Add acl_xattr:ignore system acls boolean (normally false) to allow Samba ACL module...

Jeremy.

diff --git a/source3/modules/vfs_acl_common.c b/source3/modules/vfs_acl_common.c
index 7629a3eb0a0b249e20c79934f5f7bbdf014ea6cb..c91765caa5697f452dfc939aa1dc2a4a6c48269f 100644 (file)
--- a/source3/modules/vfs_acl_common.c
+++ b/source3/modules/vfs_acl_common.c
@@ -254,6 +254,10 @@ static NTSTATUS get_nt_acl_internal(vfs_handle_struct *handle,
        uint8_t hash_tmp[XATTR_SD_HASH_SIZE];
        struct security_descriptor *psd = NULL;
        struct security_descriptor *pdesc_next = NULL;
+       bool ignore_file_system_acl = lp_parm_bool(SNUM(handle->conn),
+                                               ACL_MODULE_NAME,
+                                               "ignore system acls",
+                                               false);
 
        if (fsp && name == NULL) {
                name = fsp->fsp_name->base_name;
@@ -317,6 +321,9 @@ static NTSTATUS get_nt_acl_internal(vfs_handle_struct *handle,
                        goto out;
        }
 
+       if (ignore_file_system_acl) {
+               goto out;
+       }
 
        status = hash_sd_sha256(pdesc_next, hash_tmp);
        if (!NT_STATUS_IS_OK(status)) {
@@ -353,28 +360,45 @@ static NTSTATUS get_nt_acl_internal(vfs_handle_struct *handle,
                 * inheritable ACE entries we have to fake them.
                 */
                if (fsp) {
-                       is_directory = fsp->is_directory;
+                       status = vfs_stat_fsp(fsp);
+                       if (!NT_STATUS_IS_OK(status)) {
+                               return status;
+                       }
                        psbuf = &fsp->fsp_name->st;
                } else {
-                       if (vfs_stat_smb_fname(handle->conn,
+                       int ret = vfs_stat_smb_fname(handle->conn,
                                                name,
-                                               &sbuf) == 0) {
-                               is_directory = S_ISDIR(sbuf.st_ex_mode);
+                                               &sbuf);
+                       if (ret == -1) {
+                               return map_nt_error_from_unix(errno);
                        }
                }
-               if (is_directory &&
+               is_directory = S_ISDIR(sbuf.st_ex_mode);
+
+               if (ignore_file_system_acl) {
+                       TALLOC_FREE(pdesc_next);
+                       status = make_default_filesystem_acl(talloc_tos(),
+                                               name,
+                                               psbuf,
+                                               &psd);
+                       if (!NT_STATUS_IS_OK(status)) {
+                               return status;
+                       }
+               } else {
+                       if (is_directory &&
                                !sd_has_inheritable_components(psd,
                                                        true)) {
-                       add_directory_inheritable_components(handle,
+                               add_directory_inheritable_components(handle,
                                                        name,
                                                        psbuf,
                                                        psd);
+                       }
+                       /* The underlying POSIX module always sets
+                          the ~SEC_DESC_DACL_PROTECTED bit, as ACLs
+                          can't be inherited in this way under POSIX.
+                          Remove it for Windows-style ACLs. */
+                       psd->type &= ~SEC_DESC_DACL_PROTECTED;
                }
-               /* The underlying POSIX module always sets
-                  the ~SEC_DESC_DACL_PROTECTED bit, as ACLs
-                  can't be inherited in this way under POSIX.
-                  Remove it for Windows-style ACLs. */
-               psd->type &= ~SEC_DESC_DACL_PROTECTED;
        }
 
        if (!(security_info & OWNER_SECURITY_INFORMATION)) {

diff --git a/source3/modules/vfs_acl_tdb.c b/source3/modules/vfs_acl_tdb.c
index 8da0d1e3ee965962acda3b402334b9f37f986ecd..1dbb3bea803863e1173cfe070486dd95c3f5410c 100644 (file)
--- a/source3/modules/vfs_acl_tdb.c
+++ b/source3/modules/vfs_acl_tdb.c
@@ -28,6 +28,7 @@
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_VFS
 
+#define ACL_MODULE_NAME "acl_tdb"
 #include "modules/vfs_acl_common.c"
 
 static unsigned int ref_count;

diff --git a/source3/modules/vfs_acl_xattr.c b/source3/modules/vfs_acl_xattr.c
index 18f2d42784b6bf2f9de7b7f815e0e865439a4327..e486e2064db7cd80c480e2ffccb2e1d779ac6cd2 100644 (file)
--- a/source3/modules/vfs_acl_xattr.c
+++ b/source3/modules/vfs_acl_xattr.c
@@ -29,6 +29,8 @@
 #define DBGC_CLASS DBGC_VFS
 
 /* Pull in the common functions. */
+#define ACL_MODULE_NAME "acl_xattr"
+
 #include "modules/vfs_acl_common.c"
 
 /*******************************************************************