From janger at samba.org Mon Feb 3 15:12:46 2025 From: janger at samba.org (Jule Anger) Date: Mon, 3 Feb 2025 16:12:46 +0100 Subject: [Release Planning 4.22] Samba 4.22.0rc1 Message-ID: <2c0182dd-8892-423c-b07a-b1ccf6797727@samba.org> Hi, Samba 4.22.0rc1 is scheduled for Thursday, February 6 2025. https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.22 has been updated accordingly. Jule -- Jule Anger Release Manager Samba Team samba.org SerNet Samba Team sernet.de From slow at samba.org Mon Feb 3 15:56:36 2025 From: slow at samba.org (Ralph Boehme) Date: Mon, 3 Feb 2025 16:56:36 +0100 Subject: Fwd: Announcing SNIA SMB3 IO Lab EMEA alongside SambaXP Message-ID: <63a51802-42e2-4f01-8f9d-c9d6ec817639@samba.org> Hi! On behalf of SNIA, I'm pleased to share the following invitation to the SNIA SMB3 IO Lab EMEA taking place alongside SambaXP. Samba XP is being held April 7-8 in Goettingen, Germany. The SNIA SMB3 IO Lab EMEA is being held April 8-10 following Samba XP! https://www.snia.org/smb3iolabemea https://sambaxp.org/ The purpose of the IO Lab is for vendors to bring their implementations of SMB3 to test, identify, and fix bugs in a collaborative setting with the goal of providing a forum in which companies can develop interoperable products. SNIA provides and supports networks and infrastructure for the IO Lab, creating a collaborative framework for testing. The participants of the IO Lab work together to define the testing process, assuring that objectives are accomplished. There are several new features that have recently been added to the SMB3 protocol: SMB auditing improvements SMB NTLM disable option SMB over QUIC all server editions SMB over QUIC client access control SMB signing required SMB auth rate limiter SMB alternative ports SMB Mailslots disabled SMB guest auth off in Pro SMB global encrypt from client SMB server dialect control The IO Lab is an opportunity to learn about these new features and test your implementation with Microsoft Windows protocol test suites. During the IO Lab you can directly engage with Windows Protocol Support, Test Suite Development, and members of the Windows development team as well as network with other professionals from all over the world. If you are reluctant to participate because you feel that your SMB implementation is "not ready", you should still participate! The SMB3 IO Lab is also a development opportunity, not just a testing opportunity. Implementations still in development are encouraged to participate. It's a great opportunity to get help and learn from the experts! This year we are pleased to announce the full participation and continued support of Microsoft, our SNIA SMB3 IO Lab EMEA underwriter. Registration is 300 Euro per participant, which covers your meals (Breakfast and Lunch) for the event. For complete details or to register, please visit https://www.snia.org/smb3iolabemea See you there! -slow -------------- next part -------------- A non-text attachment was scrubbed... Name: OpenPGP_signature.asc Type: application/pgp-signature Size: 840 bytes Desc: OpenPGP digital signature URL: From slow at samba.org Mon Feb 3 16:15:21 2025 From: slow at samba.org (Ralph Boehme) Date: Mon, 3 Feb 2025 17:15:21 +0100 Subject: SambaXP 2025 and CfP final call Message-ID: <1cfa5062-2572-44bf-b6e0-046f2567f671@samba.org> Dear Samba users and hackers, I'd like to remind everyone that SambaXP 2025 is getting closer. SambaXP will take place on April 7th and 8th on-site in G?ttingen, Germany once again. This annual event promises to bring together Samba enthusiasts and experts for an interesting and enjoyable two-day conference. https://sambaxp.org/ The call for papers is still open. If you wanted to submit a proposal, now it's time to act! :) (makes not to self... :) ) I'm excited that alongside/after SambaXP, SNIA invites to the SNIA