Changeset 745 for trunk/server/source4/ntvfs/posix

Timestamp:

Nov 27, 2012, 4:43:17 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated trunk to 3.6.0

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source4/ntvfs/posix/config.m4 (deleted)
• source4/ntvfs/posix/config.mk (deleted)
• source4/ntvfs/posix/pvfs_acl.c (modified) (23 diffs)
• source4/ntvfs/posix/pvfs_acl_nfs4.c (modified) (9 diffs)
• source4/ntvfs/posix/pvfs_acl_xattr.c (modified) (2 diffs)
• source4/ntvfs/posix/pvfs_fileinfo.c (modified) (1 diff)
• source4/ntvfs/posix/pvfs_fsinfo.c (modified) (1 diff)
• source4/ntvfs/posix/pvfs_lock.c (modified) (1 diff)
• source4/ntvfs/posix/pvfs_mkdir.c (modified) (6 diffs)
• source4/ntvfs/posix/pvfs_notify.c (modified) (1 diff)
• source4/ntvfs/posix/pvfs_open.c (modified) (35 diffs)
• source4/ntvfs/posix/pvfs_qfileinfo.c (modified) (3 diffs)
• source4/ntvfs/posix/pvfs_read.c (modified) (1 diff)
• source4/ntvfs/posix/pvfs_rename.c (modified) (12 diffs)
• source4/ntvfs/posix/pvfs_resolve.c (modified) (17 diffs)
• source4/ntvfs/posix/pvfs_search.c (modified) (11 diffs)
• source4/ntvfs/posix/pvfs_setfileinfo.c (modified) (5 diffs)
• source4/ntvfs/posix/pvfs_shortname.c (modified) (4 diffs)
• source4/ntvfs/posix/pvfs_streams.c (modified) (3 diffs)
• source4/ntvfs/posix/pvfs_sys.c (copied) (copied from vendor/current/source4/ntvfs/posix/pvfs_sys.c )
• source4/ntvfs/posix/pvfs_unlink.c (modified) (2 diffs)
• source4/ntvfs/posix/pvfs_util.c (modified) (5 diffs)
• source4/ntvfs/posix/pvfs_wait.c (modified) (1 diff)
• source4/ntvfs/posix/pvfs_xattr.c (modified) (10 diffs)
• source4/ntvfs/posix/python (copied) (copied from vendor/current/source4/ntvfs/posix/python )
• source4/ntvfs/posix/python/pyxattr_native.c (copied) (copied from vendor/current/source4/ntvfs/posix/python/pyxattr_native.c )
• source4/ntvfs/posix/python/pyxattr_tdb.c (copied) (copied from vendor/current/source4/ntvfs/posix/python/pyxattr_tdb.c )
• source4/ntvfs/posix/vfs_posix.c (modified) (4 diffs)
• source4/ntvfs/posix/vfs_posix.h (modified) (8 diffs)
• source4/ntvfs/posix/wscript_build (copied) (copied from vendor/current/source4/ntvfs/posix/wscript_build )
• source4/ntvfs/posix/xattr_tdb.c (modified) (12 diffs)

trunk/server/source4/ntvfs/posix/pvfs_acl.c

@@ -26 +26 @@
 #include "libcli/security/security.h"
 #include "param/param.h"
-
+#include "../lib/util/unix_privs.h"
+
+#if defined(UID_WRAPPER)
+#if !defined(UID_WRAPPER_REPLACE) && !defined(UID_WRAPPER_NOT_REPLACE)
+#define UID_WRAPPER_REPLACE
+#include "../uid_wrapper/uid_wrapper.h"
+#endif
+#else
+#define uwrap_enabled() 0
+#endif
 
 /* the list of currently registered ACL backends */
@@ -84 +93 @@
 {
         static bool initialized = false;
-        extern NTSTATUS pvfs_acl_nfs4_init(void);
-        extern NTSTATUS pvfs_acl_xattr_init(void);
+#define _MODULE_PROTO(init) extern NTSTATUS init(void);
+        STATIC_pvfs_acl_MODULES_PROTO;
         init_module_fn static_init[] = { STATIC_pvfs_acl_MODULES };
         init_module_fn *shared_init;
@@ -149 +158 @@
         struct security_ace ace;
         mode_t mode;
-        struct id_mapping *ids;
+        struct id_map *ids;
         struct composite_context *ctx;
 
@@ -158 +167 @@
         sd = *psd;
 
-        ids = talloc_zero_array(sd, struct id_mapping, 2);
+        ids = talloc_zero_array(sd, struct id_map, 2);
         NT_STATUS_HAVE_NO_MEMORY(ids);
 
-        ids[0].unixid = talloc(ids, struct unixid);
-        NT_STATUS_HAVE_NO_MEMORY(ids[0].unixid);
-
-        ids[0].unixid->id = name->st.st_uid;
-        ids[0].unixid->type = ID_TYPE_UID;
+        ids[0].xid.id = name->st.st_uid;
+        ids[0].xid.type = ID_TYPE_UID;
         ids[0].sid = NULL;
 
-        ids[1].unixid = talloc(ids, struct unixid);
-        NT_STATUS_HAVE_NO_MEMORY(ids[1].unixid);
-
-        ids[1].unixid->id = name->st.st_gid;
-        ids[1].unixid->type = ID_TYPE_GID;
+        ids[1].xid.id = name->st.st_gid;
+        ids[1].xid.type = ID_TYPE_GID;
         ids[1].sid = NULL;
 
@@ -291 +294 @@
         uid_t new_uid = -1;
         gid_t new_gid = -1;
-        struct id_mapping *ids;
+        struct id_map *ids;
         struct composite_context *ctx;
 
@@ -304 +307 @@
         }
 
-        ids = talloc(req, struct id_mapping);
+        ids = talloc(req, struct id_map);
         NT_STATUS_HAVE_NO_MEMORY(ids);
-        ids->unixid = NULL;
+        ZERO_STRUCT(ids->xid);
         ids->sid = NULL;
-        ids->status = NT_STATUS_NONE_MAPPED;
+        ids->status = ID_UNKNOWN;
 
         new_sd = info->set_secdesc.in.sd;
@@ -328 +331 @@
                         NT_STATUS_NOT_OK_RETURN(status);
 
-                        if (ids->unixid->type == ID_TYPE_BOTH ||
-                            ids->unixid->type == ID_TYPE_UID) {
-                                new_uid = ids->unixid->id;
+                        if (ids->xid.type == ID_TYPE_BOTH ||
+                            ids->xid.type == ID_TYPE_UID) {
+                                new_uid = ids->xid.id;
                         }
                 }
@@ -346 +349 @@
                         NT_STATUS_NOT_OK_RETURN(status);
 
-                        if (ids->unixid->type == ID_TYPE_BOTH ||
-                            ids->unixid->type == ID_TYPE_GID) {
-                                new_gid = ids->unixid->id;
+                        if (ids->xid.type == ID_TYPE_BOTH ||
+                            ids->xid.type == ID_TYPE_GID) {
+                                new_gid = ids->xid.id;
                         }
 
@@ -384 +387 @@
                 } else {
                         ret = fchown(fd, new_uid, new_gid);
+                }
+                if (errno == EPERM) {
+                        if (uwrap_enabled()) {
+                                ret = 0;
+                        } else {
+                                /* try again as root if we have SEC_PRIV_RESTORE or
+                                   SEC_PRIV_TAKE_OWNERSHIP */
+                                if (security_token_has_privilege(req->session_info->security_token,
+                                                                 SEC_PRIV_RESTORE) ||
+                                    security_token_has_privilege(req->session_info->security_token,
+                                                                 SEC_PRIV_TAKE_OWNERSHIP)) {
+                                        void *privs;
+                                        privs = root_privileges();
+                                        if (fd == -1) {
+                                                ret = chown(name->full_name, new_uid, new_gid);
+                                        } else {
+                                                ret = fchown(fd, new_uid, new_gid);
+                                        }
+                                        talloc_free(privs);
+                                }
+                        }
                 }
                 if (ret == -1) {
@@ -483 +507 @@
   for the common case of access check on files with no 
   specific NT ACL
-*/
-NTSTATUS pvfs_access_check_unix(struct pvfs_state *pvfs, 
-                                struct ntvfs_request *req,
-                                struct pvfs_filename *name,
-                                uint32_t *access_mask)
+
+  If name is NULL then treat as a new file creation
+*/
+static NTSTATUS pvfs_access_check_unix(struct pvfs_state *pvfs,
+                                       struct ntvfs_request *req,
+                                       struct pvfs_filename *name,
+                                       uint32_t *access_mask)
 {
         uid_t uid = geteuid();
         uint32_t max_bits = SEC_RIGHTS_FILE_READ | SEC_FILE_ALL;
+        struct security_token *token = req->session_info->security_token;
 
         if (pvfs_read_only(pvfs, *access_mask)) {
@@ -496 +523 @@
         }
 
-        /* owner and root get extra permissions */
-        if (uid == 0) {
-                max_bits |= SEC_STD_ALL | SEC_FLAG_SYSTEM_SECURITY;
-        } else if (uid == name->st.st_uid) {
+        if (name == NULL || uid == name->st.st_uid) {
                 max_bits |= SEC_STD_ALL;
-        }
-
-        if ((name->st.st_mode & S_IWOTH) ||
+        } else if (security_token_has_privilege(token, SEC_PRIV_RESTORE)) {
+                max_bits |= SEC_STD_DELETE;
+        }
+
+        if (name == NULL ||
+            (name->st.st_mode & S_IWOTH) ||
             ((name->st.st_mode & S_IWGRP) && 
              pvfs_group_member(pvfs, name->st.st_gid))) {
@@ -517 +544 @@
         }
 
