dontcare: copy ACEs as they come, don't care with "duplicate" records.
- reject: stop operation, exit acl setter operation with an error. (deprecated)
- ignore: don't include the second matching ACE. (deprecated)
- merge: OR 2 ace.flag fields and 2 ace.mask fields of the 2 duplicate ACEs into 1 ACE (default)

Two ACEs are considered here "duplicate" when their type and id fields are matching.

Example:

[smbtest]
path = /tests/psomogyi/smbtest
writable = yes
vfs objects = aixacl2
nfs4: mode = special
nfs4: chown = yes
nfs4: acedup = merge

Configuring AIX ACL support
==============================

Binaries: (default install path is [samba]/lib/vfs/)
- aixacl.so: provides AIXC ACL support only, can be compiled and works on all AIX platforms
- aixacl2.so: provides AIXC and JFS2-NFS4 ACL support, can be compiled and works only under AIX 5.3 and newer.
NFS4 acl currently has support only under JFS2 (ext. attr. format must be set to v2).
aixacl2.so always detects support for NFS4 acls and redirects to POSIX ACL handling automatically when NFS4 is not supported for a path.

Adding "vfs objects = aixacl2" to a share should be done only in case when NFS4 is really supported by the filesystem.
(Otherwise you may get performance loss.)

For configuration see also the example above.

General notes
=============

NFS4 handling logic is separated from AIX/jfs2 ACL parsing.

Samba and its VFS modules dosn't reorder ACEs. Windows clients do that (and the smbcacl tool). MSDN also says deny ACEs must come first.
NFS4 ACL's validity is checked by the system API, not by Samba.
NFS4 ACL rights are enforced by the OS or filesystem, not by Samba.

The flag INHERITED_ACE is never set (not required, as doesn't do WinNT/98/me, only since Win2k).
Win2k GUI behaves strangely when detecting inheritance (sometimes it doesn't detect, 
but after adding an ace it shows that - it's some GUI error).

Unknown (unmappable) SIDs are not accepted.

TODOs
=====
- Creator Owner & Group SID handling (same way as posix)
- the 4 generic rights bits support (GENERIC_RIGHT_READ_ACCESS, WRITE, EXEC, ALL)
- chown & no ACL, but we have ONWER@ and GROUP@
- DIALUP, ANONYMOUS, ... builtin SIDs
- audit & alarm support - in theory it's forwarded so it should work, but currently there's no platform which supports them to test
- support for a real NFS4 client (we don't have an accepted API yet)