Update WHATSNEW.txt to explain the vfs_widelinks module addition.

[samba.git] / WHATSNEW.txt

diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index e9b269209f0c41975354dfb777ca80376b3f9b64..e47f0806332bae41b3827e3ede18531d9ad5b6e3 100644 (file)
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -27,6 +27,30 @@ we test with in our CI infrastructure.
 (Build time support for the file server with Python 2.6 has not
 changed)
 
+wide links functionality
+------------------------
+
+For this release, the code implementing the insecure "wide links = yes"
+functionality has been moved out of the core smbd code and into a separate
+VFS module, vfs_widelinks. Currently this vfs module is implicitly loaded
+by smbd as the last but one module before vfs_default if "wide links = yes"
+is enabled on the share (note, the existing restrictions on enabling wide
+links around the SMB1 "unix extensions" and the "allow insecure wide links"
+parameters are still in force). The implicit loading was done to allow
+existing users of "wide links = yes" to keep this functionality without
+having to make a change to existing working smb.conf files.
+
+Please note that the Samba developers recommend changing any Samba
+installations that currently use "wide links = yes" to use bind mounts
+as soon as possible, as "wide links = yes" is an inherently insecure
+configuration which we would like to remove from Samba. Moving the
+feature into a VFS module allows this to be done in a cleaner way
+in future.
+
+A future release to be determined will remove this implicit linkage,
+causing administrators who need this functionality to have to explicitly
+add the vfs_widelinks module into the "vfs objects =" parameter lists.
+The release notes will be updated to note this change when it occurs.
 
 REMOVED FEATURES
 ================