Documentation updates

diff --git a/NEWS b/NEWS
index 1ff6440fe24dc90d64d6ecde12e4df5c2aa82aac..9212153a33c0a5a47f8b0b6843169f3fa1e14af5 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,9 @@
+Changes in 2.2
+==============
+
+* NEW: afpd: dynamic directoy cache
+* NEW: afpd: POSIX 1e ACL support
+
 Changes in 2.1.2
 ================
 

diff --git a/doc/README.ACLs b/doc/README.ACLs
index 6c477251f354a99024eec48fd4eba6ab15084fde..64066e2de711fa354d4a9dab1a13b3786b41d187 100644 (file)
--- a/doc/README.ACLs
+++ b/doc/README.ACLs
@@ -2,16 +2,14 @@
                  ACLs - Konfiguration and Infos vor Developpers
                  ==============================================
 
-ACL support for AFP is implemented with NFSv4 ACLs. Few filesystems and fewer OSes support
-these. At the time of implementation its only provided with ZFS on Solaris, Opensolaris and
-derived distributions.
+ACL support for AFP is implemented for Solaris/ZFS/NFSv4 ACLs and POSIX 1e ACLs.
 
   Configuration
   -------------
 
 In order to be able to support ACLs, the following things have to be configured:
 
-1. ZFS Volumes
+1. For Solaris/ZFS: ZFS Volumes
 2. Authentication Domain
 3. Netatalk Volumes
 
@@ -34,18 +32,11 @@ In order to be able to support ACLs, the following things have to be configured:
 
      In other words:
       - you need an Open Directory Server or an LDAP server where you store UUIDs in some
-       attribute
+        attribute
       - your clients must be configured to use this server 
-      - your server should be configured to use this server via nsswitch and PAM. This
-       however is not a strict requirement: 
-       if you create duplicates of every LDAP/OD user and group with identic attributes
-       (name, uid, gid) in your local data store (/etc/[passwd|group]) things will work
-
-             *  as long as user/group names/ids in the filesystem are equal  *
-             *         to their counterparts in the LDAP/OD datastore        *
-
+      - your server should be configured to use this server via nsswitch and PAM
       - configure Netatalk via afp_ldap.conf so that Netatalk is able to retrieve the UUID
-       for users and groups via LDAP search queries
+        for users and groups via LDAP search queries
 
   3. Netatalk Volumes
 
@@ -66,19 +57,17 @@ Some implementation details that are buried in the code are worthwhile to be doc
      Basically as far as implementing AFP support is concerned they're equivalent.
      Subtleties arise at other places:
 
-     FPAccess
-
-       The AFP client frequently checks the (DARWIN_)ACE_DELETE_CHILD right. This is most
-       often not explicitly granted via an ACE. Therefor the client would get an no access
-        error. The client in turn then declares the object in question read only.
-       Thus we have to the check the mode for every directory and add ACE_DELETE_CHILD if
-       the requestor has write permissions.
-
-     FPGetFileDirParms
-
-       10.5 does not only use unix mode and FPAccess for permission check, but also OS 9
-       access bits from FPGetFileDirParms. Thus we have to adjust the Access Rights bitmap
-       user bits by including any ACL rigths.
+     * FPAccess:
+     The (10.5) AFP client frequently checks the (DARWIN_)ACE_DELETE_CHILD right. This is most
+     often not explicitly granted via an ACE. Therefor the client would get an no access
+     error. The client in turn then declares the object in question read only.
+     Thus we have to the check the mode for every directory and add ACE_DELETE_CHILD if
+     the requestor has write permissions.
+
+     * FPGetFileDirParms:
+     10.5 does not only use unix mode and FPAccess for permission check, but also OS 9
+     access bits from FPGetFileDirParms. Thus we have to adjust the Access Rights bitmap
+     user bits by including any ACL rigths.
 
   2. .AppleDouble VFS integration
 

diff --git a/etc/afpd/acls.c b/etc/afpd/acls.c
index 2f55bb87c8503d19cbef1ae8062443c3886ce65e..2f5b49b89076dfcb0f48cf8434ef1e00ba8be59b 100644 (file)
--- a/etc/afpd/acls.c
+++ b/etc/afpd/acls.c
@@ -977,6 +977,14 @@ exit:
 #ifdef HAVE_POSIX_ACLS
 static int check_acl_access(const char *path, const uuidp_t uuid, uint32_t requested_darwin_rights)
 {
+    /*
+     * FIXME: for OS X >= 10.6 it seems fp_access isn't called anymore, instead
+     * the client just tries to perform any action, relying on the server
+     * to enforce permission (which the OS does for us), returning appropiate
+     * error codes in case the action failed.
+     * So to summarize: I think it's safe to not implement this function and
+     * just always return AFP_OK.
+     */
     return AFP_OK;
 }
 #endif /* HAVE_POSIX_ACLS */