-        if (*access_mask == SEC_FLAG_MAXIMUM_ALLOWED) {
-                *access_mask = max_bits;
-                return NT_STATUS_OK;
-        }
-
-        if (uid != 0 && (*access_mask & SEC_FLAG_SYSTEM_SECURITY)) {
-                return NT_STATUS_ACCESS_DENIED;
+        if (*access_mask & SEC_FLAG_MAXIMUM_ALLOWED) {
+                *access_mask |= max_bits;
+                *access_mask &= ~SEC_FLAG_MAXIMUM_ALLOWED;
+        }
+
+        if ((*access_mask & SEC_FLAG_SYSTEM_SECURITY) &&
+            security_token_has_privilege(token, SEC_PRIV_SECURITY)) {
+                max_bits |= SEC_FLAG_SYSTEM_SECURITY;
+        }
+        
+        if (((*access_mask & ~max_bits) & SEC_RIGHTS_PRIV_RESTORE) &&
+            security_token_has_privilege(token, SEC_PRIV_RESTORE)) {
+                max_bits |= ~(SEC_RIGHTS_PRIV_RESTORE);
+        }
+        if (((*access_mask & ~max_bits) & SEC_RIGHTS_PRIV_BACKUP) &&
+            security_token_has_privilege(token, SEC_PRIV_BACKUP)) {
+                max_bits |= ~(SEC_RIGHTS_PRIV_BACKUP);
         }
 
         if (*access_mask & ~max_bits) {
                 DEBUG(0,(__location__ " denied access to '%s' - wanted 0x%08x but got 0x%08x (missing 0x%08x)\n",
-                         name->full_name, *access_mask, max_bits, *access_mask & ~max_bits));
+                         name?name->full_name:"(new file)", *access_mask, max_bits, *access_mask & ~max_bits));
                 return NT_STATUS_ACCESS_DENIED;
         }
@@ -556 +593 @@
         NTSTATUS status;
         struct security_descriptor *sd;
+        bool allow_delete = false;
 
         /* on SMB2 a blank access mask is always denied */
@@ -567 +605 @@
         }
 
+        if (*access_mask & SEC_FLAG_MAXIMUM_ALLOWED ||
+            *access_mask & SEC_STD_DELETE) {
+                status = pvfs_access_check_parent(pvfs, req,
+                                                  name, SEC_DIR_DELETE_CHILD);
+                if (NT_STATUS_IS_OK(status)) {
+                        allow_delete = true;
+                        *access_mask &= ~SEC_STD_DELETE;
+                }
+        }
+
         acl = talloc(req, struct xattr_NTACL);
         if (acl == NULL) {
@@ -581 +629 @@
         if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
                 talloc_free(acl);
-                return pvfs_access_check_unix(pvfs, req, name, access_mask);
+                status = pvfs_access_check_unix(pvfs, req, name, access_mask);
+                goto done;
         }
         if (!NT_STATUS_IS_OK(status)) {
@@ -596 +645 @@
 
         /* check the acl against the required access mask */
-        status = sec_access_check(sd, token, *access_mask, access_mask);
-
+        status = se_access_check(sd, token, *access_mask, access_mask);
+        talloc_free(acl);
+done:
         if (pvfs->ntvfs->ctx->protocol != PROTOCOL_SMB2) {
                 /* on SMB, this bit is always granted, even if not
@@ -604 +654 @@
         }
 
-        talloc_free(acl);
-        
+        if (allow_delete) {
+                *access_mask |= SEC_STD_DELETE;
+        }
+
         return status;
 }
@@ -631 +683 @@
                                   struct ntvfs_request *req,
                                   struct pvfs_filename *name,
-                                  uint32_t *access_mask)
+                                  uint32_t *access_mask,
+                                  bool container,
+                                  struct security_descriptor **sd)
 {
         struct pvfs_filename *parent;
         NTSTATUS status;
+        uint32_t parent_mask;
+        bool allow_delete = false;
+
+        if (pvfs_read_only(pvfs, *access_mask)) {
+                return NT_STATUS_ACCESS_DENIED;
+        }
 
         status = pvfs_resolve_parent(pvfs, req, name, &parent);
+        NT_STATUS_NOT_OK_RETURN(status);
+
+        if (container) {
+                parent_mask = SEC_DIR_ADD_SUBDIR;
+        } else {
+                parent_mask = SEC_DIR_ADD_FILE;
+        }
+        if (*access_mask & SEC_FLAG_MAXIMUM_ALLOWED ||
+            *access_mask & SEC_STD_DELETE) {
+                parent_mask |= SEC_DIR_DELETE_CHILD;
+        }
+
+        status = pvfs_access_check(pvfs, req, parent, &parent_mask);
+        if (NT_STATUS_IS_OK(status)) {
+                if (parent_mask & SEC_DIR_DELETE_CHILD) {
+                        allow_delete = true;
+                }
+        } else if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
+                /*
+                 * on ACCESS_DENIED we get the rejected bits
+                 * remove the non critical SEC_DIR_DELETE_CHILD
+                 * and check if something else was rejected.
+                 */
+                parent_mask &= ~SEC_DIR_DELETE_CHILD;
+                if (parent_mask != 0) {
+                        return NT_STATUS_ACCESS_DENIED;
+                }
+                status = NT_STATUS_OK;
+        } else {
+                return status;
+        }
+
+        if (*sd == NULL) {
+                status = pvfs_acl_inherited_sd(pvfs, req, req, parent, container, sd);
+        }
+
+        talloc_free(parent);
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
         }
 
-        status = pvfs_access_check(pvfs, req, parent, access_mask);
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
-        }
-
-        if (! ((*access_mask) & SEC_DIR_ADD_FILE)) {
-                return pvfs_access_check_simple(pvfs, req, parent, SEC_DIR_ADD_FILE);
-        }
-
-        return status;
+        /* expand the generic access bits to file specific bits */
+        *access_mask = pvfs_translate_mask(*access_mask);
+
+        if (*access_mask & SEC_FLAG_MAXIMUM_ALLOWED) {
+                *access_mask |= SEC_RIGHTS_FILE_ALL;
+                *access_mask &= ~SEC_FLAG_MAXIMUM_ALLOWED;
+        }
+
+        if (pvfs->ntvfs->ctx->protocol != PROTOCOL_SMB2) {
+                /* on SMB, this bit is always granted, even if not
+                   asked for */
+                *access_mask |= SEC_FILE_READ_ATTRIBUTE;
+        }
+
+        if (allow_delete) {
+                *access_mask |= SEC_STD_DELETE;
+        }
+
+        return NT_STATUS_OK;
 }
 
@@ -778 +884 @@
 
 /*
-  setup an ACL on a new file/directory based on the inherited ACL from
-  the parent. If there is no inherited ACL then we don't set anything,
-  as the default ACL applies anyway
-*/
-NTSTATUS pvfs_acl_inherit(struct pvfs_state *pvfs, 
-                          struct ntvfs_request *req,
-                          struct pvfs_filename *name,
-                          int fd)
+  calculate the ACL on a new file/directory based on the inherited ACL
+  from the parent. If there is no inherited ACL then return a NULL
+  ACL, which means the default ACL should be used
+*/
+NTSTATUS pvfs_acl_inherited_sd(struct pvfs_state *pvfs, 
+                               TALLOC_CTX *mem_ctx,
+                               struct ntvfs_request *req,
+                               struct pvfs_filename *parent,
+                               bool container,
+                               struct security_descriptor **ret_sd)
 {
         struct xattr_NTACL *acl;
         NTSTATUS status;
-        struct pvfs_filename *parent;
         struct security_descriptor *parent_sd, *sd;
-        bool container;
-        struct id_mapping *ids;
+        struct id_map *ids;
         struct composite_context *ctx;
-
-        /* form the parents path */
-        status = pvfs_resolve_parent(pvfs, req, name, &parent);
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
-        }
+        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+
+        *ret_sd = NULL;
 
         acl = talloc(req, struct xattr_NTACL);
-        if (acl == NULL) {
-                return NT_STATUS_NO_MEMORY;
-        }
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(acl, tmp_ctx);
 
         status = pvfs_acl_load(pvfs, parent, -1, acl);
         if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
+                talloc_free(tmp_ctx);
                 return NT_STATUS_OK;
         }
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
-        }
+        NT_STATUS_NOT_OK_RETURN_AND_FREE(status, tmp_ctx);
 
         switch (acl->version) {
@@ -819 +919 @@
                 break;
         default:
+                talloc_free(tmp_ctx);
                 return NT_STATUS_INVALID_ACL;
         }
@@ -826 +927 @@
             parent_sd->dacl->num_aces == 0) {
                 /* go with the default ACL */
+                talloc_free(tmp_ctx);
                 return NT_STATUS_OK;
         }
@@ -831 +933 @@
         /* create the new sd */
         sd = security_descriptor_initialise(req);
-        if (sd == NULL) {
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        ids = talloc_array(sd, struct id_mapping, 2);
-        NT_STATUS_HAVE_NO_MEMORY(ids);
-
-        ids[0].unixid = talloc(ids, struct unixid);
-        NT_STATUS_HAVE_NO_MEMORY(ids[0].unixid);
-        ids[0].unixid->id = name->st.st_uid;
-        ids[0].unixid->type = ID_TYPE_UID;
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(sd, tmp_ctx);
+
+        ids = talloc_array(sd, struct id_map, 2);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(ids, tmp_ctx);
+
+        ids[0].xid.id = geteuid();
+        ids[0].xid.type = ID_TYPE_UID;
         ids[0].sid = NULL;
-        ids[0].status = NT_STATUS_NONE_MAPPED;
-
-        ids[1].unixid = talloc(ids, struct unixid);
-        NT_STATUS_HAVE_NO_MEMORY(ids[1].unixid);
-        ids[1].unixid->id = name->st.st_gid;
-        ids[1].unixid->type = ID_TYPE_GID;
+        ids[0].status = ID_UNKNOWN;
+
+        ids[1].xid.id = getegid();
+        ids[1].xid.type = ID_TYPE_GID;
         ids[1].sid = NULL;
-        ids[1].status = NT_STATUS_NONE_MAPPED;
+        ids[1].status = ID_UNKNOWN;
 
         ctx = wbc_xids_to_sids_send(pvfs->wbc_ctx, ids, 2, ids);
-        NT_STATUS_HAVE_NO_MEMORY(ctx);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(ctx, tmp_ctx);
 
         status = wbc_xids_to_sids_recv(ctx, &ids);
-        NT_STATUS_NOT_OK_RETURN(status);
+        NT_STATUS_NOT_OK_RETURN_AND_FREE(status, tmp_ctx);
 
         sd->owner_sid = talloc_steal(sd, ids[0].sid);
@@ -863 +959 @@
         sd->type |= SEC_DESC_DACL_PRESENT;
 
-        container = (name->dos.attrib & FILE_ATTRIBUTE_DIRECTORY) ? true:false;
-
         /* fill in the aces from the parent */
         status = pvfs_acl_inherit_aces(pvfs, parent_sd, sd, container);
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
-        }
+        NT_STATUS_NOT_OK_RETURN_AND_FREE(status, tmp_ctx);
 
