similar to: Skip ACL checks

On Fri, Mar 17, 2017 at 1:54 PM, Volker Lendecke <vl at samba.org> wrote: > On Thu, Mar 16, 2017 at 05:38:57PM +0100, Christoph Kleineweber wrote: > > I am wondering if there is a way to bypass Samba's ACL checks and > delegate > > access control completely to the underlying file system. > > > > My problem arises from the following scenario: Our file system

On Mon, Mar 20, 2017 at 3:29 PM, Volker Lendecke <vl at samba.org> wrote: > On Mon, Mar 20, 2017 at 03:23:47PM +0100, Christoph Kleineweber wrote: > > The nfs4-acl-tools make also use of xattrs to access ACLs. The ACL itself > > is XDR encoded, so access could be done directly by a VFS module and does > > not require the executable. > > This sounds as if it would

> > > > > I am wondering if there is a way to bypass Samba's ACL checks and > > > delegate > > > > access control completely to the underlying file system. > > > > > > > > My problem arises from the following scenario: Our file system > implements > > > > ACLs that are to the best of my knowledge currently not readable

On Fri, Apr 06, 2018 at 12:40:31PM -0700, Jeremy Allison wrote: > On Fri, Apr 06, 2018 at 09:22:17PM +0200, Ralph Böhme wrote: > > On Fri, Apr 06, 2018 at 10:27:32AM -0700, Jeremy Allison via samba wrote: > > > On Fri, Apr 06, 2018 at 01:44:50PM +0530, Akash Jain wrote: > > > > Hi All > > > > > > > > I found there is one bug in the plugin. The

On Mon, 2017-03-20 at 10:57 +0100, Christoph Kleineweber via samba wrote: > On Fri, Mar 17, 2017 at 1:54 PM, Volker Lendecke <vl at samba.org> > wrote: > > > On Thu, Mar 16, 2017 at 05:38:57PM +0100, Christoph Kleineweber > > wrote: > > > I am wondering if there is a way to bypass Samba's ACL checks and > > > > delegate > > > access

Hello All I am trying to use nfs4acl_xattr plugin from samba source code. https://www.samba.org/samba/docs/current/man-html/vfs_nfs4acl_xattr.8.html I mounted NFSv4 mount point locally and exported it through samba with vfs objects set to nfs4acl_xattr. *[root at test3 ajain]# net conf showshare local[local] path = /home/ajain/mount comment = local share guest ok =

Hi All I found there is one bug in the plugin. The name of the attribute for ACL as per strace output of nfs4_setfacl is *system.nfs4_acl.* The source code has defined it as #define NFS4ACL_XATTR_NAME ( "system.nfs4acl" ) Note there is missing underscore. After this, the EOPNOTSUPP error is not observed. Hope this helps Akash On Thu, Apr 5, 2018 at 11:43 PM, Jeremy Allison

On Wed, 10 Oct 2018 09:25:16 +0200 "L.P.H. van Belle via samba" <samba at lists.samba.org> wrote: > Hai, > > Hmm.. Bummer.. > I just discovered the debian package dont have the vfs_nfs4acl > include in the build. > > And because of that it's not in my packages. I'll have a look into > it, see what i can make of it. > That is odd, it

On 16/03/2020 13:50, Marcio Demetrio Bacci wrote: > Hi, > > >Is this the machine that you cannot set the permissions on ? > Yes. > > >If so, what is the filesystem ? > Ext4 for SO and Ext4 for shared files, but I have created a pool ZFS > on this last filesystem (/dev/vdb1). > If zfs is involved in any way, you will have problems, zfs uses nfs4acls, you could try

On Fri, Apr 06, 2018 at 10:27:32AM -0700, Jeremy Allison via samba wrote: > On Fri, Apr 06, 2018 at 01:44:50PM +0530, Akash Jain wrote: > > Hi All > > > > I found there is one bug in the plugin. The name of the attribute for ACL as > > per strace output of nfs4_setfacl is system.nfs4_acl. > > The source code has defined it as > > #define

Am 3/16/20 um 3:04 PM schrieb Ralph Boehme via samba: > Am 3/16/20 um 2:59 PM schrieb Rowland penny via samba: >> On 16/03/2020 13:50, Marcio Demetrio Bacci wrote: >>> Hi, >>> >>>> Is this the machine that you cannot set the permissions on ? >>> Yes. >>> >>>> If so, what is the filesystem ? >>> Ext4 for SO and Ext4 for

Is nfs4acl_xattr available in any version of samba? I just upgraded to 4.9.6 but it doesn’t seem to be baked in.

Hello In the Samba Wiki page "https://wiki.samba.org/index.php/NFS4_ACL_overview" we can read the following: "If you use the Samba vfs module acl_xattr, you can use the full Windows ACL features but you will not be able to manage the ACLs on the OS of the Samba host directly and you will not have the permissions enforced by the filesystem. Samba is doing permission management in

Hello, I'm running a PDC and a secondary DC in privilegded lxc containers and try to setup a fileserver in an unprivileged lxc container. The shares of the file server are on the ZFS of the host and mapped via bind-mount. I've got the problem, that I get error messages when setting the ACLs of a samba share either via the Windows explorer or using the smbcacls command. On Windows

hi there - is it possible to share a directory via samba and (kernel-)nfsv4 in parallel and make samba use (ie.: read, write and enforce) nfsv4 acls to implement winnt-acls? i know that using nfs3 and posix acls is working halfway okay, but couldn't find anything useful for nfsv4 and the associated acls - sorry if i missed something obvious. i played around with the nfs4acl_xattr and

On Fri, Apr 06, 2018 at 01:44:50PM +0530, Akash Jain wrote: > Hi All > > I found there is one bug in the plugin. The name of the attribute for ACL as > per strace output of nfs4_setfacl is system.nfs4_acl. > The source code has defined it as > #define NFS4ACL_XATTR_NAME      ( "system.nfs4acl" ) > > Note there is missing underscore. > > After this, the

> Samba provides the "nfs4acl_xattr" vfs module precisely for that. I am not an expert in Windows ACL, but where do you see that the nfs4acl_xattr vfs module provides the support for "manage the ACLs on the OS of the Samba host directly?" From the Wiki page, https://wiki.samba.org/index.php/NFS4_ACL_overview, it implies the following four operation modes are possible.

Two attached patches for samba 2.2.7a and 3.0-alfa22, that I've made today, fix 3 bugs mentioned in my previous e-mail. 1) For each file in addition to ALLOW ACE proper DENY ACE is created. 2) "Take ownership" is shown DENIED for all except root ACEs 3) Read Permissions and read attributes are always shown as allowed, as they are actually allowed. -- Zhitomirsky

On 16/03/2020 01:55, Marcio Demetrio Bacci via samba wrote: > Hi, > > I think the error is in converting the POSIx ACl, but I don't know how to > fix this. You posted: My two DC are Samba4 (migrated of the Windows 2008 Server) and my current File Servers are Windows 2008 Server. Yet, you have a Unix domain member: netbios name = SRV-FILESERVER Is this the machine that you

Hi Ralph Thanks a lot. With xattr_tdb I could at least list the files getting rid of access denied error. I still do not see the exactly mapped ACEs in the Security Descriptor of a file in Windows Explorer but I will debug that little further and then come back with questions. I see only 1 entry of Everyone on Windows client side if there are added ACEs using nfs4_setfacl. Let me know if that