s3/vfs: move ACE4_ADD_FILE/ACE4_DELETE_CHILD mapping from NFSv4 framework to vfs_zfsacl

This was added in e6a5f11865a55e9644292ae92e4a4b5ec0662ccd to adopt the
NFSv4 framework to follow ZFS permission rules. But this is the wrong
place, other filesystems like GPFS do not allow deletion when the user
has SEC_DIR_ADD_FILE.

This patch therefor moves the change from the NFS4 framework into the
ZFS module.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=6133

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Sep  9 04:59:51 CEST 2017 on sn-devel-144

(cherry picked from commit 4102697503691f3b2eadfcb98834bb66c669f3ab)

diff --git a/source3/modules/nfs4_acls.c b/source3/modules/nfs4_acls.c
index 7488b1c9606d47baffad16731898c84cf1146b45..6a337177626661860a64301f190e3bdfddcf77c4 100644 (file)
--- a/source3/modules/nfs4_acls.c
+++ b/source3/modules/nfs4_acls.c
@@ -352,10 +352,6 @@ static bool smbacl4_nfs42win(TALLOC_CTX *mem_ctx,
                DEBUG(10, ("mapped %d to %s\n", ace->who.id,
                           sid_string_dbg(&sid)));
 
-               if (is_directory && (ace->aceMask & SMB_ACE4_ADD_FILE)) {
-                       ace->aceMask |= SMB_ACE4_DELETE_CHILD;
-               }
-
                if (!is_directory && params->map_full_control) {
                        /*
                         * Do we have all access except DELETE_CHILD

diff --git a/source3/modules/vfs_zfsacl.c b/source3/modules/vfs_zfsacl.c
index e59b0bbfb4a13f8b9e4488e64c65769e3d515149..dca8f83303b690a0e9bd193467da446b8a111a32 100644 (file)
--- a/source3/modules/vfs_zfsacl.c
+++ b/source3/modules/vfs_zfsacl.c
@@ -66,6 +66,10 @@ static NTSTATUS zfs_get_nt_acl_common(struct connection_struct *conn,
                psbuf = &sbuf;
        }
 
+       if (S_ISDIR(psbuf->st_ex_mode) && (ace->aceMask & SMB_ACE4_ADD_FILE)) {
+               ace->aceMask |= SMB_ACE4_DELETE_CHILD;
+       }
+
        /* read the number of file aces */
        if((naces = acl(smb_fname->base_name, ACE_GETACLCNT, 0, NULL)) == -1) {
                if(errno == ENOSYS) {