         /* if there is nothing to inherit then we fallback to the
            default acl */
         if (sd->dacl == NULL || sd->dacl->num_aces == 0) {
+                talloc_free(tmp_ctx);
                 return NT_STATUS_OK;
         }
 
-        acl->info.sd = sd;
-
-        status = pvfs_acl_save(pvfs, name, fd, acl);
-        
+        *ret_sd = talloc_steal(mem_ctx, sd);
+
+        talloc_free(tmp_ctx);
+        return NT_STATUS_OK;
+}
+
+
+/*
+  setup an ACL on a new file/directory based on the inherited ACL from
+  the parent. If there is no inherited ACL then we don't set anything,
+  as the default ACL applies anyway
+*/
+NTSTATUS pvfs_acl_inherit(struct pvfs_state *pvfs, 
+                          struct ntvfs_request *req,
+                          struct pvfs_filename *name,
+                          int fd)
+{
+        struct xattr_NTACL acl;
+        NTSTATUS status;
+        struct security_descriptor *sd;
+        struct pvfs_filename *parent;
+        bool container;
+
+        /* form the parents path */
+        status = pvfs_resolve_parent(pvfs, req, name, &parent);
+        NT_STATUS_NOT_OK_RETURN(status);
+
+        container = (name->dos.attrib & FILE_ATTRIBUTE_DIRECTORY) ? true:false;
+
+        status = pvfs_acl_inherited_sd(pvfs, req, req, parent, container, &sd);
+        if (!NT_STATUS_IS_OK(status)) {
+                talloc_free(parent);
+                return status;
+        }
+
+        if (sd == NULL) {
+                return NT_STATUS_OK;
+        }
+
+        acl.version = 1;
+        acl.info.sd = sd;
+
+        status = pvfs_acl_save(pvfs, name, fd, &acl);
+        talloc_free(sd);
+        talloc_free(parent);
+
         return status;
 }

trunk/server/source4/ntvfs/posix/pvfs_acl_nfs4.c

@@ -40 +40 @@
         struct security_descriptor *sd;
         int i, num_ids;
-        struct id_mapping *ids;
+        struct id_map *ids;
         struct composite_context *ctx;
 
@@ -48 +48 @@
         status = pvfs_xattr_ndr_load(pvfs, mem_ctx, name->full_name, fd, 
                                      NFS4ACL_XATTR_NAME,
-                                     acl, ndr_pull_nfs4acl);
+                                     acl, (void *) ndr_pull_nfs4acl);
         if (!NT_STATUS_IS_OK(status)) {
                 talloc_free(acl);
@@ -63 +63 @@
         /* the number of ids to map is the acl count plus uid and gid */
         num_ids = acl->a_count +2;
-        ids = talloc_array(sd, struct id_mapping, num_ids);
+        ids = talloc_array(sd, struct id_map, num_ids);
         NT_STATUS_HAVE_NO_MEMORY(ids);
 
-        ids[0].unixid = talloc(ids, struct unixid);
-        NT_STATUS_HAVE_NO_MEMORY(ids[0].unixid);
-        ids[0].unixid->id = name->st.st_uid;
-        ids[0].unixid->type = ID_TYPE_UID;
+        ids[0].xid.id = name->st.st_uid;
+        ids[0].xid.type = ID_TYPE_UID;
         ids[0].sid = NULL;
-        ids[0].status = NT_STATUS_NONE_MAPPED;
-
-        ids[1].unixid = talloc(ids, struct unixid);
-        NT_STATUS_HAVE_NO_MEMORY(ids[1].unixid);
-        ids[1].unixid->id = name->st.st_gid;
-        ids[1].unixid->type = ID_TYPE_GID;
+        ids[0].status = ID_UNKNOWN;
+
+        ids[1].xid.id = name->st.st_gid;
+        ids[1].xid.type = ID_TYPE_GID;
         ids[1].sid = NULL;
-        ids[1].status = NT_STATUS_NONE_MAPPED;
+        ids[1].status = ID_UNKNOWN;
 
         for (i=0;i<acl->a_count;i++) {
                 struct nfs4ace *a = &acl->ace[i];
-                ids[i+2].unixid = talloc(ids, struct unixid);
-                NT_STATUS_HAVE_NO_MEMORY(ids[i+2].unixid);
-                ids[i+2].unixid->id = a->e_id;
+                ids[i+2].xid.id = a->e_id;
                 if (a->e_flags & ACE4_IDENTIFIER_GROUP) {
-                        ids[i+2].unixid->type = ID_TYPE_GID;
+                        ids[i+2].xid.type = ID_TYPE_GID;
                 } else {
-                        ids[i+2].unixid->type = ID_TYPE_UID;
+                        ids[i+2].xid.type = ID_TYPE_UID;
                 }
                 ids[i+2].sid = NULL;
-                ids[i+2].status = NT_STATUS_NONE_MAPPED;
+                ids[i+2].status = ID_UNKNOWN;
         }
 
@@ -128 +122 @@
         int i;
         TALLOC_CTX *tmp_ctx;
-        struct id_mapping *ids;
+        struct id_map *ids;
         struct composite_context *ctx;
 
@@ -147 +141 @@
         }
 
-        ids = talloc_array(tmp_ctx, struct id_mapping, acl.a_count);
+        ids = talloc_array(tmp_ctx, struct id_map, acl.a_count);
         if (ids == NULL) {
                 talloc_free(tmp_ctx);
@@ -155 +149 @@
         for (i=0;i<acl.a_count;i++) {
                 struct security_ace *ace = &sd->dacl->aces[i];
-                ids[i].unixid = NULL;
+                ZERO_STRUCT(ids[i].xid);
                 ids[i].sid = dom_sid_dup(ids, &ace->trustee);
                 if (ids[i].sid == NULL) {
@@ -161 +155 @@
                         return NT_STATUS_NO_MEMORY;
                 }
-                ids[i].status = NT_STATUS_NONE_MAPPED;
+                ids[i].status = ID_UNKNOWN;
         }
 
@@ -181 +175 @@
                 a->e_flags = ace->flags;
                 a->e_mask  = ace->access_mask;
-                if (ids[i].unixid->type != ID_TYPE_UID) {
+                if (ids[i].xid.type != ID_TYPE_UID) {
                         a->e_flags |= ACE4_IDENTIFIER_GROUP;
                 }
-                a->e_id = ids[i].unixid->id;
+                a->e_id = ids[i].xid.id;
                 a->e_who   = "";
         }
@@ -191 +185 @@
         status = pvfs_xattr_ndr_save(pvfs, name->full_name, fd, 
                                      NFS4ACL_XATTR_NAME, 
-                                     &acl, ndr_push_nfs4acl);
+                                     &acl, (void *) ndr_push_nfs4acl);
         talloc_free(privs);
 

trunk/server/source4/ntvfs/posix/pvfs_acl_xattr.c

@@ -44 +44 @@
         status = pvfs_xattr_ndr_load(pvfs, mem_ctx, name->full_name, fd, 
                                      XATTR_NTACL_NAME,
-                                     acl, 
-                                     (ndr_pull_flags_fn_t)ndr_pull_xattr_NTACL);
+                                     acl, (void *) ndr_pull_xattr_NTACL);
 
         if (!NT_STATUS_IS_OK(status)) {
@@ -84 +83 @@
         status = pvfs_xattr_ndr_save(pvfs, name->full_name, fd, 
                                      XATTR_NTACL_NAME, 
-                                     &acl, 
-                                     (ndr_push_flags_fn_t)ndr_push_xattr_NTACL);
+                                     &acl, (void *) ndr_push_xattr_NTACL);
         talloc_free(privs);
         return status;

trunk/server/source4/ntvfs/posix/pvfs_fileinfo.c

@@ -54 +54 @@
 */
 NTSTATUS pvfs_fill_dos_info(struct pvfs_state *pvfs, struct pvfs_filename *name,
-                            uint_t flags, int fd)
+                            unsigned int flags, int fd)
 {
         NTSTATUS status;

trunk/server/source4/ntvfs/posix/pvfs_fsinfo.c

@@ -89 +89 @@
                                   struct pvfs_state);
         uint64_t blocks_free, blocks_total;
-        uint_t bpunit;
+        unsigned int bpunit;
         struct stat st;
         const uint16_t block_size = 512;

trunk/server/source4/ntvfs/posix/pvfs_lock.c

@@ -117 +117 @@
         /* we don't retry on a cancel */
         if (reason == PVFS_WAIT_CANCEL) {
-                status = NT_STATUS_FILE_LOCK_CONFLICT;
+                if (pvfs->ntvfs->ctx->protocol != PROTOCOL_SMB2) {
+                        status = NT_STATUS_FILE_LOCK_CONFLICT;
+                } else {
+                        status = NT_STATUS_CANCELLED;
+                }
         } else {
                 /* 

trunk/server/source4/ntvfs/posix/pvfs_mkdir.c

@@ -52 +52 @@
         mode = pvfs_fileperms(pvfs, FILE_ATTRIBUTE_DIRECTORY);
 
-        if (mkdir(name->full_name, mode) == -1) {
+        if (pvfs_sys_mkdir(pvfs, name->full_name, mode) == -1) {
                 return pvfs_map_errno(pvfs, errno);
         }
@@ -70 +70 @@
         status = pvfs_acl_inherit(pvfs, req, name, -1);
         if (!NT_STATUS_IS_OK(status)) {
-                rmdir(name->full_name);
+                pvfs_sys_rmdir(pvfs, name->full_name);
                 return status;
         }
@@ -79 +79 @@
                                          md->t2mkdir.in.eas);
         if (!NT_STATUS_IS_OK(status)) {
-                rmdir(name->full_name);
+                pvfs_sys_rmdir(pvfs, name->full_name);
                 return status;
         }
@@ -128 +128 @@
         mode = pvfs_fileperms(pvfs, FILE_ATTRIBUTE_DIRECTORY);
 
-        if (mkdir(name->full_name, mode) == -1) {
+        if (pvfs_sys_mkdir(pvfs, name->full_name, mode) == -1) {
                 return pvfs_map_errno(pvfs, errno);
         }
@@ -137 +137 @@
         status = pvfs_acl_inherit(pvfs, req, name, -1);
         if (!NT_STATUS_IS_OK(status)) {
-                rmdir(name->full_name);
+                pvfs_sys_rmdir(pvfs, name->full_name);
                 return status;
         }
@@ -180 +180 @@
         }
 
