ACLs for CIFS/SMB shares [PSARC/2008/641 FastTrack timeout 10/27/2008]

[Tim Haley]

I am sponsoring the following fasttrack for Doug McCallum.  The case
introduces ACLs to control access to SMB shares.  Requested binding is
minor.  Timeout is 10/27/2008.

Template Version: @(#)sac_nextcase %I% %G% SMI
This information is Copyright 2008 Sun Microsystems
1. Introduction
    1.1. Project/Component Working Name:
	 ACLs for CIFS/SMB shares
    1.2. Name of Document Author/Supplier:
	 Author:  Doug McCallum
    1.3  Date of This Document:
	20 October, 2008

2. Project Summary
   2.1. Project Description:
	Project is to provide ACLs at the CIFS/SMB "share" level.
	This is a standard feature in Microsoft implementations and
	is needed for completeness. ACLs on shares will only be supported
	on ZFS file systems.

   2.2. Risks and Assumptions:
	Assumes changes to ZFS to provide a place to store the share
	ACLs.

4. Technical Description:

    4.1. Details:

	During SMB "tree connect" is will be necessary to get the ACL
	that is set on a share and use it to setup the initial access.
	The ACLs are expected to be stored in objects within a new
	directory under .zfs. /dataset/.zfs/shares/ will contain
	objects with names that match the shares defined on that
	dataset. Just before the tree connect, the sharename will be
	looked up in the .zfs/shares directory, the ACLs obtained and
	then processed relative to the user making the tree
	connect. The result of processing the ACL will be used to
	determine access.

	The ZFS changes will include a means to create/remove the
	share objects within the new .zfs/shares directory. Once
	created, it will also be possible to use the standard ACL
	interfaces to get/set ACLs on these new objects. That is,
	chmod and ls will be used.

	Note that there can be multiple shares (resources) for any
	given path that is shared. This mechanism allows setting
	different ACLs for the same path depending on the name it is
	associated with.

	CIFS is the only protocol we currently support that has the
	concept of shares (resources in sharemgr/share terms) so this
	implementation will initially only provide support for CIFS.


    4.2. Bug/RFE Number(s):
	6582163 Access Control List (ACL) for Shares
    
    4.3. In Scope:
	Only ZFS file systems will be supported.

    4.4. Out of Scope:
    
    4.5. Interfaces:
	Standard ACL interfaces will be used (ls, chmod).
    
    4.6. Doc Impact:
	CIFS Administration Guide

        Modification to the zfs(1M) man page:
	----------------------------------------------------------

         When the "sharesmb" property is changed for  a  dataset,
         the dataset and any children inheriting the property are
         re-shared with the new options, only if the property was
         previously  set  to "off", or if they were shared before
         the property was changed. If the new property is set  to
         "off", the file systems are unshared.

+	 When SMB shares are created, the SMB share name appears as an
+	 entry in the .zfs/shares directory. You can use the ls or
+	 chmod command to display the share-level ACLs on the entries
+	 in this directory.

	----------------------------------------------------------

    
    4.7. Admin/Config Impact:
    	N/A
    
    4.8. HA Impact:
	N/A
    
    4.9. I18N/L10N Impact:
	N/A
    
    4.10. Packaging & Delivery:
	N/A (existing packages will be used)
    
    4.11. Security Impact:
	Doesn't change any existing security APIs or features. It does
	add an additional security mechanism.
    
    4.12. Dependencies:
	N/A

6. Resources and Schedule
    6.4. Steering Committee requested information
   	6.4.1. Consolidation C-team Name:
		ON
    6.5. ARC review type: FastTrack
    6.6. ARC Exposure: open