1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-24 21:34:56 +03:00
samba-mirror/source3/modules
Ralph Boehme 909edd6e8a vfs_default: implement FSCTL_DUP_EXTENTS_TO_FILE with copy_reflink()
According to MS-FSA 2.1.5.9.4 FSCTL_DUPLICATE_EXTENTS_TO_FILE ReFS on Windows
does not check for byte range lock conflicts:

 * The object store SHOULD<81> check for byte range lock conflicts ...

 * <81>: The ReFS file system in Windows Server 2016 and later does not check
 for byte range lock conflicts

To match Windows behaviour we also don't check for conflicts.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
2024-08-20 05:41:32 +00:00
..
getdate.c s3:modules: Fix code spelling 2023-07-17 11:46:29 +00:00
getdate.h
getdate.y s3:modules: Fix code spelling 2023-07-17 11:46:29 +00:00
hash_inode.c
hash_inode.h
lib_vxfs.c Cleanup and bug fixes in vxfs vfs code. 2022-09-02 17:40:00 +00:00
nfs4_acls.c Revert "nfs4_acls.c: prefer capabilities over become_root" 2024-03-27 09:40:34 +00:00
nfs4_acls.h nfs4_acls: Make fstat_with_cap_dac_override static 2023-11-15 18:54:11 +00:00
nfs4acl_xattr_ndr.c
nfs4acl_xattr_ndr.h
nfs4acl_xattr_nfs.c s3:modules: Add missing newlines to logging messages 2023-08-08 04:39:38 +00:00
nfs4acl_xattr_nfs.h
nfs4acl_xattr_util.c vfs: fix the build of nfs4acl_xattr_ without rpc/xdr.h support 2022-11-25 06:07:32 +00:00
nfs4acl_xattr_util.h
nfs4acl_xattr_xdr.c s3:modules: Add missing newlines to logging messages 2023-08-08 04:39:38 +00:00
nfs4acl_xattr_xdr.h
nfs4acl_xattr.h
nfs41acl.x s3:modules: Fix code spelling 2023-07-17 11:46:29 +00:00
non_posix_acls.c
non_posix_acls.h
offload_token.c smbd: replace CHECK_WRITE() macro with calls to check_any_access_fsp() 2024-01-08 15:53:36 +00:00
offload_token.h vfs: add and use a few SMB_VFS_ODX defines 2021-10-08 20:21:21 +00:00
posixacl_xattr.c s3:mod:posixacl_xattr: use NUMERIC_CMP in posixacl_xattr_entry_compare 2024-04-23 01:33:29 +00:00
posixacl_xattr.h
README-gpfs-acl.txt
README.nfs4acls.txt s3:modules: Fix code spelling 2023-07-17 11:46:29 +00:00
test_nfs4_acls.c s3:modules: Fix code spelling 2023-07-17 11:46:29 +00:00
test_vfs_full_audit.c
test_vfs_gpfs.c smbd: remove itime and file_id logic and code 2022-03-31 23:01:37 +00:00
test_vfs_posixacl.c
The_New_VFS.org s3:modules: Fix code spelling 2023-07-17 11:46:29 +00:00
The_New_VFS.txt s3:modules: Fix code spelling 2023-07-17 11:46:29 +00:00
util_reparse.c smbd: Show blk and chr devices as nfs reparse points 2024-07-12 21:36:16 +00:00
util_reparse.h smbd: Add fsctl_get_reparse_tag() helper function 2024-05-14 22:29:36 +00:00
vfs_acl_common.c Revert "vfs_acl_common.c: prefer capabilities over become_root" 2024-03-27 09:40:34 +00:00
vfs_acl_common.h vfs_acl_xattr: add acl_xattr:security_acl_name option 2022-06-27 15:50:29 +00:00
vfs_acl_tdb.c lib: Convert push_file_id_16 to take uint8_t instead of char 2024-04-30 22:44:32 +00:00
vfs_acl_xattr.c Revert "vfs_acl_xattr.c: prefer capabilities over become_root" 2024-01-26 10:26:30 +00:00
