| 1 | '\" t
|
|---|
| 2 | .\" Title: vfs_zfsacl
|
|---|
| 3 | .\" Author: [see the "AUTHOR" section]
|
|---|
| 4 | .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
|
|---|
| 5 | .\" Date: 10/25/2016
|
|---|
| 6 | .\" Manual: System Administration tools
|
|---|
| 7 | .\" Source: Samba 4.4
|
|---|
| 8 | .\" Language: English
|
|---|
| 9 | .\"
|
|---|
| 10 | .TH "VFS_ZFSACL" "8" "10/25/2016" "Samba 4\&.4" "System Administration tools"
|
|---|
| 11 | .\" -----------------------------------------------------------------
|
|---|
| 12 | .\" * Define some portability stuff
|
|---|
| 13 | .\" -----------------------------------------------------------------
|
|---|
| 14 | .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|---|
| 15 | .\" http://bugs.debian.org/507673
|
|---|
| 16 | .\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
|
|---|
| 17 | .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|---|
| 18 | .ie \n(.g .ds Aq \(aq
|
|---|
| 19 | .el .ds Aq '
|
|---|
| 20 | .\" -----------------------------------------------------------------
|
|---|
| 21 | .\" * set default formatting
|
|---|
| 22 | .\" -----------------------------------------------------------------
|
|---|
| 23 | .\" disable hyphenation
|
|---|
| 24 | .nh
|
|---|
| 25 | .\" disable justification (adjust text to left margin only)
|
|---|
| 26 | .ad l
|
|---|
| 27 | .\" -----------------------------------------------------------------
|
|---|
| 28 | .\" * MAIN CONTENT STARTS HERE *
|
|---|
| 29 | .\" -----------------------------------------------------------------
|
|---|
| 30 | .SH "NAME"
|
|---|
| 31 | vfs_zfsacl \- ZFS ACL samba module
|
|---|
| 32 | .SH "SYNOPSIS"
|
|---|
| 33 | .HP \w'\ 'u
|
|---|
| 34 | vfs objects = zfsacl
|
|---|
| 35 | .SH "DESCRIPTION"
|
|---|
| 36 | .PP
|
|---|
| 37 | This VFS module is part of the
|
|---|
| 38 | \fBsamba\fR(7)
|
|---|
| 39 | suite\&.
|
|---|
| 40 | .PP
|
|---|
| 41 | The
|
|---|
| 42 | zfsacl
|
|---|
| 43 | VFS module is the home for all ACL extensions that Samba requires for proper integration with ZFS\&.
|
|---|
| 44 | .PP
|
|---|
| 45 | Currently the zfsacl vfs module provides extensions in following areas :
|
|---|
| 46 | .sp
|
|---|
| 47 | .RS 4
|
|---|
| 48 | .ie n \{\
|
|---|
| 49 | \h'-04'\(bu\h'+03'\c
|
|---|
| 50 | .\}
|
|---|
| 51 | .el \{\
|
|---|
| 52 | .sp -1
|
|---|
| 53 | .IP \(bu 2.3
|
|---|
| 54 | .\}
|
|---|
| 55 | NFSv4 ACL Interfaces with configurable options for ZFS
|
|---|
| 56 | .RE
|
|---|
| 57 | .sp
|
|---|
| 58 | .RE
|
|---|
| 59 | .PP
|
|---|
| 60 | NOTE:This module follows the posix\-acl behaviour and hence allows permission stealing via chown\&. Samba might allow at a later point in time, to restrict the chown via this module as such restrictions are the responsibility of the underlying filesystem than of Samba\&.
|
|---|
| 61 | .PP
|
|---|
| 62 | This module makes use of the smb\&.conf parameter
|
|---|
| 63 | \m[blue]\fBacl map full control = acl map full control\fR\m[]
|
|---|
| 64 | When set to yes (the default), this parameter will add in the FILE_DELETE_CHILD bit on a returned ACE entry for a file (not a directory) that already contains all file permissions except for FILE_DELETE and FILE_DELETE_CHILD\&. This can prevent Windows applications that request GENERIC_ALL access from getting ACCESS_DENIED errors when running against a filesystem with NFSv4 compatible ACLs\&.