-        if (rmdir(name->full_name) == -1) {
+        if (pvfs_sys_rmdir(pvfs, name->full_name) == -1) {
                 /* some olders systems don't return ENOTEMPTY to rmdir() */
                 if (errno == EEXIST) {

trunk/server/source4/ntvfs/posix/pvfs_notify.c

@@ -180 +180 @@
         NTSTATUS status;
         struct notify_entry e;
+        
+        /* We may not fill in all the elements in this entry -
+         * structure may in future be shared with Samba3 */
+        ZERO_STRUCT(e);
+
+        /* We may not fill in all the elements in this entry -
+         * structure may in future be shared with Samba3 */
+        ZERO_STRUCT(e);
 
         f->notify_buffer = talloc_zero(f, struct pvfs_notify_buffer);

trunk/server/source4/ntvfs/posix/pvfs_open.c

@@ -74 +74 @@
                                          delete_path, nt_errstr(status)));
                         }
-                        if (rmdir(delete_path) != 0) {
+                        if (pvfs_sys_rmdir(h->pvfs, delete_path) != 0) {
                                 DEBUG(0,("pvfs_dir_handle_destructor: failed to rmdir '%s' - %s\n",
                                          delete_path, strerror(errno)));
@@ -104 +104 @@
                                         struct pvfs_filename *name,
                                         int fd, struct pvfs_file *f,
-                                        union smb_open *io)
-{
-        NTSTATUS status;
-        struct security_descriptor *sd;
+                                        union smb_open *io,
+                                        struct security_descriptor *sd)
+{
+        NTSTATUS status = NT_STATUS_OK;
 
         /* setup any EAs that were asked for */
@@ -119 +119 @@
         }
 
-        sd = io->ntcreatex.in.sec_desc;
         /* setup an initial sec_desc if requested */
         if (sd && (sd->type & SEC_DESC_DACL_PRESENT)) {
@@ -135 +134 @@
 
                 status = pvfs_acl_set(pvfs, req, name, fd, SEC_STD_WRITE_DAC, &set);
-        } else {
-                /* otherwise setup an inherited acl from the parent */
-                status = pvfs_acl_inherit(pvfs, req, name, fd);
         }
 
@@ -186 +182 @@
         uint32_t share_access;
         bool forced;
+        struct security_descriptor *sd = NULL;
 
         create_options = io->generic.in.create_options;
@@ -210 +207 @@
             (io->ntcreatex.in.create_options & NTCREATEX_OPTIONS_DIRECTORY) &&
             (io->ntcreatex.in.create_options & NTCREATEX_OPTIONS_DELETE_ON_CLOSE)) {
+                DEBUG(3,(__location__ ": Invalid access_mask/create_options 0x%08x 0x%08x for %s\n",
+                         io->ntcreatex.in.access_mask, io->ntcreatex.in.create_options, name->original_name));
                 return NT_STATUS_INVALID_PARAMETER;
         }
@@ -233 +232 @@
         case NTCREATEX_DISP_SUPERSEDE:
         default:
+                DEBUG(3,(__location__ ": Invalid open disposition 0x%08x for %s\n",
+                         io->generic.in.open_disposition, name->original_name));
                 return NT_STATUS_INVALID_PARAMETER;
         }
@@ -252 +253 @@
                 /* check the security descriptor */
                 status = pvfs_access_check(pvfs, req, name, &access_mask);
-        } else {
-                status = pvfs_access_check_create(pvfs, req, name, &access_mask);
+        } else {                
+                sd = io->ntcreatex.in.sec_desc;
+                status = pvfs_access_check_create(pvfs, req, name, &access_mask, true, &sd);
         }
         NT_STATUS_NOT_OK_RETURN(status);
@@ -279 +281 @@
         f->handle->odb_locking_key   = data_blob(NULL, 0);
         f->handle->create_options    = io->generic.in.create_options;
+        f->handle->private_flags     = io->generic.in.private_flags;
         f->handle->seek_offset       = 0;
         f->handle->position          = 0;
@@ -342 +345 @@
                 mode_t mode = pvfs_fileperms(pvfs, attrib);
 
-                if (mkdir(name->full_name, mode) == -1) {
+                if (pvfs_sys_mkdir(pvfs, name->full_name, mode) == -1) {
                         return pvfs_map_errno(pvfs,errno);
                 }
@@ -353 +356 @@
                 }
 
-                status = pvfs_open_setup_eas_acl(pvfs, req, name, -1, f, io);
+                status = pvfs_open_setup_eas_acl(pvfs, req, name, -1, f, io, sd);
                 if (!NT_STATUS_IS_OK(status)) {
                         goto cleanup_delete;
@@ -430 +433 @@
 
 cleanup_delete:
-        rmdir(name->full_name);
+        pvfs_sys_rmdir(pvfs, name->full_name);
         return status;
 }
@@ -512 +515 @@
                                          delete_path, nt_errstr(status)));
                         }
-                        if (unlink(delete_path) != 0) {
+                        if (pvfs_sys_unlink(h->pvfs, delete_path) != 0) {
                                 DEBUG(0,("pvfs_close: failed to delete '%s' - %s\n",
                                          delete_path, strerror(errno)));
@@ -617 +620 @@
         uint32_t oplock_level = OPLOCK_NONE, oplock_granted;
         bool allow_level_II_oplock = false;
+        struct security_descriptor *sd = NULL;
 
         if (io->ntcreatex.in.file_attr & ~FILE_ATTRIBUTE_ALL_MASK) {
+                DEBUG(3,(__location__ ": Invalid file_attr 0x%08x for %s\n",
+                         io->ntcreatex.in.file_attr, name->original_name));
                 return NT_STATUS_INVALID_PARAMETER;
         }
 
         if (io->ntcreatex.in.file_attr & FILE_ATTRIBUTE_ENCRYPTED) {
+                DEBUG(3,(__location__ ": Invalid encryption request for %s\n",
+                         name->original_name));
                 return NT_STATUS_ACCESS_DENIED;
         }
@@ -628 +636 @@
         if ((io->ntcreatex.in.file_attr & FILE_ATTRIBUTE_READONLY) &&
             (create_options & NTCREATEX_OPTIONS_DELETE_ON_CLOSE)) {
+                DEBUG(4,(__location__ ": Invalid delete on close for readonly file %s\n",
+                         name->original_name));
                 return NT_STATUS_CANNOT_DELETE;
         }
 
-        status = pvfs_access_check_create(pvfs, req, name, &access_mask);
+        sd = io->ntcreatex.in.sec_desc;
+        status = pvfs_access_check_create(pvfs, req, name, &access_mask, false, &sd);
         NT_STATUS_NOT_OK_RETURN(status);
 
@@ -667 +678 @@
 
         /* create the file */
-        fd = open(name->full_name, flags | O_CREAT | O_EXCL| O_NONBLOCK, mode);
+        fd = pvfs_sys_open(pvfs, name->full_name, flags | O_CREAT | O_EXCL| O_NONBLOCK, mode);
         if (fd == -1) {
                 return pvfs_map_errno(pvfs, errno);
@@ -699 +710 @@
 
 
-        status = pvfs_open_setup_eas_acl(pvfs, req, name, fd, f, io);
+        status = pvfs_open_setup_eas_acl(pvfs, req, name, fd, f, io, sd);
         if (!NT_STATUS_IS_OK(status)) {
                 goto cleanup_delete;
@@ -777 +788 @@
         f->handle->fd                = fd;
         f->handle->create_options    = io->generic.in.create_options;
+        f->handle->private_flags     = io->generic.in.private_flags;
         f->handle->seek_offset       = 0;
         f->handle->position          = 0;
@@ -845 +857 @@
 cleanup_delete:
         close(fd);
-        unlink(name->full_name);
+        pvfs_sys_unlink(pvfs, name->full_name);
         return status;
 }
@@ -1062 +1074 @@
                     f2->ntvfs->session_info == req->session_info &&
                     f2->ntvfs->smbpid == req->smbpid &&
-                    (f2->handle->create_options & 
+                    (f2->handle->private_flags &
                      (NTCREATEX_OPTIONS_PRIVATE_DENY_DOS |
                       NTCREATEX_OPTIONS_PRIVATE_DENY_FCB)) &&
@@ -1078 +1090 @@
         /* quite an insane set of semantics ... */
         if (is_exe_filename(io->generic.in.fname) &&
-            (f2->handle->create_options & NTCREATEX_OPTIONS_PRIVATE_DENY_DOS)) {
+            (f2->handle->private_flags & NTCREATEX_OPTIONS_PRIVATE_DENY_DOS)) {
                 return NT_STATUS_SHARING_VIOLATION;
         }
@@ -1130 +1142 @@
         struct timeval *final_timeout = NULL;
 
-        if (io->generic.in.create_options & 
+        if (io->generic.in.private_flags &
             (NTCREATEX_OPTIONS_PRIVATE_DENY_DOS | NTCREATEX_OPTIONS_PRIVATE_DENY_FCB)) {
                 /* see if we can satisfy the request using the special DENY_DOS
@@ -1186 +1198 @@
         struct ntvfs_handle *h;
         NTSTATUS status;
-        int fd;
+        int fd, count;
         struct odb_lock *lck;
         uint32_t create_options;
@@ -1212 +1224 @@
 
         if (share_access & ~NTCREATEX_SHARE_ACCESS_MASK) {
+                DEBUG(3,(__location__ ": Invalid share_access 0x%08x for %s\n",
+                         share_access, io->ntcreatex.in.fname));
                 return NT_STATUS_INVALID_PARAMETER;
         }
@@ -1220 +1234 @@
          */
         create_options_must_ignore_mask = NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
-        create_options_must_ignore_mask &= ~NTCREATEX_OPTIONS_PRIVATE_MASK;
         create_options &= ~create_options_must_ignore_mask;
 
@@ -1230 +1243 @@
 
         if (create_options & NTCREATEX_OPTIONS_INVALID_PARAM_MASK) {
+                DEBUG(3,(__location__ ": Invalid create_options 0x%08x for %s\n",
+                         create_options, io->ntcreatex.in.fname));
                 return NT_STATUS_INVALID_PARAMETER;
         }
@@ -1260 +1275 @@
         if ((create_options & NTCREATEX_OPTIONS_DELETE_ON_CLOSE) &&
             !(access_mask & SEC_STD_DELETE)) {
+                DEBUG(3,(__location__ ": Invalid delete_on_close option 0x%08x with access_mask 0x%08x for %s\n",
+                         create_options, access_mask, io->ntcreatex.in.fname));
                 return NT_STATUS_INVALID_PARAMETER;
         }
@@ -1273 +1290 @@
         }
 