vfs_afsacl.c s3:modules: Add missing newlines to logging messages 2023-08-08 04:39:38 +00:00
vfs_aio_fork.c
vfs_aio_pthread.c vfs_aio_pthread: use SMB_VFS_NEXT_OPENAT() in aio_pthread_openat_fn() 2023-08-22 17:44:00 +00:00
vfs_aixacl2.c vfs_aixacl2: Call stat DAC_CAP_OVERRIDE functions 2023-11-15 18:54:11 +00:00
vfs_aixacl_util.c vfs: Fix whitespace in vfs_aixacl_util.c 2023-02-13 21:23:43 +00:00
vfs_aixacl_util.h
vfs_aixacl.c
vfs_aixacl.h vfs_aixacl: add proper header file 2022-02-18 22:17:33 +00:00
vfs_audit.c vfs: change openat propotype to match linux openat2 2022-08-06 01:43:50 +00:00
vfs_btrfs.c vfs_default: implement FSCTL_DUP_EXTENTS_TO_FILE with copy_reflink() 2024-08-20 05:41:32 +00:00
vfs_cacheprime.c
vfs_cap.c vfs: Remove "sbuf" from readdir_fn() 2023-06-23 18:29:40 +00:00
vfs_catia.c vfs: change openat propotype to match linux openat2 2022-08-06 01:43:50 +00:00
vfs_ceph_new.c vfs_ceph_new: use 'ceph_new' for config-param prefix 2024-08-08 12:34:37 +00:00
vfs_ceph_snapshots.c smbd: Give source3/smbd/dir.c its own header file 2023-12-19 16:05:36 +00:00
vfs_ceph.c smbd: consolidate fs capabilities code in vfswrap_fs_capabilities() 2024-08-20 05:41:32 +00:00
vfs_commit.c s3:modules: Fix code spelling 2023-07-17 11:46:29 +00:00
vfs_crossrename.c s3: smbd: Add src_dirfsp and dst_dirfsp parameters to copy_internals(). 2022-08-02 19:49:32 +00:00
vfs_default_quota.c
vfs_default.c vfs_default: implement FSCTL_DUP_EXTENTS_TO_FILE with copy_reflink() 2024-08-20 05:41:32 +00:00
vfs_delay_inject.c
vfs_dfs_samba4.c vfs: Fix a copy&paste error 2022-08-26 18:54:37 +00:00
vfs_dirsort.c vfs: Remove "sbuf" from readdir_fn() 2023-06-23 18:29:40 +00:00
vfs_error_inject.c error_inject: Reduce indentation with an early return 2023-07-03 19:40:35 +00:00
vfs_expand_msdfs.c s3:modules: Fix code spelling 2023-07-17 11:46:29 +00:00
vfs_extd_audit.c s3:modules: Add missing newlines to logging messages 2023-08-08 04:39:38 +00:00
vfs_fake_acls.c vfs: xattr calls give EBADF for sockets 2024-07-12 20:35:34 +00:00
vfs_fake_dfq.c
vfs_fake_perms.c
vfs_fileid.c s3:vfs_fileid: add 'fileid:nolock_all_inodes = BOOL' 2022-07-05 15:09:35 +00:00
vfs_fruit.c vfs: Fix a DBG message 2024-08-06 16:29:33 +00:00
vfs_full_audit.c vfs: Remove "sbuf" from readdir_fn() 2023-06-23 18:29:40 +00:00
vfs_glusterfs_fuse.c s3:modules: Add missing newlines to logging messages 2023-08-08 04:39:38 +00:00
vfs_glusterfs.c smbd: consolidate fs capabilities code in vfswrap_fs_capabilities() 2024-08-20 05:41:32 +00:00
vfs_gpfs.c vfs_gpfs: Move vfs_gpfs_fstatat to nfs4_acls.c and rename function 2023-11-15 18:54:11 +00:00
vfs_hpuxacl.c s3:modules: Fix code spelling 2023-07-17 11:46:29 +00:00
vfs_hpuxacl.h
vfs_io_uring.c s4:modules: Move structs with dynamic arrays to end of struct 2023-02-06 22:51:31 +00:00
vfs_linux_xfs_sgid.c
vfs_media_harmony.c vfs: Remove "sbuf" from readdir_fn() 2023-06-23 18:29:40 +00:00
