| 1 | Configuring NFS4 ACLs in Samba3
|
|---|
| 2 | ===============================
|
|---|
| 3 | Created: Peter Somogyi, 2006-JUN-06
|
|---|
| 4 | Last modified: Peter Somogyi, 2006-JUL-20
|
|---|
| 5 | Revision no.: 4
|
|---|
| 6 | -------------------------------
|
|---|
| 7 |
|
|---|
| 8 |
|
|---|
| 9 | Parameters in smb.conf:
|
|---|
| 10 | =======================
|
|---|
| 11 |
|
|---|
| 12 | Each parameter must have a prefix "nfs4:".
|
|---|
| 13 | Each one affects the behaviour only when _setting_ an acl on a file/dir:
|
|---|
| 14 |
|
|---|
| 15 | mode = [simple|special]
|
|---|
| 16 | - simple: don't use OWNER@ and GROUP@ special IDs in ACEs. - default
|
|---|
| 17 | - special: use OWNER@ and GROUP@ special IDs in ACEs instead of simple user&group ids.
|
|---|
| 18 | Note: EVERYONE@ is always processed (if found such an ACE).
|
|---|
| 19 | Note2: special mode will have side effect when _only_ chown is performed. Later this may be worked out.
|
|---|
| 20 |
|
|---|
| 21 | Use "simple" mode when the share is used mainly by windows users and unix side is not significant. You will loose unix bits in this case.
|
|---|
| 22 | It's strongly advised setting "store dos attributes = yes" in smb.conf.
|
|---|
| 23 |
|
|---|
| 24 | chown = [true|false]
|
|---|
| 25 | - true => enable changing owner and group - default.
|
|---|
| 26 | - false => disable support for changing owner or group
|
|---|
| 27 |
|
|---|
| 28 | acedup = [dontcare|reject|ignore|merge]
|
|---|
| 29 | - dontcare: copy ACEs as they come, don't care with "duplicate" records. Default.
|
|---|
| 30 | - reject: stop operation, exit acl setter operation with an error
|
|---|
| 31 | - ignore: don't include the second matching ACE
|
|---|
| 32 | - merge: OR 2 ace.flag fields and 2 ace.mask fields of the 2 duplicate ACEs into 1 ACE
|
|---|
| 33 |
|
|---|
| 34 | Two ACEs are considered here "duplicate" when their type and id fields are matching.
|
|---|
| 35 |
|
|---|
| 36 | Example:
|
|---|
| 37 |
|
|---|
| 38 | [smbtest]
|
|---|
| 39 | path = /tests/psomogyi/smbtest
|
|---|
| 40 | writable = yes
|
|---|
| 41 | vfs objects = aixacl2
|
|---|
| 42 | nfs4: mode = special
|
|---|
| 43 | nfs4: chown = yes
|
|---|
| 44 | nfs4: acedup = merge
|
|---|
| 45 |
|
|---|
| 46 | Configuring AIX ACL support
|
|---|
| 47 | ==============================
|
|---|
| 48 |
|
|---|
| 49 | Binaries: (default install path is [samba]/lib/vfs/)
|
|---|
| 50 | - aixacl.so: provides AIXC ACL support only, can be compiled and works on all AIX platforms
|
|---|
| 51 | - aixacl2.so: provides AIXC and JFS2-NFS4 ACL support, can be compiled and works only under AIX 5.3 and newer.
|
|---|
| 52 | NFS4 acl currently has support only under JFS2 (ext. attr. format must be set to v2).
|
|---|
| 53 | aixacl2.so always detects support for NFS4 acls and redirects to POSIX ACL handling automatically when NFS4 is not supported for a path.
|
|---|
| 54 |
|
|---|
| 55 | Adding "vfs objects = aixacl2" to a share should be done only in case when NFS4 is really supported by the filesystem.
|
|---|
| 56 | (Otherwise you may get performance loss.)
|
|---|
| 57 |
|
|---|
| 58 | For configuration see also the example above.
|
|---|
| 59 |
|
|---|
| 60 | General notes
|
|---|
| 61 | =============
|
|---|
| 62 |
|
|---|
| 63 | NFS4 handling logic is separated from AIX/jfs2 ACL parsing.
|
|---|
| 64 |
|
|---|
| 65 | Samba and its VFS modules dosn't reorder ACEs. Windows clients do that (and the smbcacl tool). MSDN also says deny ACEs must come first.
|
|---|
| 66 | NFS4 ACL's validity is checked by the system API, not by Samba.
|
|---|
| 67 | NFS4 ACL rights are enforced by the OS or filesystem, not by Samba.
|
|---|
| 68 |
|
|---|
| 69 | The flag INHERITED_ACE is never set (not required, as doesn't do WinNT/98/me, only since Win2k).
|
|---|
| 70 | Win2k GUI behaves strangely when detecting inheritance (sometimes it doesn't detect,
|
|---|
| 71 | but after adding an ace it shows that - it's some GUI error).
|
|---|
| 72 |
|
|---|
| 73 | Unknown (unmappable) SIDs are not accepted.
|
|---|
| 74 |
|
|---|
| 75 | TODOs
|
|---|
| 76 | =====
|
|---|
| 77 | - Creator Owner & Group SID handling (same way as posix)
|
|---|
| 78 | - the 4 generic rights bits support (GENERIC_RIGHT_READ_ACCESS, WRITE, EXEC, ALL)
|
|---|
| 79 | - chown & no ACL, but we have ONWER@ and GROUP@
|
|---|
| 80 | - DIALUP, ANONYMOUS, ... builtin SIDs
|
|---|
| 81 | - audit & alarm support - in theory it's forwarded so it should work, but currently there's no platform which supports them to test
|
|---|
| 82 | - support for a real NFS4 client (we don't have an accepted API yet)
|
|---|
