samba: Make adjustments to vfs_acl_xattr configuration

playbooks/ansible/cluster-cephfs.yml

@@ -24,4 +24,4 @@ samba_shares:
   - name: share
     samba:
       options:
-        "acl_xattr:ignore system acls": "yes"
+        "acl_xattr:security_acl_name": "user.NTACL"

playbooks/ansible/cluster-glusterfs.yml

@@ -71,7 +71,7 @@ samba_shares:
   - name: vol-replicate
     samba:
       options:
-        "acl_xattr:ignore system acls": "yes"
+        "acl_xattr:security_acl_name": "user.NTACL"
     glusterfs:
       type: "replicate"
       subvolume_size: "{{ config.groups['cluster']|length }}"
@@ -92,7 +92,7 @@ samba_shares:
   - name: vol-disperse
     samba:
       options:
-        "acl_xattr:ignore system acls": "yes"
+        "acl_xattr:security_acl_name": "user.NTACL"
     glusterfs:
       type: "disperse"
       subvolume_size: 3

playbooks/ansible/cluster-gpfs.yml

@@ -24,6 +24,6 @@ samba_shares:
   - name: share
     samba:
       options:
-        "acl_xattr:ignore system acls": "yes"
+        "acl_xattr:security_acl_name": "user.NTACL"
 
 nsd_device: "/dev/vdb"

playbooks/ansible/cluster-xfs.yml

@@ -24,6 +24,6 @@ samba_shares:
   - name: share
     samba:
       options:
-        "acl_xattr:ignore system acls": "yes"
+        "acl_xattr:security_acl_name": "user.NTACL"
     xfs:
       device: "/dev/vdb"

playbooks/ansible/roles/samba.setup/files/smbd_dac_override.te

@@ -0,0 +1,10 @@
+
+module smbd_dac_override 1.0;
+
+require {
+	type smbd_t;
+	class capability dac_override;
+}
+
+#============= smbd_t ==============
+allow smbd_t self:capability dac_override;

playbooks/ansible/roles/samba.setup/tasks/cephfs/main.yml

@@ -26,3 +26,35 @@
         search_string: "CTDB_SAMBA_SKIP_SHARE_CHECK"
         line: "CTDB_SAMBA_SKIP_SHARE_CHECK=yes"
         state: present
+
+- name: Temporarily allow cap_dac_override for smbd from SELinux
+  when: config.be.variant == 'default'
+  block:
+    - name: Remove any existing policy package
+      command: semodule -r smbd_dac_override
+      failed_when: false
+
+    - name: Copy required type enforcement file
+      copy:
+        src: smbd_dac_override.te
+        dest: /tmp
+
+    - name: Compile SELinux module file
+      command: checkmodule -M -m -o smbd_dac_override.mod smbd_dac_override.te
+      args:
+        chdir: /tmp
+
+    - name: Build SELinux policy package
+      command: semodule_package -o smbd_dac_override.pp -m smbd_dac_override.mod
+      args:
+        chdir: /tmp
+
+    - name: Load SELinux policy package
+      command: semodule -i smbd_dac_override.pp
+      args:
+        chdir: /tmp
+
+    - name: Remove temporary policy files
+      file:
+        path: /tmp/smbd_dac_override.*
+        state: absent

playbooks/ansible/roles/samba.setup/tasks/xfs/main.yml

@@ -1 +1,31 @@
 ---
+- name: Temporarily allow cap_dac_override for smbd from SELinux
+  block:
+    - name: Remove any existing policy package
+      command: semodule -r smbd_dac_override
+      failed_when: false
+
+    - name: Copy required type enforcement file
+      copy:
+        src: smbd_dac_override.te
+        dest: /tmp
+
+    - name: Compile SELinux module file
+      command: checkmodule -M -m -o smbd_dac_override.mod smbd_dac_override.te
+      args:
+        chdir: /tmp
+
+    - name: Build SELinux policy package
+      command: semodule_package -o smbd_dac_override.pp -m smbd_dac_override.mod
+      args:
+        chdir: /tmp
+
+    - name: Load SELinux policy package
+      command: semodule -i smbd_dac_override.pp
+      args:
+        chdir: /tmp
+
+    - name: Remove temporary policy files
+      file:
+        path: /tmp/smbd_dac_override.*
+        state: absent