vfs_nfs4acl_xattr.c smbd: use check_any_access_fsp() for all access checks 2024-01-08 15:53:36 +00:00
vfs_not_implemented.c vfs: Remove "sbuf" from readdir_fn() 2023-06-23 18:29:40 +00:00
vfs_offline.c
vfs_posix_eadb.c Revert "vfs_posix_eadb.c: prefer capabilities over become_root" 2024-03-27 09:40:34 +00:00
vfs_posixacl.c vfs: Fix typos 2024-06-28 13:26:24 +00:00
vfs_posixacl.h
vfs_prealloc.c vfs: change openat propotype to match linux openat2 2022-08-06 01:43:50 +00:00
vfs_preopen.c s3:modules: Make nread a size_t and check for possible overflow 2024-07-16 11:41:33 +00:00
vfs_readahead.c
vfs_readonly.c
vfs_recycle.c vfs_recycle: remember resolved config->repository in vfs_recycle_connect() 2024-06-19 09:07:36 +00:00
vfs_shadow_copy2.c vfs: Fix a typo 2024-03-12 13:31:31 +00:00
vfs_shadow_copy.c smbd: Give source3/smbd/dir.c its own header file 2023-12-19 16:05:36 +00:00
vfs_shell_snap.c lib: Give lib/util/util_file.c its own header file 2024-04-16 23:51:45 +00:00
vfs_snapper.c s3:modules: Fix code spelling 2023-07-17 11:46:29 +00:00
vfs_solarisacl.c s3: VFS: solarisacl: Fix compile error (missed variable rename). 2021-08-06 17:19:57 +00:00
vfs_solarisacl.h acl: fix function arguments for AIX' and Solaris' sys_acl_get_fd() 2022-02-18 22:17:33 +00:00
vfs_streams_depot.c lib: Convert push_file_id_16 to take uint8_t instead of char 2024-04-30 22:44:32 +00:00
vfs_streams_xattr.c streams_xattr: Avoid a talloc_strdup 2022-09-19 17:23:31 +00:00
vfs_syncops.c smbd: Give source3/smbd/dir.c its own header file 2023-12-19 16:05:36 +00:00
vfs_time_audit.c vfs: Remove "sbuf" from readdir_fn() 2023-06-23 18:29:40 +00:00
vfs_tsmsm.c s3:modules: Add missing newlines to logging messages 2023-08-08 04:39:38 +00:00
vfs_unityed_media.c s3:vfs: Add missing space in debug message 2023-08-08 04:39:38 +00:00
vfs_virusfilter_clamav.c
vfs_virusfilter_common.h s3/lib: remove name_compare_entry typedef 2024-07-26 10:06:30 +00:00
vfs_virusfilter_dummy.c s3:modules: Implement dummy virus scanner that uses filename matching 2022-02-10 21:14:32 +00:00
vfs_virusfilter_fsav.c s3:modules: Correct escape sequence 2023-08-08 04:39:38 +00:00
vfs_virusfilter_sophos.c
vfs_virusfilter_utils.c s3:modules: Fix code spelling 2023-07-17 11:46:29 +00:00
vfs_virusfilter_utils.h
vfs_virusfilter.c lib: Remove "token" parameter from set_namearray 2024-07-31 08:39:29 +00:00
vfs_vxfs.c s3:mod:vfs_vxfs: use NUMERIC_CMP in vxfs_ace_cmp 2024-04-23 01:33:29 +00:00
vfs_vxfs.h Cleanup and bug fixes in vxfs vfs code. 2022-09-02 17:40:00 +00:00
vfs_widelinks.c s3: vfs_widelinks: Allow case insensitivity to work on DFS widelinks shares. 2024-06-11 17:00:38 +00:00
vfs_worm.c vfs_worm: add FILE_WRITE_EA to write access mask 2024-01-16 14:37:31 +00:00
vfs_xattr_tdb.c vfs: Simplify xattr_tdb_mkdirat() 2022-09-19 17:23:31 +00:00
vfs_zfsacl.c vfs_zfsacl: Call stat CAP_DAC_OVERRIDE functions 2023-11-15 19:55:07 +00:00
wscript_build vfs_ceph_new: next iteration of samba-to-cephfs bridge 2024-07-29 14:51:36 +00:00

