1Configuring NFS4 ACLs in Samba3 2=============================== 3Created: Peter Somogyi, 2006-JUN-06 4Last modified: Peter Somogyi, 2006-JUL-20 5Revision no.: 4 6------------------------------- 7 8 9Parameters in smb.conf: 10======================= 11 12Each parameter must have a prefix "nfs4:". 13Each one affects the behaviour only when _setting_ an acl on a file/dir: 14 15mode = [simple|special] 16- simple: don't use OWNER@ and GROUP@ special IDs in ACEs. - default 17- special: use OWNER@ and GROUP@ special IDs in ACEs instead of simple user&group ids. 18Note: EVERYONE@ is always processed (if found such an ACE). 19Note2: special mode will have side effect when _only_ chown is performed. Later this may be worked out. 20 21Use "simple" mode when the share is used mainly by windows users and unix side is not significant. You will loose unix bits in this case. 22It's strongly advised setting "store dos attributes = yes" in smb.conf. 23 24chown = [true|false] 25- true => enable changing owner and group - default. 26- false => disable support for changing owner or group 27 28acedup = [dontcare|reject|ignore|merge] 29- dontcare: copy ACEs as they come, don't care with "duplicate" records. Default. 30- reject: stop operation, exit acl setter operation with an error 31- ignore: don't include the second matching ACE 32- merge: OR 2 ace.flag fields and 2 ace.mask fields of the 2 duplicate ACEs into 1 ACE 33 34Two ACEs are considered here "duplicate" when their type and id fields are matching. 35 36Example: 37 38[smbtest] 39path = /tests/psomogyi/smbtest 40writable = yes 41vfs objects = aixacl2 42nfs4: mode = special 43nfs4: chown = yes 44nfs4: acedup = merge 45 46Configuring AIX ACL support 47============================== 48 49Binaries: (default install path is [samba]/lib/vfs/) 50- aixacl.so: provides AIXC ACL support only, can be compiled and works on all AIX platforms 51- aixacl2.so: provides AIXC and JFS2-NFS4 ACL support, can be compiled and works only under AIX 5.3 and newer. 52NFS4 acl currently has support only under JFS2 (ext. attr. format must be set to v2). 53aixacl2.so always detects support for NFS4 acls and redirects to POSIX ACL handling automatically when NFS4 is not supported for a path. 54 55Adding "vfs objects = aixacl2" to a share should be done only in case when NFS4 is really supported by the filesystem. 56(Otherwise you may get performance loss.) 57 58For configuration see also the example above. 59 60General notes 61============= 62 63NFS4 handling logic is separated from AIX/jfs2 ACL parsing. 64 65Samba and its VFS modules dosn't reorder ACEs. Windows clients do that (and the smbcacl tool). MSDN also says deny ACEs must come first. 66NFS4 ACL's validity is checked by the system API, not by Samba. 67NFS4 ACL rights are enforced by the OS or filesystem, not by Samba. 68 69The flag INHERITED_ACE is never set (not required, as doesn't do WinNT/98/me, only since Win2k). 70Win2k GUI behaves strangely when detecting inheritance (sometimes it doesn't detect, 71but after adding an ace it shows that - it's some GUI error). 72 73Unknown (unmappable) SIDs are not accepted. 74 75TODOs 76===== 77- Creator Owner & Group SID handling (same way as posix) 78- the 4 generic rights bits support (GENERIC_RIGHT_READ_ACCESS, WRITE, EXEC, ALL) 79- chown & no ACL, but we have ONWER@ and GROUP@ 80- DIALUP, ANONYMOUS, ... builtin SIDs 81- audit & alarm support - in theory it's forwarded so it should work, but currently there's no platform which supports them to test 82- support for a real NFS4 client (we don't have an accepted API yet) 83