+        /* cope with non-zero root_fid */
+        if (io->ntcreatex.in.root_fid.ntvfs != NULL) {
+                f = pvfs_find_fd(pvfs, req, io->ntcreatex.in.root_fid.ntvfs);
+                if (f == NULL) {
+                        return NT_STATUS_INVALID_HANDLE;
+                }
+                if (f->handle->fd != -1) {
+                        return NT_STATUS_INVALID_DEVICE_REQUEST;
+                }
+                io->ntcreatex.in.fname = talloc_asprintf(req, "%s\\%s", 
+                                                         f->handle->name->original_name,
+                                                         io->ntcreatex.in.fname);
+                NT_STATUS_HAVE_NO_MEMORY(io->ntcreatex.in.fname);                       
+        }
+
         if (io->ntcreatex.in.file_attr & (FILE_ATTRIBUTE_DEVICE|
                                           FILE_ATTRIBUTE_VOLUME| 
                                           (~FILE_ATTRIBUTE_ALL_MASK))) {
+                DEBUG(3,(__location__ ": Invalid file_attr 0x%08x for %s\n",
+                         io->ntcreatex.in.file_attr, io->ntcreatex.in.fname));
                 return NT_STATUS_INVALID_PARAMETER;
         }
@@ -1359 +1393 @@
 
         default:
+                DEBUG(3,(__location__ ": Invalid open disposition 0x%08x for %s\n",
+                         io->generic.in.open_disposition, name->original_name));
                 return NT_STATUS_INVALID_PARAMETER;
         }
@@ -1424 +1460 @@
         f->handle->name              = talloc_steal(f->handle, name);
         f->handle->create_options    = io->generic.in.create_options;
+        f->handle->private_flags     = io->generic.in.private_flags;
         f->handle->seek_offset       = 0;
         f->handle->position          = 0;
@@ -1513 +1550 @@
 
         /* do the actual open */
-        fd = open(f->handle->name->full_name, flags | O_NONBLOCK);
+        fd = pvfs_sys_open(pvfs, f->handle->name->full_name, flags | O_NONBLOCK, 0);
         if (fd == -1) {
                 status = pvfs_map_errno(f->pvfs, errno);
@@ -1533 +1570 @@
         f->handle->fd = fd;
 
+        status = brl_count(f->pvfs->brl_context, f->brl_handle, &count);
+        if (!NT_STATUS_IS_OK(status)) {
+                talloc_free(lck);
+                return status;
+        }
+
+        if (count != 0) {
+                oplock_level = OPLOCK_NONE;
+        }
+
         /* now really mark the file as open */
         status = odb_open_file(lck, f->handle, name->full_name,
@@ -1589 +1636 @@
                 if (f->handle->name->st.st_mode != mode &&
                     f->handle->name->dos.attrib != attrib &&
-                    fchmod(fd, mode) == -1) {
+                    pvfs_sys_fchmod(pvfs, fd, mode) == -1) {
                         talloc_free(lck);
                         return pvfs_map_errno(pvfs, errno);
@@ -1699 +1746 @@
         struct pvfs_file *f, *next;
 
+        /* If pvfs is NULL, we never logged on, and no files are open. */
+        if(pvfs == NULL) {
+                return NT_STATUS_OK;
+        }
+
         for (f=pvfs->files.list;f;f=next) {
                 next = f->next;
@@ -1927 +1979 @@
                           NTCREATEX_SHARE_ACCESS_DELETE;
         /*
-         * I would have thought that we would need to pass
-         * SEC_FILE_WRITE_DATA | SEC_FILE_APPEND_DATA here too
-         *
-         * But you only need SEC_FILE_WRITE_ATTRIBUTE permissions
-         * to set the filesize.
-         *
-         * --metze
+         * this code previous set only SEC_FILE_WRITE_ATTRIBUTE, with
+         * a comment that this seemed to be wrong, but matched windows
+         * behaviour. It now appears that this windows behaviour is
+         * just a bug.
          */
-        access_mask     = SEC_FILE_WRITE_ATTRIBUTE;
+        access_mask     = SEC_FILE_WRITE_ATTRIBUTE | SEC_FILE_WRITE_DATA | SEC_FILE_APPEND_DATA;
         delete_on_close = false;
         break_to_none   = true;

trunk/server/source4/ntvfs/posix/pvfs_qfileinfo.c

@@ -46 +46 @@
                 break;
 
+        case RAW_FILEINFO_STREAM_INFO:
+        case RAW_FILEINFO_STREAM_INFORMATION:
+                needed = 0;
+                break;
+
         case RAW_FILEINFO_SEC_DESC:
                 needed = 0;
@@ -72 +77 @@
 NTSTATUS pvfs_query_ea_list(struct pvfs_state *pvfs, TALLOC_CTX *mem_ctx, 
                             struct pvfs_filename *name, int fd, 
-                            uint_t num_names,
+                            unsigned int num_names,
                             struct ea_name *names,
                             struct smb_ea_list *eas)
@@ -319 +324 @@
                 info->all_info2.out.position       = 0; /* only set by qfileinfo */
                 info->all_info2.out.mode           = 0; /* only set by qfileinfo */
+                info->all_info2.out.alignment_requirement = 0;
                 /* windows wants the full path on disk for this
                    result, but I really don't want to expose that on

trunk/server/source4/ntvfs/posix/pvfs_read.c

@@ -61 +61 @@
         maxcnt = rd->readx.in.maxcnt;
         if (maxcnt > 2*UINT16_MAX && req->ctx->protocol < PROTOCOL_SMB2) {
+                DEBUG(3,(__location__ ": Invalid SMB maxcnt 0x%x\n", maxcnt));
                 return NT_STATUS_INVALID_PARAMETER;
         }

trunk/server/source4/ntvfs/posix/pvfs_rename.c

@@ -38 +38 @@
         NTSTATUS status;
 
-        if (rename(name1->full_name, name2) == -1) {
+        if (pvfs_sys_rename(pvfs, name1->full_name, name2) == -1) {
                 return pvfs_map_errno(pvfs, errno);
         }
@@ -96 +96 @@
 */
 static const char *pvfs_resolve_wildcard_component(TALLOC_CTX *mem_ctx, 
-                                                   struct smb_iconv_convenience *iconv_convenience,
                                                    const char *fname, 
                                                    const char *pattern)
@@ -116 +115 @@
                 codepoint_t c1, c2;
                 size_t c_size1, c_size2;
-                c1 = next_codepoint_convenience(iconv_convenience, p1, &c_size1);
-                c2 = next_codepoint_convenience(iconv_convenience, p2, &c_size2);
+                c1 = next_codepoint(p1, &c_size1);
+                c2 = next_codepoint(p2, &c_size2);
                 if (c2 == '?') {
-                        d += push_codepoint_convenience(iconv_convenience, d, c1);
+                        d += push_codepoint(d, c1);
                 } else if (c2 == '*') {
                         memcpy(d, p1, strlen(p1));
@@ -125 +124 @@
                         break;
                 } else {
-                        d += push_codepoint_convenience(iconv_convenience, d, c2);
+                        d += push_codepoint(d, c2);
                 }
 
@@ -143 +142 @@
 */
 static const char *pvfs_resolve_wildcard(TALLOC_CTX *mem_ctx, 
-                                         struct smb_iconv_convenience *iconv_convenience,
                                          const char *fname, 
                                          const char *pattern)
@@ -176 +174 @@
         }
 
-        base1 = pvfs_resolve_wildcard_component(mem_ctx, iconv_convenience, base1, base2);
-        ext1 = pvfs_resolve_wildcard_component(mem_ctx, iconv_convenience, ext1, ext2);
+        base1 = pvfs_resolve_wildcard_component(mem_ctx, base1, base2);
+        ext1 = pvfs_resolve_wildcard_component(mem_ctx, ext1, ext2);
         if (base1 == NULL || ext1 == NULL) {
                 return NULL;
@@ -284 +282 @@
 
         /* resolve the wildcard pattern for this name */
-        fname2 = pvfs_resolve_wildcard(mem_ctx, lp_iconv_convenience(pvfs->ntvfs->ctx->lp_ctx), fname1, fname2);
+        fname2 = pvfs_resolve_wildcard(mem_ctx, fname1, fname2);
         if (fname2 == NULL) {
                 return NT_STATUS_NO_MEMORY;
@@ -367 +365 @@
             name2->full_name[strlen(dir_path)] != '/' ||
             strchr(name2->full_name + strlen(dir_path) + 1, '/')) {
+                DEBUG(3,(__location__ ": Invalid rename for %s -> %s\n",
+                         name1->original_name, name2->original_name));
                 return NT_STATUS_INVALID_PARAMETER;
         }
@@ -481 +481 @@
 
         if (name1->has_wildcard) {
+                DEBUG(3,(__location__ ": Invalid wildcard rename for %s\n",
+                         name1->original_name));
                 return NT_STATUS_INVALID_PARAMETER;
         }
 
         if (ren->ntrename.in.new_name[0] != ':') {
+                DEBUG(3,(__location__ ": Invalid rename for %s\n",
+                         ren->ntrename.in.new_name));
                 return NT_STATUS_INVALID_PARAMETER;
         }
@@ -493 +497 @@
 
         if (ren->ntrename.in.flags != RENAME_FLAG_RENAME) {
+                DEBUG(3,(__location__ ": Invalid rename flags 0x%x for %s\n",
+                         ren->ntrename.in.flags, ren->ntrename.in.new_name));
                 return NT_STATUS_INVALID_PARAMETER;
         }
@@ -516 +522 @@
 
         status = pvfs_stream_rename(pvfs, name1, -1, 
-                                    ren->ntrename.in.new_name+1);
+                                    ren->ntrename.in.new_name+1, 
+                                    true);
         NT_STATUS_NOT_OK_RETURN(status);
         
