Adding upstream version 2:4.20.0+dfsg.upstream/2%4.20.0+dfsg

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 35 insertions, 0 deletions

diff --git a/docs-xml/smbdotconf/security/rootdirectory.xml b/docs-xml/smbdotconf/security/rootdirectory.xml
new file mode 100644
index 0000000..0eb7c15
--- /dev/null
+++ b/docs-xml/smbdotconf/security/rootdirectory.xml
@@ -0,0 +1,35 @@
+<samba:parameter name="root directory"
+                 context="G"
+                 type="string"
+                 substitution="1"
+                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
+<synonym>root</synonym>
+<synonym>root dir</synonym>
+<description>
+    <para>The server will <command moreinfo="none">chroot()</command> (i.e. 
+    Change its root directory) to this directory on startup. This is 
+    not strictly necessary for secure operation. Even without it the 
+    server will deny access to files not in one of the service entries. 
+    It may also check for, and deny access to, soft links to other 
+    parts of the filesystem, or attempts to use &quot;..&quot; in file names 
+    to access other directories (depending on the setting of the
+	<smbconfoption name="wide links"/> parameter).
+    </para>
+
+    <para>Adding a <parameter moreinfo="none">root directory</parameter> entry other 
+    than &quot;/&quot; adds an extra level of security, but at a price. It 
+    absolutely ensures that no access is given to files not in the 
+    sub-tree specified in the <parameter moreinfo="none">root directory</parameter> 
+    option, <emphasis>including</emphasis> some files needed for 
+    complete operation of the server. To maintain full operability 
+    of the server you will need to mirror some system files 
+    into the <parameter moreinfo="none">root directory</parameter> tree. In particular 
+    you will need to mirror <filename moreinfo="none">/etc/passwd</filename> (or a 
+    subset of it), and any binaries or configuration files needed for 
+    printing (if required). The set of files that must be mirrored is
+    operating system dependent.</para>
+</description>
+
+<value type="default"></value>
+<value type="example">/homes/smb</value>
+</samba:parameter>