1VFS_ACL_XATTR(8) System Administration tools VFS_ACL_XATTR(8)
2
6 vfs_acl_xattr - Save NTFS-ACLs in Extended Attributes (EAs)
7
9 vfs objects = acl_xattr
10
12 This VFS module is part of the samba(7) suite.
13 This module is made for systems which do not support standardized NFS4
15 ACLs but only a deprecated POSIX ACL draft implementation. This is
16 usually the case on Linux systems. Systems that do support just use
17 NFSv4 ACLs directly instead of this module. Such support is usually
18 provided by the filesystem VFS module specific to the underlying
19 filesystem that supports NFS4 ACLs
20 The vfs_acl_xattr VFS module stores NTFS Access Control Lists (ACLs) in
22 Extended Attributes (EAs). This enables the full mapping of Windows
23 ACLs on Samba servers even if the ACL implementation is not capable of
24 doing so.
25 The NT ACLs are stored in the security.NTACL extended attribute of
27 files and directories in a form containing the Windows SID representing
28 the users and groups in the ACL. This is different from the uid and
29 gids stored in local filesystem ACLs and the mapping from users and
30 groups to Windows SIDs must be consistent in order to maintain the
31 meaning of the stored NT ACL That extended attribute is not listed by
32 the Linux command getfattr -d filename. To show the current value, the
33 name of the EA must be specified (e.g. getfattr -n security.NTACL
34 filename).
35 This module forces the following parameters:
37 • inherit acls = true
39 • dos filemode = true
41 • force unknown acl user = true
43 This module is stackable.
46
48 acl_xattr:security_acl_name = NAME
49 This option allows to redefine the default location for the NTACL
50 extended attribute (xattr). If not set, NTACL xattrs are written to
51 security.NTACL which is a protected location, which means the
52 content of the security.NTACL attribute is not accessible from
53 normal users outside of Samba. When this option is set to use a
54 user-defined value, e.g. user.NTACL then any user can potentially
55 access and overwrite this information. The module prevents access
56 to this xattr over SMB, but the xattr may still be accessed by
57 other means (eg local access, SSH, NFS). This option must only be
58 used when this consequence is clearly understood and when specific
59 precautions are taken to avoid compromising the ACL content.
60 acl_xattr:ignore system acls = [yes|no]
62 When set to yes, a best effort mapping from/to the POSIX draft ACL
63 layer will not be done by this module. The default is no, which
64 means that Samba keeps setting and evaluating both the system ACLs
65 and the NT ACLs. This is better if you need your system ACLs be set
66 for local or NFS file access, too. If you only access the data via
67 Samba you might set this to yes to achieve better NT ACL
68 compatibility.
69 If acl_xattr:ignore system acls is set to yes, the following
71 additional settings will be enforced:
72 • create mask = 0666
74 • directory mask = 0777
76 • map archive = no
78 • map hidden = no
80 • map readonly = no
82 • map system = no
84 • store dos attributes = yes
86 acl_xattr:default acl style = [posix|windows|everyone]
89 This parameter determines the type of ACL that is synthesized in
90 case a file or directory lacks an security.NTACL xattr.
91 When set to posix, an ACL will be synthesized based on the POSIX
93 mode permissions for user, group and others, with an additional ACE
94 for NT Authority\SYSTEM will full rights.
95 When set to windows, an ACL is synthesized the same way Windows
97 does it, only including permissions for the owner and NT
98 Authority\SYSTEM.
99 When set to everyone, an ACL is synthesized giving full permissions
101 to everyone (S-1-1-0).
102 The default for this option is posix.
104
106 The original Samba software and related utilities were created by
107 Andrew Tridgell. Samba is now developed by the Samba Team as an Open
108 Source project similar to the way the Linux kernel is developed.
109Samba 4.19.3 11/27/2023 VFS_ACL_XATTR(8)