Adding upstream version 2:4.20.0+dfsg.upstream/2%4.20.0+dfsg

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 30 insertions, 0 deletions

diff --git a/docs-xml/smbdotconf/security/aclflaginheritedcanonicalization.xml b/docs-xml/smbdotconf/security/aclflaginheritedcanonicalization.xml
new file mode 100644
index 0000000..b306b2b
--- /dev/null
+++ b/docs-xml/smbdotconf/security/aclflaginheritedcanonicalization.xml
@@ -0,0 +1,30 @@
+<samba:parameter name="acl flag inherited canonicalization"
+                 context="S"
+                 type="boolean"
+                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
+<description>
+	<para>This option controls the way Samba handles client requests setting
+	the Security Descriptor of files and directories and the effect the
+	operation has on the Security Descriptor flag &quot;DACL
+	auto-inherited&quot; (DI). Generally, this flag is set on a file (or
+	directory) upon creation if the parent directory has DI set and also has
+	inheritable ACEs.
+	</para>
+
+	<para>On the other hand when a Security Descriptor is explicitly set on
+	a file, the DI flag is cleared, unless the flag &quot;DACL Inheritance
+	Required&quot; (DR) is also set in the new Security Descriptor (fwiw, DR is
+	never stored on disk).</para>
+
+	<para>This is the default behaviour when this option is enabled (the
+	default). When setting this option to <command>no</command>, the
+	resulting value of the DI flag on-disk is directly taken from the DI
+	value of the to-be-set Security Descriptor. This can be used so dump
+	tools like rsync that copy data blobs from xattrs that represent ACLs
+	created by the acl_xattr VFS module will result in copies of the ACL
+	that are identical to the source. Without this option, the copied ACLs
+	would all lose the DI flag if set on the source.</para>
+</description>
+
+<value type="default">yes</value>
+</samba:parameter>