@@ -621 +628 @@
 
         case RENAME_FLAG_MOVE_CLUSTER_INFORMATION:
+                DEBUG(3,(__location__ ": Invalid rename cluster for %s\n",
+                         name1->original_name));
                 return NT_STATUS_INVALID_PARAMETER;
 

trunk/server/source4/ntvfs/posix/pvfs_resolve.c

@@ -60 +60 @@
 static NTSTATUS pvfs_case_search(struct pvfs_state *pvfs,
                                  struct pvfs_filename *name,
-                                 uint_t flags)
+                                 unsigned int flags)
 {
         /* break into a series of components */
@@ -187 +187 @@
   parse a alternate data stream name
 */
-static NTSTATUS parse_stream_name(struct smb_iconv_convenience *ic,
-                                  struct pvfs_filename *name,
+static NTSTATUS parse_stream_name(struct pvfs_filename *name,
                                   const char *s)
 {
@@ -204 +203 @@
         while (*p) {
                 size_t c_size;
-                codepoint_t c = next_codepoint_convenience(ic, p, &c_size);
+                codepoint_t c = next_codepoint(p, &c_size);
 
                 switch (c) {
@@ -257 +256 @@
 */
 static NTSTATUS pvfs_unix_path(struct pvfs_state *pvfs, const char *cifs_name,
-                               uint_t flags, struct pvfs_filename *name)
+                               unsigned int flags, struct pvfs_filename *name)
 {
         char *ret, *p, *p_start;
-        struct smb_iconv_convenience *ic = NULL;
         NTSTATUS status;
 
         name->original_name = talloc_strdup(name, cifs_name);
+
+        /* remove any :$DATA */
+        p = strrchr(name->original_name, ':');
+        if (p && strcasecmp_m(p, ":$DATA") == 0) {
+                if (p > name->original_name && p[-1] == ':') {
+                        p--;
+                }
+                *p = 0;
+        }
+
         name->stream_name = NULL;
         name->stream_id = 0;
@@ -291 +299 @@
         p_start = p;
 
-        ic = lp_iconv_convenience(pvfs->ntvfs->ctx->lp_ctx);
         while (*p) {
                 size_t c_size;
-                codepoint_t c = next_codepoint_convenience(ic, p, &c_size);
+                codepoint_t c = next_codepoint(p, &c_size);
 
                 if (c <= 0x1F) {
@@ -327 +334 @@
                                 return NT_STATUS_OBJECT_NAME_INVALID;
                         }
-                        status = parse_stream_name(ic, name, p);
+                        status = parse_stream_name(name, p);
                         if (!NT_STATUS_IS_OK(status)) {
                                 return status;
@@ -379 +386 @@
 */
 static NTSTATUS pvfs_reduce_name(TALLOC_CTX *mem_ctx, 
-                                 struct smb_iconv_convenience *iconv_convenience, 
-                                 const char **fname, uint_t flags)
+                                 const char **fname, unsigned int flags)
 {
         codepoint_t c;
@@ -392 +398 @@
 
         for (num_components=1, p=s; *p; p += c_size) {
-                c = next_codepoint_convenience(iconv_convenience, p, &c_size);
+                c = next_codepoint(p, &c_size);
                 if (c == '\\') num_components++;
         }
@@ -404 +410 @@
         components[0] = s;
         for (i=0, p=s; *p; p += c_size) {
-                c = next_codepoint_convenience(iconv_convenience, p, &c_size);
+                c = next_codepoint(p, &c_size);
                 if (c == '\\') {
                         *p = 0;
@@ -499 +505 @@
      TODO: ../ collapsing, and outside share checking
 */
-NTSTATUS pvfs_resolve_name(struct pvfs_state *pvfs, TALLOC_CTX *mem_ctx,
+NTSTATUS pvfs_resolve_name(struct pvfs_state *pvfs, 
+                           struct ntvfs_request *req,
                            const char *cifs_name,
-                           uint_t flags, struct pvfs_filename **name)
+                           unsigned int flags, struct pvfs_filename **name)
 {
         NTSTATUS status;
 
-        *name = talloc(mem_ctx, struct pvfs_filename);
+        *name = talloc(req, struct pvfs_filename);
         if (*name == NULL) {
                 return NT_STATUS_NO_MEMORY;
@@ -515 +522 @@
         if (!(pvfs->fs_attribs & FS_ATTR_NAMED_STREAMS)) {
                 flags &= ~PVFS_RESOLVE_STREAMS;
+        }
+
+        /* SMB2 doesn't allow a leading slash */
+        if (req->ctx->protocol == PROTOCOL_SMB2 &&
+            *cifs_name == '\\') {
+                return NT_STATUS_INVALID_PARAMETER;
         }
 
@@ -523 +536 @@
         if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_PATH_SYNTAX_BAD)) {
                 /* it might contain .. components which need to be reduced */
-                status = pvfs_reduce_name(*name, lp_iconv_convenience(pvfs->ntvfs->ctx->lp_ctx), &cifs_name, flags);
+                status = pvfs_reduce_name(*name, &cifs_name, flags);
                 if (!NT_STATUS_IS_OK(status)) {
                         return status;
@@ -594 +607 @@
 NTSTATUS pvfs_resolve_partial(struct pvfs_state *pvfs, TALLOC_CTX *mem_ctx,
                               const char *unix_dir, const char *fname,
-                              uint_t flags, struct pvfs_filename **name)
+                              unsigned int flags, struct pvfs_filename **name)
 {
         NTSTATUS status;
@@ -631 +644 @@
 */
 NTSTATUS pvfs_resolve_name_fd(struct pvfs_state *pvfs, int fd,
-                              struct pvfs_filename *name, uint_t flags)
+                              struct pvfs_filename *name, unsigned int flags)
 {
         dev_t device = (dev_t)0;
@@ -680 +693 @@
         if (h->have_opendb_entry) {
                 struct odb_lock *lck;
-                const char *name = NULL;
+                char *name = NULL;
 
                 lck = odb_lock(h, h->pvfs->odb_context, &h->odb_locking_key);
@@ -691 +704 @@
                 }
 
-                status = odb_get_path(lck, &name);
+                status = odb_get_path(lck, (const char **) &name);
                 if (NT_STATUS_IS_OK(status)) {
                         /*
@@ -703 +716 @@
                                 const char *orig_dir;
                                 const char *new_file;
-                                const char *new_orig;
+                                char *new_orig;
                                 char *delim;
 

trunk/server/source4/ntvfs/posix/pvfs_search.c

@@ -233 +233 @@
 */
 static NTSTATUS pvfs_search_fill(struct pvfs_state *pvfs, TALLOC_CTX *mem_ctx, 
-                                 uint_t max_count, 
+                                 unsigned int max_count,
                                  struct pvfs_search_state *search,
                                  enum smb_search_data_level level,
-                                 uint_t *reply_count,
+                                 unsigned int *reply_count,
                                  void *search_private, 
                                  bool (*callback)(void *, const union smb_search_data *))
@@ -292 +292 @@
 {
         int i;
-        time_t t = time(NULL);
+        time_t t = time_mono(NULL);
 
         for (i=0;i<MAX_OLD_SEARCHES;i++) {
@@ -324 +324 @@
                                   struct pvfs_state);
         struct pvfs_search_state *search;
-        uint_t reply_count;
+        unsigned int reply_count;
         uint16_t search_attrib;
         const char *pattern;
@@ -380 +380 @@
         search->search_attrib = search_attrib & 0xFF;
         search->must_attrib = (search_attrib>>8) & 0xFF;
-        search->last_used = time(NULL);
+        search->last_used = time_mono(NULL);
         search->te = NULL;
 
@@ -416 +416 @@
         struct pvfs_search_state *search;
         struct pvfs_dir *dir;
-        uint_t reply_count, max_count;
+        unsigned int reply_count, max_count;
         uint16_t handle;
         NTSTATUS status;
@@ -438 +438 @@
                 return status;
         }
-        search->last_used = time(NULL);
+        search->last_used = time_mono(NULL);
 
         status = pvfs_search_fill(pvfs, req, max_count, search, io->generic.data_level,
@@ -468 +468 @@
                                   struct pvfs_state);
         struct pvfs_search_state *search;
-        uint_t reply_count;
+        unsigned int reply_count;
         uint16_t search_attrib, max_count;
         const char *pattern;
@@ -566 +566 @@
         struct pvfs_search_state *search;
         struct pvfs_dir *dir;
-        uint_t reply_count;
+        unsigned int reply_count;
         uint16_t handle;
         NTSTATUS status;
@@ -630 +630 @@
                                   struct pvfs_state);
         struct pvfs_search_state *search;
-        uint_t reply_count;
+        unsigned int reply_count;
         uint16_t max_count;
         const char *pattern;
@@ -667 +667 @@
 
         if (strequal("", f->handle->name->original_name)) {
-                pattern = talloc_asprintf(req, "\\%s", io->in.pattern);
+                pattern = talloc_asprintf(req, "%s", io->in.pattern);
                 NT_STATUS_HAVE_NO_MEMORY(pattern);
         } else {
-                pattern = talloc_asprintf(req, "\\%s\\%s",
+                pattern = talloc_asprintf(req, "%s\\%s",
                                           f->handle->name->original_name,
                                           io->in.pattern);
@@ -733 +733 @@
                                   struct pvfs_state);
         struct pvfs_search_state *search;
-        uint_t reply_count;
+        unsigned int reply_count;
         uint16_t max_count;
         NTSTATUS status;

trunk/server/source4/ntvfs/posix/pvfs_setfileinfo.c

@@ -90 +90 @@
         struct odb_lock *lck = NULL;
 
+        /* strangely, this gives a sharing violation, not invalid
+           parameter */
         if (info->rename_information.in.new_name[0] != ':') {
-                return NT_STATUS_INVALID_PARAMETER;
+                return NT_STATUS_SHARING_VIOLATION;
         }
 
@@ -107 +109 @@
 
         status = pvfs_stream_rename(pvfs, name, fd, 
-                                    info->rename_information.in.new_name+1);
+                                    info->rename_information.in.new_name+1,
+                                    info->rename_information.in.overwrite);
         return status;
 }
@@ -169 +172 @@
 
         /* resolve the new name */
-        status = pvfs_resolve_name(pvfs, name, new_name, 0, &name2);
+        status = pvfs_resolve_name(pvfs, req, new_name, 0, &name2);
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
@@ -532 +535 @@
                 mode = pvfs_fileperms(pvfs, newstats.dos.attrib);
                 if (!(h->name->dos.attrib & FILE_ATTRIBUTE_DIRECTORY)) {
-                        if (fchmod(h->fd, mode) == -1) {
+                        if (pvfs_sys_fchmod(pvfs, h->fd, mode) == -1) {
                                 return pvfs_map_errno(pvfs, errno);
                         }
@@ -857 +860 @@
         if (newstats.dos.attrib != name->dos.attrib) {
                 mode_t mode = pvfs_fileperms(pvfs, newstats.dos.attrib);
-                if (chmod(name->full_name, mode) == -1) {
+                if (pvfs_sys_chmod(pvfs, name->full_name, mode) == -1) {
                         return pvfs_map_errno(pvfs, errno);
                 }

trunk/server/source4/ntvfs/posix/pvfs_shortname.c

@@ -105 +105 @@
         /* this is used to reverse the base 36 mapping */
         unsigned char base_reverse[256];
-
-        struct smb_iconv_convenience *iconv_convenience;
 };
 