Configuring NFS4 ACLs in Samba3
===============================
Created: Peter Somogyi, 2006-JUN-06
Last modified: Alexander Werth, 2013-MAY-02
Revision no.: 4
-------------------------------


Parameters in smb.conf:
=======================

Each parameter must have a prefix "nfs4:".
Each one affects the behaviour only when _setting_ an acl on a file/dir:

mode = [simple|special]
- simple: Use OWNER@ and GROUP@ special IDs for non inheriting ACEs only.
  This mode is the default.
- special: use OWNER@ and GROUP@ special IDs in ACEs instead of simple
  user&group ids. This mode is deprecated.

Note1: EVERYONE@ is always processed (if found such an ACE).
Note2: There is a side effect when _only_ chown is performed.
       Later this may be worked out.
Note3: Mode special inherits incorrect ACL entries when the user creating
       a file is different from the owner of the caurrent folder.
Note4: Mode simple uses inheriting OWNER@ and GROUP@ special IDs to
       support Creator Owner and Creator Group.

It's strongly advised to set "store dos attributes = yes" in smb.conf.

chown = [true|false]
- true => enable changing owner and group - default.
- false => disable support for changing owner or group

acedup = [dontcare|reject|ignore|merge]
- dontcare: copy ACEs as they come, don't care with "duplicate" records.
- reject: stop operation, exit acl setter operation with an error. (deprecated)
- ignore: don't include the second matching ACE. (deprecated)
- merge: OR 2 ace.flag fields and 2 ace.mask fields of the 2 duplicate ACEs into 1 ACE (default)

Two ACEs are considered here "duplicate" when their type and id fields are matching.

Example:

[smbtest]
path = /tests/psomogyi/smbtest
writable = yes
vfs objects = aixacl2
nfs4: mode = special
nfs4: chown = yes
nfs4: acedup = merge

Configuring AIX ACL support
==============================

Binaries: (default install path is [samba]/lib/vfs/)
- aixacl.so: provides AIXC ACL support only, can be compiled and works on all AIX platforms
- aixacl2.so: provides AIXC and JFS2-NFS4 ACL support, can be compiled and works only under AIX 5.3 and newer.
NFS4 acl currently has support only under JFS2 (ext. attr. format must be set to v2).
aixacl2.so always detects support for NFS4 acls and redirects to POSIX ACL handling automatically when NFS4 is not supported for a path.

Adding "vfs objects = aixacl2" to a share should be done only in case when NFS4 is really supported by the filesystem.
(Otherwise you may get performance loss.)

For configuration see also the example above.

General notes
=============

NFS4 handling logic is separated from AIX/jfs2 ACL parsing.

Samba and its VFS modules don't reorder ACEs. Windows clients do that (and the smbcacl tool). MSDN also says deny ACEs must come first.
NFS4 ACL's validity is checked by the system API, not by Samba.
NFS4 ACL rights are enforced by the OS or filesystem, not by Samba.

The flag INHERITED_ACE is never set (not required, as doesn't do WinNT/98/me, only since Win2k).
Win2k GUI behaves strangely when detecting inheritance (sometimes it doesn't detect,
but after adding an ace it shows that - it's some GUI error).

Unknown (unmappable) SIDs are not accepted.

TODOs
=====
- Creator Owner & Group SID handling (same way as posix)
- the 4 generic rights bits support (GENERIC_RIGHT_READ_ACCESS, WRITE, EXEC, ALL)
- chown & no ACL, but we have OWNER@ and GROUP@
- DIALUP, ANONYMOUS, ... builtin SIDs
- audit & alarm support - in theory it's forwarded so it should work, but currently there's no platform which supports them to test
- support for a real NFS4 client (we don't have an accepted API yet)