|
|---|
| 65 | .PP
|
|---|
| 66 | This module is stackable\&.
|
|---|
| 67 | .PP
|
|---|
| 68 | Since Samba 4\&.0 all options are per share options\&.
|
|---|
| 69 | .SH "OPTIONS"
|
|---|
| 70 | .PP
|
|---|
| 71 | nfs4:mode = [ simple | special ]
|
|---|
| 72 | .RS 4
|
|---|
| 73 | Controls substitution of special IDs (OWNER@ and GROUP@) on ZFS\&. The use of mode simple is recommended\&. In this mode only non inheriting ACL entries for the file owner and group are mapped to special IDs\&.
|
|---|
| 74 | .sp
|
|---|
| 75 | The following MODEs are understood by the module:
|
|---|
| 76 | .sp
|
|---|
| 77 | .RS 4
|
|---|
| 78 | .ie n \{\
|
|---|
| 79 | \h'-04'\(bu\h'+03'\c
|
|---|
| 80 | .\}
|
|---|
| 81 | .el \{\
|
|---|
| 82 | .sp -1
|
|---|
| 83 | .IP \(bu 2.3
|
|---|
| 84 | .\}
|
|---|
| 85 | simple(default)
|
|---|
| 86 | \- use OWNER@ and GROUP@ special IDs for non inheriting ACEs only\&.
|
|---|
| 87 | .RE
|
|---|
| 88 | .sp
|
|---|
| 89 | .RS 4
|
|---|
| 90 | .ie n \{\
|
|---|
| 91 | \h'-04'\(bu\h'+03'\c
|
|---|
| 92 | .\}
|
|---|
| 93 | .el \{\
|
|---|
| 94 | .sp -1
|
|---|
| 95 | .IP \(bu 2.3
|
|---|
| 96 | .\}
|
|---|
| 97 | special(deprecated)
|
|---|
| 98 | \- use OWNER@ and GROUP@ special IDs in ACEs for all file owner and group ACEs\&.
|
|---|
| 99 | .RE
|
|---|
| 100 | .sp
|
|---|
| 101 | .RE
|
|---|
| 102 | .RE
|
|---|
| 103 | .PP
|
|---|
| 104 | nfs4:acedup = [dontcare|reject|ignore|merge]
|
|---|
| 105 | .RS 4
|
|---|
| 106 | This parameter configures how Samba handles duplicate ACEs encountered in ZFS ACLs\&. ZFS allows/creates duplicate ACE for different bits for same ID\&.
|
|---|
| 107 | .sp
|
|---|
| 108 | Following is the behaviour of Samba for different values :
|
|---|
| 109 | .sp
|
|---|
| 110 | .RS 4
|
|---|
| 111 | .ie n \{\
|
|---|
| 112 | \h'-04'\(bu\h'+03'\c
|
|---|
| 113 | .\}
|
|---|
| 114 | .el \{\
|
|---|
| 115 | .sp -1
|
|---|
| 116 | .IP \(bu 2.3
|
|---|
| 117 | .\}
|
|---|
| 118 | dontcare (default)
|
|---|
| 119 | \- copy the ACEs as they come
|
|---|
| 120 | .RE
|
|---|
| 121 | .sp
|
|---|
| 122 | .RS 4
|
|---|
| 123 | .ie n \{\
|
|---|
| 124 | \h'-04'\(bu\h'+03'\c
|
|---|
| 125 | .\}
|
|---|
| 126 | .el \{\
|
|---|
| 127 | .sp -1
|
|---|
| 128 | .IP \(bu 2.3
|
|---|
| 129 | .\}
|
|---|
| 130 | reject
|
|---|
| 131 | \- stop operation and exit with error on ACL set op
|
|---|
| 132 | .RE
|
|---|
| 133 | .sp
|
|---|
| 134 | .RS 4
|
|---|
| 135 | .ie n \{\
|
|---|
| 136 | \h'-04'\(bu\h'+03'\c
|
|---|
| 137 | .\}
|
|---|
| 138 | .el \{\
|
|---|
| 139 | .sp -1
|
|---|
| 140 | .IP \(bu 2.3
|
|---|
| 141 | .\}
|
|---|
| 142 | ignore
|
|---|
| 143 | \- don\*(Aqt include the second matching ACE
|
|---|
| 144 | .RE
|
|---|
| 145 | .sp
|
|---|
| 146 | .RS 4
|
|---|
| 147 | .ie n \{\
|
|---|
| 148 | \h'-04'\(bu\h'+03'\c
|
|---|
| 149 | .\}
|
|---|
| 150 | .el \{\
|
|---|
| 151 | .sp -1
|
|---|
| 152 | .IP \(bu 2.3
|
|---|
| 153 | .\}
|
|---|
| 154 | merge
|
|---|
| 155 | \- bitwise OR the 2 ace\&.flag fields and 2 ace\&.mask fields of the 2 duplicate ACEs into 1 ACE
|
|---|
| 156 | .RE
|
|---|
| 157 | .sp
|
|---|
| 158 | .RE
|
|---|
| 159 | .RE
|
|---|
| 160 | .PP
|
|---|
| 161 | nfs4:chown = [yes|no]
|
|---|
| 162 | .RS 4
|
|---|
| 163 | This parameter allows enabling or disabling the chown supported by the underlying filesystem\&. This parameter should be enabled with care as it might leave your system insecure\&.