@@ -391 +389 @@
         while (*name) {
                 size_t c_size;
-                codepoint_t c = next_codepoint_convenience(ctx->iconv_convenience, name, &c_size);
+                codepoint_t c = next_codepoint(name, &c_size);
                 if (c == INVALID_CODEPOINT) {
                         return false;
@@ -616 +614 @@
         }
 
-        ctx->iconv_convenience = lp_iconv_convenience(pvfs->ntvfs->ctx->lp_ctx);
-
         /* by default have a max of 512 entries in the cache. */
-        ctx->cache_size = lp_parm_int(pvfs->ntvfs->ctx->lp_ctx, NULL, "mangle", "cachesize", 512);
+        ctx->cache_size = lpcfg_parm_int(pvfs->ntvfs->ctx->lp_ctx, NULL, "mangle", "cachesize", 512);
 
         ctx->prefix_cache = talloc_array(ctx, char *, ctx->cache_size);
@@ -633 +629 @@
         memset(ctx->prefix_cache_hashes, 0, sizeof(uint32_t) * ctx->cache_size);
 
-        ctx->mangle_prefix = lp_parm_int(pvfs->ntvfs->ctx->lp_ctx, NULL, "mangle", "prefix", -1);
+        ctx->mangle_prefix = lpcfg_parm_int(pvfs->ntvfs->ctx->lp_ctx, NULL, "mangle", "prefix", -1);
         if (ctx->mangle_prefix < 0 || ctx->mangle_prefix > 6) {
                 ctx->mangle_prefix = DEFAULT_MANGLE_PREFIX;

trunk/server/source4/ntvfs/posix/pvfs_streams.c

@@ -241 +241 @@
 */
 NTSTATUS pvfs_stream_rename(struct pvfs_state *pvfs, struct pvfs_filename *name, int fd,
-                            const char *new_name)
+                            const char *new_name, bool overwrite)
 {
         struct xattr_DosStreams *streams;
@@ -290 +290 @@
                 s->name = new_name;
         } else {
-                /* remove the old one and replace with the new one */
-                streams->streams[found_old].name = new_name;
-                memmove(&streams->streams[found_new],
-                        &streams->streams[found_new+1],
-                        sizeof(streams->streams[0]) *
-                        (streams->num_streams - (found_new+1)));
+                if (!overwrite) {
+                        return NT_STATUS_OBJECT_NAME_COLLISION;
+                }
+                if (found_old != found_new) {
+                        /* remove the old one and replace with the new one */
+                        streams->streams[found_old].name = new_name;
+                        memmove(&streams->streams[found_new],
+                                &streams->streams[found_new+1],
+                                sizeof(streams->streams[0]) *
+                                (streams->num_streams - (found_new+1)));
+                        streams->num_streams--;
+                }
         }
 
         status = pvfs_streams_save(pvfs, name, fd, streams);
-        talloc_free(streams);
+
+        if (NT_STATUS_IS_OK(status)) {
+
+                /* update the in-memory copy of the name of the open file */
+                talloc_free(name->stream_name);
+                name->stream_name = talloc_strdup(name, new_name);
+
+                talloc_free(streams);
+        }
 
         return status;
@@ -533 +547 @@
         status = pvfs_xattr_save(pvfs, name->full_name, fd, XATTR_DOSSTREAM_PREFIX,
                                  name->stream_name, &blob);
-        data_blob_free(&blob);
 
         if (NT_STATUS_IS_OK(status)) {
                 status = pvfs_stream_update_size(pvfs, name, fd, blob.length);
         }
+        data_blob_free(&blob);
 
         return status;

trunk/server/source4/ntvfs/posix/pvfs_unlink.c

@@ -110 +110 @@
                                  struct pvfs_filename *name)
 {
-        NTSTATUS status;
+        NTSTATUS status = NT_STATUS_OK;
 
         if (name->dos.attrib & FILE_ATTRIBUTE_DIRECTORY) {
@@ -124 +124 @@
 
         /* finally try the actual unlink */
-        if (unlink(name->full_name) == -1) {
+        if (pvfs_sys_unlink(pvfs, name->full_name) == -1) {
                 status = pvfs_map_errno(pvfs, errno);
         }

trunk/server/source4/ntvfs/posix/pvfs_util.c

@@ -103 +103 @@
         }
 
-        fd1 = open(name1->full_name, O_RDONLY);
+        fd1 = pvfs_sys_open(pvfs, name1->full_name, O_RDONLY, 0);
         if (fd1 == -1) {
                 talloc_free(buf);
@@ -109 +109 @@
         }
 
-        fd2 = open(name2->full_name, O_CREAT|O_EXCL|O_WRONLY, 0);
+        fd2 = pvfs_sys_open(pvfs, name2->full_name, O_CREAT|O_EXCL|O_WRONLY, 0);
         if (fd2 == -1) {
                 close(fd1);
@@ -134 +134 @@
                         close(fd2);
                         talloc_free(buf);
-                        unlink(name2->full_name);
+                        pvfs_sys_unlink(pvfs, name2->full_name);
                         if (ret2 == -1) {
                                 return pvfs_map_errno(pvfs, errno);
@@ -146 +146 @@
 
         mode = pvfs_fileperms(pvfs, name1->dos.attrib);
-        if (fchmod(fd2, mode) == -1) {
+        if (pvfs_sys_fchmod(pvfs, fd2, mode) == -1) {
                 status = pvfs_map_errno(pvfs, errno);
                 close(fd2);
-                unlink(name2->full_name);
+                pvfs_sys_unlink(pvfs, name2->full_name);
                 return status;
         }
@@ -159 +159 @@
         if (!NT_STATUS_IS_OK(status)) {
                 close(fd2);
-                unlink(name2->full_name);
+                pvfs_sys_unlink(pvfs, name2->full_name);
                 return status;
         }

trunk/server/source4/ntvfs/posix/pvfs_wait.c

@@ -103 +103 @@
         pwait->reason = PVFS_WAIT_TIMEOUT;
 
-        talloc_increase_ref_count(req);
-        ntvfs_async_setup(pwait->req, pwait);
-        talloc_free(req);
+        req = talloc_reference(ev, req);
+        if (req != NULL) {
+                ntvfs_async_setup(req, pwait);
+                talloc_unlink(ev, req);
+        }
 }
 

trunk/server/source4/ntvfs/posix/pvfs_xattr.c

@@ -118 +118 @@
 
         /* pull the blob */
-        ndr_err = ndr_pull_struct_blob(&blob, mem_ctx, lp_iconv_convenience(pvfs->ntvfs->ctx->lp_ctx), 
-                                       p, (ndr_pull_flags_fn_t)pull_fn);
+        ndr_err = ndr_pull_struct_blob(&blob, mem_ctx, p,
+                                                                   (ndr_pull_flags_fn_t)pull_fn);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                 return ndr_map_error2ntstatus(ndr_err);
@@ -141 +141 @@
         enum ndr_err_code ndr_err;
 
-        ndr_err = ndr_push_struct_blob(&blob, mem_ctx, lp_iconv_convenience(pvfs->ntvfs->ctx->lp_ctx), p, (ndr_push_flags_fn_t)push_fn);
+        ndr_err = ndr_push_struct_blob(&blob, mem_ctx, p, (ndr_push_flags_fn_t)push_fn);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                 talloc_free(mem_ctx);
@@ -177 +177 @@
         status = pvfs_xattr_ndr_load(pvfs, mem_ctx, name->full_name, 
                                      fd, XATTR_DOSATTRIB_NAME,
-                                     &attrib, 
-                                     (ndr_pull_flags_fn_t)ndr_pull_xattr_DosAttrib);
+                                     &attrib,
+                                     (void *) ndr_pull_xattr_DosAttrib);
 
         /* not having a DosAttrib is not an error */
@@ -272 +272 @@
         return pvfs_xattr_ndr_save(pvfs, name->full_name, fd, 
                                    XATTR_DOSATTRIB_NAME, &attrib, 
-                                   (ndr_push_flags_fn_t)ndr_push_xattr_DosAttrib);
+                                   (void *) ndr_push_xattr_DosAttrib);
 }
 
@@ -288 +288 @@
         }
         status = pvfs_xattr_ndr_load(pvfs, eas, name->full_name, fd, XATTR_DOSEAS_NAME,
-                                     eas, (ndr_pull_flags_fn_t)ndr_pull_xattr_DosEAs);
+                                     eas, (void *) ndr_pull_xattr_DosEAs);
         if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
                 return NT_STATUS_OK;
@@ -305 +305 @@
         }
         return pvfs_xattr_ndr_save(pvfs, name->full_name, fd, XATTR_DOSEAS_NAME, eas, 
-                                   (ndr_push_flags_fn_t)ndr_push_xattr_DosEAs);
+                                   (void *) ndr_push_xattr_DosEAs);
 }
 
@@ -323 +323 @@
                                      XATTR_DOSSTREAMS_NAME,
                                      streams, 
-                                     (ndr_pull_flags_fn_t)ndr_pull_xattr_DosStreams);
+                                     (void *) ndr_pull_xattr_DosStreams);
         if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
                 return NT_STATUS_OK;
@@ -342 +342 @@
                                    XATTR_DOSSTREAMS_NAME, 
                                    streams, 
-                                   (ndr_push_flags_fn_t)ndr_push_xattr_DosStreams);
+                                   (void *) ndr_push_xattr_DosStreams);
 }
 
@@ -360 +360 @@
                                      XATTR_NTACL_NAME,
                                      acl, 
-                                     (ndr_pull_flags_fn_t)ndr_pull_xattr_NTACL);
+                                     (void *) ndr_pull_xattr_NTACL);
         return status;
 }
@@ -383 +383 @@
                                      XATTR_NTACL_NAME, 
                                      acl, 
-                                     (ndr_push_flags_fn_t)ndr_push_xattr_NTACL);
+                                     (void *) ndr_push_xattr_NTACL);
         talloc_free(privs);
         return status;

trunk/server/source4/ntvfs/posix/vfs_posix.c

@@ -27 +27 @@
 #include "vfs_posix.h"
 #include "librpc/gen_ndr/security.h"
-#include "../tdb/include/tdb.h"
-#include "tdb_wrap.h"
+#include <tdb.h>
+#include "lib/util/tdb_wrap.h"
 #include "libcli/security/security.h"
 #include "lib/events/events.h"
@@ -40 +40 @@
         struct share_config *scfg = pvfs->ntvfs->ctx->config;
         const char *eadb;
+        bool def_perm_override = false;
 
         if (share_bool_option(scfg, SHARE_MAP_HIDDEN, SHARE_MAP_HIDDEN_DEFAULT))
@@ -60 +61 @@
                 pvfs->flags |= PVFS_FLAG_LINUX_AIO;
 
