s3/vfs: move ACE4_ADD_FILE/ACE4_DELETE_CHILD mapping from NFSv4 framework to vfs_zfsacl

This was added in e6a5f11865a55e9644292ae92e4a4b5ec0662ccd to adopt the
NFSv4 framework to follow ZFS permission rules. But this is the wrong
place, other filesystems like GPFS do not allow deletion when the user
has SEC_DIR_ADD_FILE.

This patch therefor moves the change from the NFS4 framework into the
ZFS module.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=6133

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Sep  9 04:59:51 CEST 2017 on sn-devel-144

diff --git a/source3/modules/nfs4_acls.c b/source3/modules/nfs4_acls.c
index 78861f5df6275aee9345ba632b6911877ac495c7..b755344322efbbabf2653a2ccd55fa2a4448e631 100644 (file)
--- a/source3/modules/nfs4_acls.c
+++ b/source3/modules/nfs4_acls.c
@@ -352,10 +352,6 @@ static bool smbacl4_nfs42win(TALLOC_CTX *mem_ctx,
                DEBUG(10, ("mapped %d to %s\n", ace->who.id,
                           sid_string_dbg(&sid)));
 
-               if (is_directory && (ace->aceMask & SMB_ACE4_ADD_FILE)) {
-                       ace->aceMask |= SMB_ACE4_DELETE_CHILD;
-               }
-
                if (!is_directory && params->map_full_control) {
                        /*
                         * Do we have all access except DELETE_CHILD

diff --git a/source3/modules/vfs_zfsacl.c b/source3/modules/vfs_zfsacl.c
index da13c4c4908c57426750b872787696ad54f5cafa..dd0f343b8c6b2e3b2d5ae064203437604b69e0bb 100644 (file)
--- a/source3/modules/vfs_zfsacl.c
+++ b/source3/modules/vfs_zfsacl.c
@@ -66,6 +66,10 @@ static NTSTATUS zfs_get_nt_acl_common(struct connection_struct *conn,
                psbuf = &sbuf;
        }
 
+       if (S_ISDIR(psbuf->st_ex_mode) && (ace->aceMask & SMB_ACE4_ADD_FILE)) {
+               ace->aceMask |= SMB_ACE4_DELETE_CHILD;
+       }
+
        /* read the number of file aces */
        if((naces = acl(smb_fname->base_name, ACE_GETACLCNT, 0, NULL)) == -1) {
                if(errno == ENOSYS) {