|
|---|
| 164 | .sp
|
|---|
| 165 | Some filesystems allow chown as a) giving b) stealing\&. It is the latter that is considered a risk\&.
|
|---|
| 166 | .sp
|
|---|
| 167 | Following is the behaviour of Samba for different values :
|
|---|
| 168 | .sp
|
|---|
| 169 | .RS 4
|
|---|
| 170 | .ie n \{\
|
|---|
| 171 | \h'-04'\(bu\h'+03'\c
|
|---|
| 172 | .\}
|
|---|
| 173 | .el \{\
|
|---|
| 174 | .sp -1
|
|---|
| 175 | .IP \(bu 2.3
|
|---|
| 176 | .\}
|
|---|
| 177 | yes
|
|---|
| 178 | \- Enable chown if as supported by the under filesystem
|
|---|
| 179 | .RE
|
|---|
| 180 | .sp
|
|---|
| 181 | .RS 4
|
|---|
| 182 | .ie n \{\
|
|---|
| 183 | \h'-04'\(bu\h'+03'\c
|
|---|
| 184 | .\}
|
|---|
| 185 | .el \{\
|
|---|
| 186 | .sp -1
|
|---|
| 187 | .IP \(bu 2.3
|
|---|
| 188 | .\}
|
|---|
| 189 | no (default)
|
|---|
| 190 | \- Disable chown
|
|---|
| 191 | .RE
|
|---|
| 192 | .sp
|
|---|
| 193 | .RE
|
|---|
| 194 | .RE
|
|---|
| 195 | .SH "EXAMPLES"
|
|---|
| 196 | .PP
|
|---|
| 197 | A ZFS mount can be exported via Samba as follows :
|
|---|
| 198 | .sp
|
|---|
| 199 | .if n \{\
|
|---|
| 200 | .RS 4
|
|---|
| 201 | .\}
|
|---|
| 202 | .nf
|
|---|
| 203 | \fI[samba_zfs_share]\fR
|
|---|
| 204 | \m[blue]\fBvfs objects = zfsacl\fR\m[]
|
|---|
| 205 | \m[blue]\fBpath = /test/zfs_mount\fR\m[]
|
|---|
| 206 | \m[blue]\fBnfs4: mode = special\fR\m[]
|
|---|
| 207 | \m[blue]\fBnfs4: acedup = merge\fR\m[]
|
|---|
| 208 | .fi
|
|---|
| 209 | .if n \{\
|
|---|
| 210 | .RE
|
|---|
| 211 | .\}
|
|---|
| 212 | .SH "VERSION"
|
|---|
| 213 | .PP
|
|---|
| 214 | This man page is correct for version 4\&.0\&.x of the Samba suite\&.
|
|---|
| 215 | .SH "AUTHOR"
|
|---|
| 216 | .PP
|
|---|
| 217 | The original Samba software and related utilities were created by Andrew Tridgell\&. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed\&.
|
|---|