+#if defined(O_DIRECTORY) && defined(O_NOFOLLOW)
+        /* set PVFS_PERM_OVERRIDE by default only if the system
+         * supports the necessary capabilities to make it secure
+         */
+        def_perm_override = true;
+#endif
+        if (share_bool_option(scfg, PVFS_PERM_OVERRIDE, def_perm_override))
+                pvfs->flags |= PVFS_FLAG_PERM_OVERRIDE;
+
         /* file perm options */
         pvfs->options.create_mask       = share_int_option(scfg,
@@ -257 +267 @@
                                            pvfs->ntvfs->ctx->server_id,  
                                            pvfs->ntvfs->ctx->msg_ctx, 
-                                           pvfs->ntvfs->ctx->lp_ctx, 
+                                           pvfs->ntvfs->ctx->lp_ctx,
                                            pvfs->ntvfs->ctx->event_ctx,
                                            pvfs->ntvfs->ctx->config);

trunk/server/source4/ntvfs/posix/vfs_posix.h

@@ -41 +41 @@
 
         const char *share_name;
-        uint_t flags;
+        unsigned int flags;
 
         struct pvfs_mangle_context *mangle_ctx;
@@ -55 +55 @@
 
         /* the sharing violation timeout (nsecs) */
-        uint_t sharing_violation_delay;
+        unsigned int sharing_violation_delay;
 
         /* the oplock break timeout (secs) */
-        uint_t oplock_break_timeout;
+        unsigned int oplock_break_timeout;
 
         /* the write time update delay (nsecs) */
-        uint_t writetime_delay;
+        unsigned int writetime_delay;
 
         /* filesystem attributes (see FS_ATTR_*) */
@@ -85 +85 @@
 
                 /* how long to keep inactive searches around for */
-                uint_t inactivity_time;
+                unsigned int inactivity_time;
         } search;
 
@@ -125 +125 @@
 */
 struct pvfs_filename {
-        const char *original_name;
+        char *original_name;
         char *full_name;
-        const char *stream_name; /* does not include :$DATA suffix */
+        char *stream_name; /* does not include :$DATA suffix */
         uint32_t stream_id;      /* this uses a hash, so is probabilistic */
         bool has_wildcard;
@@ -183 +183 @@
         /* the open went through to completion */
         bool open_completed;
+
+        uint8_t private_flags;
 };
 
@@ -223 +225 @@
         uint16_t must_attrib;
         struct pvfs_dir *dir;
-        time_t last_used;
-        uint_t num_ea_names;
+        time_t last_used; /* monotonic clock time */
+        unsigned int num_ea_names;
         struct ea_name *ea_names;
         struct tevent_timer *te;
@@ -245 +247 @@
 #define PVFS_FLAG_FAKE_OPLOCKS   (1<<8)
 #define PVFS_FLAG_LINUX_AIO      (1<<9)
+#define PVFS_FLAG_PERM_OVERRIDE  (1<<10)
 
 /* forward declare some anonymous structures */
@@ -267 +270 @@
 #define PVFS_ACL                        "posix:acl"
 #define PVFS_AIO                        "posix:aio"
+#define PVFS_PERM_OVERRIDE              "posix:permission override"
 
 #define PVFS_XATTR_DEFAULT                      true

trunk/server/source4/ntvfs/posix/xattr_tdb.c

@@ -21 +21 @@
 
 #include "includes.h"
+#include "lib/util/tdb_wrap.h"
+#include <tdb.h>
 #include "vfs_posix.h"
-#include "../tdb/include/tdb.h"
-#include "tdb_wrap.h"
 
 #define XATTR_LIST_ATTR ".xattr_list"
@@ -31 +31 @@
   can automatically clean them up
 */
-static NTSTATUS xattr_tdb_add_list(struct pvfs_state *pvfs, const char *attr_name, 
+static NTSTATUS xattr_tdb_add_list(struct tdb_wrap *ea_tdb, TALLOC_CTX *ctx, const char *attr_name,
                                    const char *fname, int fd)
 {
@@ -44 +44 @@
         }
 
-        mem_ctx = talloc_new(pvfs);
-
-        status = pull_xattr_blob_tdb(pvfs, mem_ctx, XATTR_LIST_ATTR, 
+        mem_ctx = talloc_new(ctx);
+
+        status = pull_xattr_blob_tdb_raw(ea_tdb, mem_ctx, XATTR_LIST_ATTR,
                                      fname, fd, 100, &blob);
         if (!NT_STATUS_IS_OK(status)) {
@@ -69 +69 @@
         blob.length += len;
 
-        status = push_xattr_blob_tdb(pvfs, XATTR_LIST_ATTR, fname, fd, &blob);
+        status = push_xattr_blob_tdb_raw(ea_tdb,ctx, XATTR_LIST_ATTR, fname, fd, &blob);
         talloc_free(mem_ctx);
 
@@ -76 +76 @@
 
 /*
-  form a key for using in the ea_db
-*/
-static NTSTATUS get_ea_db_key(TALLOC_CTX *mem_ctx,
+  form a key for using in the ea_tdb
+*/
+static NTSTATUS get_ea_tdb_key(TALLOC_CTX *mem_ctx,
                               const char *attr_name,
                               const char *fname, int fd, 
@@ -109 +109 @@
 }
 
-/*
-  pull a xattr as a blob, using the ea_db tdb
-*/
-NTSTATUS pull_xattr_blob_tdb(struct pvfs_state *pvfs,
+
+
+/*
+  pull a xattr as a blob, using the ea_tdb_context tdb
+*/
+NTSTATUS pull_xattr_blob_tdb_raw(struct tdb_wrap *ea_tdb,
                              TALLOC_CTX *mem_ctx,
-                             const char *attr_name, 
-                             const char *fname, 
-                             int fd, 
+                             const char *attr_name,
+                             const char *fname,
+                             int fd,
                              size_t estimated_size,
                              DATA_BLOB *blob)
@@ -123 +125 @@
         NTSTATUS status;
 
-        status = get_ea_db_key(mem_ctx, attr_name, fname, fd, &tkey);
+        status = get_ea_tdb_key(mem_ctx, attr_name, fname, fd, &tkey);
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
         }
 
-        tdata = tdb_fetch(pvfs->ea_db->tdb, tkey);
+        tdata = tdb_fetch(ea_tdb->tdb, tkey);
         if (tdata.dptr == NULL) {
                 return NT_STATUS_NOT_FOUND;
@@ -142 +144 @@
 }
 
-/*
-  push a xattr as a blob, using ea_db
-*/
-NTSTATUS push_xattr_blob_tdb(struct pvfs_state *pvfs,
-                             const char *attr_name, 
-                             const char *fname, 
-                             int fd, 
+NTSTATUS pull_xattr_blob_tdb(struct pvfs_state *pvfs,
+                             TALLOC_CTX *mem_ctx,
+                             const char *attr_name,
+                             const char *fname,
+                             int fd,
+                             size_t estimated_size,
+                             DATA_BLOB *blob)
+{
+        return pull_xattr_blob_tdb_raw(pvfs->ea_db,mem_ctx,attr_name,fname,fd,estimated_size,blob);
+}
+
+/*
+  push a xattr as a blob, using ea_tdb
+*/
+NTSTATUS push_xattr_blob_tdb_raw(struct tdb_wrap *ea_tdb,
+                             TALLOC_CTX *mem_ctx,
+                             const char *attr_name,
+                             const char *fname,
+                             int fd,
                              const DATA_BLOB *blob)
 {
@@ -154 +168 @@
         NTSTATUS status;
 
-        status = get_ea_db_key(pvfs, attr_name, fname, fd, &tkey);
+        status = get_ea_tdb_key(mem_ctx, attr_name, fname, fd, &tkey);
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
@@ -162 +176 @@
         tdata.dsize = blob->length;
 
-        if (tdb_chainlock(pvfs->ea_db->tdb, tkey) != 0) {
+        if (tdb_chainlock(ea_tdb->tdb, tkey) != 0) {
                 talloc_free(tkey.dptr);
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
         }
 
-        status = xattr_tdb_add_list(pvfs, attr_name, fname, fd);
+        status = xattr_tdb_add_list(ea_tdb,mem_ctx, attr_name, fname, fd);
         if (!NT_STATUS_IS_OK(status)) {
                 goto done;
         }
 
-        if (tdb_store(pvfs->ea_db->tdb, tkey, tdata, TDB_REPLACE) == -1) {
+        if (tdb_store(ea_tdb->tdb, tkey, tdata, TDB_REPLACE) == -1) {
                 status = NT_STATUS_INTERNAL_DB_CORRUPTION;
         }
 
 done:
-        tdb_chainunlock(pvfs->ea_db->tdb, tkey);
+        tdb_chainunlock(ea_tdb->tdb, tkey);
         talloc_free(tkey.dptr);
         return status;  
 }
+NTSTATUS push_xattr_blob_tdb(struct pvfs_state *pvfs,
+                             const char *attr_name,
+                             const char *fname,
+                             int fd,
+                             const DATA_BLOB *blob)
+{
+        return push_xattr_blob_tdb_raw(pvfs->ea_db,pvfs,attr_name,fname,fd,blob);
+}
 
 
@@ -192 +214 @@
         NTSTATUS status;
 
-        status = get_ea_db_key(NULL, attr_name, fname, fd, &tkey);
+        status = get_ea_tdb_key(NULL, attr_name, fname, fd, &tkey);
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
@@ -218 +240 @@
         NTSTATUS status;
 
-        status = pull_xattr_blob_tdb(pvfs, mem_ctx, XATTR_LIST_ATTR, 
+        status = pull_xattr_blob_tdb(pvfs, mem_ctx, XATTR_LIST_ATTR,
                                      fname, -1, 100, &blob);
         if (!NT_STATUS_IS_OK(status)) {