I am sponsoring the following fasttrack for Doug McCallum. The case
introduces ACLs to control access to SMB shares. Requested binding is
minor. Timeout is 10/27/2008.
Template Version: @(#)sac_nextcase %I% %G% SMI
This information is Copyright 2008 Sun Microsystems
1. Introduction
1.1. Project/Component Working Name:
ACLs for CIFS/SMB shares
1.2. Name of Document Author/Supplier:
Author: Doug McCallum
1.3 Date of This Document:
20 October, 2008
2. Project Summary
2.1. Project Description:
Project is to provide ACLs at the CIFS/SMB "share" level.
This is a standard feature in Microsoft implementations and
is needed for completeness. ACLs on shares will only be supported
on ZFS file systems.
2.2. Risks and Assumptions:
Assumes changes to ZFS to provide a place to store the share
ACLs.
4. Technical Description:
4.1. Details:
During SMB "tree connect" is will be necessary to get the ACL
that is set on a share and use it to setup the initial access.
The ACLs are expected to be stored in objects within a new
directory under .zfs. /dataset/.zfs/shares/ will contain
objects with names that match the shares defined on that
dataset. Just before the tree connect, the sharename will be
looked up in the .zfs/shares directory, the ACLs obtained and
then processed relative to the user making the tree
connect. The result of processing the ACL will be used to
determine access.
The ZFS changes will include a means to create/remove the
share objects within the new .zfs/shares directory. Once
created, it will also be possible to use the standard ACL
interfaces to get/set ACLs on these new objects. That is,
chmod and ls will be used.
Note that there can be multiple shares (resources) for any
given path that is shared. This mechanism allows setting
different ACLs for the same path depending on the name it is
associated with.
CIFS is the only protocol we currently support that has the
concept of shares (resources in sharemgr/share terms) so this
implementation will initially only provide support for CIFS.
4.2. Bug/RFE Number(s):
6582163 Access Control List (ACL) for Shares
4.3. In Scope:
Only ZFS file systems will be supported.
4.4. Out of Scope:
4.5. Interfaces:
Standard ACL interfaces will be used (ls, chmod).
4.6. Doc Impact:
CIFS Administration Guide
Modification to the zfs(1M) man page:
----------------------------------------------------------
When the "sharesmb" property is changed for a dataset,
the dataset and any children inheriting the property are
re-shared with the new options, only if the property was
previously set to "off", or if they were shared before
the property was changed. If the new property is set to
"off", the file systems are unshared.
+ When SMB shares are created, the SMB share name appears as an
+ entry in the .zfs/shares directory. You can use the ls or
+ chmod command to display the share-level ACLs on the entries
+ in this directory.
----------------------------------------------------------
4.7. Admin/Config Impact:
N/A
4.8. HA Impact:
N/A
4.9. I18N/L10N Impact:
N/A
4.10. Packaging & Delivery:
N/A (existing packages will be used)
4.11. Security Impact:
Doesn't change any existing security APIs or features. It does
add an additional security mechanism.
4.12. Dependencies:
N/A
6. Resources and Schedule
6.4. Steering Committee requested information
6.4.1. Consolidation C-team Name:
ON
6.5. ARC review type: FastTrack
6.6. ARC Exposure: open