SMB3 IO Lab EMEA at the same venue. https://www.snia.org/smb3iolabemea Please check my earlier mail for more details or please check the website. If you have ideas, questions, or any issues related to your SambaxP participation, please do not hesitate to reach out to the Local Organizing Committee (loc at sambaxp.org). We are ready to assist and make your Samba eXPerience as smooth as possible. Looking forward to see you in G?ttingen! -Ralph -- SerNet Samba Team Lead https://sernet.de/ Samba Team Member https://samba.org/ -------------- next part -------------- A non-text attachment was scrubbed... Name: OpenPGP_signature.asc Type: application/pgp-signature Size: 840 bytes Desc: OpenPGP digital signature URL: From janger at samba.org Thu Feb 6 13:08:26 2025 From: janger at samba.org (Jule Anger) Date: Thu, 6 Feb 2025 14:08:26 +0100 Subject: [Announce] Samba 4.22.0rc1 Available for Download Message-ID: <5f8a1298-bf5b-4d41-a7f5-5c298944d41b@samba.org> Release Announcements ===================== This is the first release candidate of Samba 4.22.? This is *not* intended for production environments and is designed for testing purposes only.? Please report any defects via the Samba bug reporting system at https://bugzilla.samba.org/. Samba 4.22 will be the next version of the Samba suite. UPGRADING ========= NEW FEATURES/CHANGES ==================== SMB3 Directory Leases --------------------- Starting with Samba 4.22 SMB3 Directory Leases are supported. The new global option "smb3 directory leases" controls whether the feature is enabled or not. By default, SMB3 Directory Leases are enabled on non-clustered Samba and disabled on clustered Samba, based on the "clustering" option. See man smb.conf for more details. SMB3 Directory Leases allow clients to cache directory listings and, depending on the workload, result in a decent reduction in SMB requests from clients. Netlogon Ping over LDAP and LDAPS --------------------------------- Samba must query domain controller information via simple queries on the AD rootdse's netlogon attribute. Typically this is done via connectionless LDAP, using UDP on port 389. The same information is also available via classic LDAP rootdse queries over TCP. Samba can now be configured to use TCP via the new "client netlogon ping protocol" parameter to enable running in environments where firewalls completely block port 389 or UDP traffic to domain controllers. REMOVED FEATURES ================ The "nmbd proxy logon" feature was removed. This was used before Samba4 acquired a NBT server. The parameter "cldap port" has been removed. CLDAP runs over UDP port 389, we don't see a reason why this should ever be changed to a different port. Moreover, we had several places in the code where Samba did not respect this parameter, so the behaviour was at least inconsistent. fruit:posix_rename ------------------ This option of the vfs_fruit VFS module that could be used to enable POSIX directory rename behaviour for OS X clients has been removed as it could result in severe problems for Windows clients. As a possible workaround it is possible to prevent creation of .DS_Store files (a Finder thingy to store directory view settings) on network mounts by running ? $ defaults write com.apple.desktopservices DSDontWriteNetworkStores true on the Mac. smb.conf changes ================ ? Parameter Name????????????????????????? Description???? Default ? --------------????????????????????????? -----------???? ------- ? smb3 directory leases?????????????????? New???????????? Auto ? vfs mkdir use tmp name????????????????? New???????????? Auto ? client netlogon ping protocol?????????? New???????????? cldap ? fruit:posix_rename????????????????????? Removed ? cldap port????????????????????????????? Removed KNOWN ISSUES ============ https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.22#Release_blocking_bugs ####################################### Reporting bugs & Development Discussion ####################################### Please discuss this release on the samba-technical mailing list or by joining the #samba-technical:matrix.org matrix room, or #samba-technical IRC channel on irc.libera.chat If you do report problems then please try to send high quality feedback. If you don't provide vital information to help us track down the problem then you will probably be ignored.? All bug reports should be filed under the Samba 4.1 and newer product in the project's Bugzilla database (https://bugzilla.samba.org/). ====================================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ====================================================================== ================ Download Details ================ The uncompressed tarballs and patch files have been signed using GnuPG (ID AA99442FB680B620).? The source code can be downloaded from: ??????? https://download.samba.org/pub/samba/rc/ The release notes are available online at: https://download.samba.org/pub/samba/rc/samba-4.22.0rc1.WHATSNEW.txt Our Code, Our Bugs, Our Responsibility. (https://bugzilla.samba.org/) ??????????????????????? --Enjoy ??????????????????????? The Samba Team From janger at samba.org Thu Feb 6 13:09:33 2025 From: janger at samba.org (Jule Anger) Date: Thu, 6 Feb 2025 14:09:33 +0100 Subject: [Release Planning 4.22] Samba 4.22.0rc2 Message-ID: <47a09e41-2a09-41fd-a313-b6249fd29b24@samba.org> Hi, Samba 4.22.0rc2 is scheduled for Thursday, February 13 2025. https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.22 has been updated accordingly. Jule -- Jule Anger Release Manager Samba Team samba.org SerNet Samba Team sernet.de From empbilly at gmail.com Thu Feb 6 15:56:14 2025 From: empbilly at gmail.com (Elias Pereira) Date: Thu, 6 Feb 2025 12:56:14 -0300 Subject: error accessing the wiki Message-ID: hello, The wiki is returning the error below: Sorry! This site is experiencing technical difficulties. Try waiting a few minutes and reloading. (Cannot access the database) Backtrace: #0 /usr/share/mediawiki/includes/libs/rdbms/loadbalancer/LoadBalancer.php(972): Wikimedia\Rdbms\LoadBalancer->reportConnectionError() #1 /usr/share/mediawiki/includes/libs/rdbms/loadbalancer/LoadBalancer.php(944): Wikimedia\Rdbms\LoadBalancer->getServerConnection() #2 /usr/share/mediawiki/includes/libs/rdbms/database/DBConnRef.php(95): Wikimedia\Rdbms\LoadBalancer->getConnectionInternal() #3 /usr/share/mediawiki/includes/libs/rdbms/database/DBConnRef.php(101): Wikimedia\Rdbms\DBConnRef->ensureConnection() #4 /usr/share/mediawiki/includes/libs/rdbms/database/DBConnRef.php(313): Wikimedia\Rdbms\DBConnRef->__call() #5 /usr/share/mediawiki/includes/language/LCStoreDB.php(61): Wikimedia\Rdbms\DBConnRef->selectField() #6 /usr/share/mediawiki/includes/language/LocalisationCache.php(496): LCStoreDB->get() #7 /usr/share/mediawiki/includes/language/LocalisationCache.php(542): LocalisationCache->isExpired() #8 /usr/share/mediawiki/includes/language/LocalisationCache.php(453): LocalisationCache->initLanguage() #9 /usr/share/mediawiki/includes/language/LocalisationCache.php(352): LocalisationCache->loadSubitem() #10 /usr/share/mediawiki/includes/language/LocalisationCache.php(368): LocalisationCache->getSubitem() #11 /usr/share/mediawiki/includes/language/MessageCache.php(1147): LocalisationCache->getSubitemWithSource() #12 /usr/share/mediawiki/includes/language/MessageCache.php(1097): MessageCache->getMessageForLang() #13 /usr/share/mediawiki/includes/language/MessageCache.php(1036): MessageCache->getMessageFromFallbackChain() #14 /usr/share/mediawiki/includes/language/Message.php(1473): MessageCache->get() #15 /usr/share/mediawiki/includes/language/Message.php(970): Message->fetchMessage() #16 /usr/share/mediawiki/includes/language/Message.php(1053): Message->format() #17 /usr/share/mediawiki/includes/title/MalformedTitleException.php(55): Message->text() #18 /usr/share/mediawiki/includes/title/MediaWikiTitleCodec.php(92): MalformedTitleException->__construct() #19 /usr/share/mediawiki/includes/title/MediaWikiTitleCodec.php(405): MediaWikiTitleCodec::{closure}() #20 /usr/share/mediawiki/includes/Title.php(2984): MediaWikiTitleCodec->splitTitleString() #21 /usr/share/mediawiki/includes/Title.php(480): Title->secureAndSplit() #22 /usr/share/mediawiki/includes/MediaWiki.php(89): Title::newFromURL() #23 /usr/share/mediawiki/includes/MediaWiki.php(162): MediaWiki->parseTitle() #24 /usr/share/mediawiki/includes/MediaWiki.php(860): MediaWiki->getTitle() #25 /usr/share/mediawiki/includes/MediaWiki.php(562): MediaWiki->main() #26 /usr/share/mediawiki/index.php(50): MediaWiki->run() #27 /usr/share/mediawiki/index.php(46): wfIndexMain() #28 {main} -- Elias Pereira From tom at talpey.com Thu Feb 6 16:32:36 2025 From: tom at talpey.com (Tom Talpey) Date: Thu, 6 Feb 2025 08:32:36 -0800 Subject: [PATCH 2/2] smb: client: make lease state changes compliant with the protocol spec In-Reply-To: <20250206065101.339850-2-meetakshisetiyaoss@gmail.com> References: <20250206065101.339850-1-meetakshisetiyaoss@gmail.com> <20250206065101.339850-2-meetakshisetiyaoss@gmail.com> Message-ID: On 2/5/2025 1:50 AM, meetakshisetiyaoss at gmail.com wrote: > From: Meetakshi Setiya > > MS-SMB2 section 3.2.5.7.5 specifies that client must evaluate > delta_epoch to compare the old and new epoch values. This delta_epoch > takes care of lease epoch wraparounds (e.g. when the server resets > the epoch from 65535 to 0). Currently, we just check if the old epoch > is numerically less than the new epoch, which can cause problems when > the server resets its epoch counter from 65535 to 0 - like causing > the client (with current epoch > 0) to not change its lease state. > This patch uses delta_epoch based comparisons while comparing lease > epochs in smb3_downgrade_oplock and smb3_set_oplock_level. > > Also, in the current code for smb3_set_oplock_level, the client > changes the lease state for a file without comparing the epoch. This > patch adds the delta_epoch comparision before updating the lease > state, so that when the change in epoch is negative, the new lease > state is invalid too. This can protect the client from having an > inconsistent lease state because of a stale lease state change > response. > > This patch also adds additional validations to check if the lease > state change is valid or not, before going through > smb3_set_oplock_level. > > Cc: stable at vger.kernel.org > Signed-off-by: Meetakshi Setiya > Reviewed-by: Shyam Prasad N These changes look promising, but how have they been tested? I'm especially concerned with the cases where a lease update is becoming ignored. Combined with the rather subtle wraparound logic, that doesn't sound like these should go straight to stable. I'll attempt to find time to review in more detail next week. Tom. > --- > fs/smb/client/cifsglob.h | 6 +++ > fs/smb/client/smb2ops.c | 95 +++++++++++++++++++++++++++++++--------- > 2 files changed, 80 insertions(+), 21 deletions(-) > > diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h > index 2c1b0438fe7d..4417fa46885f 100644 > --- a/fs/smb/client/cifsglob.h > +++ b/fs/smb/client/cifsglob.h > @@ -1558,6 +1558,12 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file); > #define CIFS_CACHE_HANDLE(cinode) (cinode->oplock & CIFS_CACHE_HANDLE_FLG) > #define CIFS_CACHE_WRITE(cinode) ((cinode->oplock & CIFS_CACHE_WRITE_FLG) || (CIFS_SB(cinode->netfs.inode.i_sb)->mnt_cifs_flags & CIFS_MOUNT_RW_CACHE)) > > +#define IS_SAME_EPOCH(new, cur) ((__u16)new == (__u16)cur) > +#define IS_NEWER_EPOCH(new, cur) (((short)((__u16)new - (__u16)cur) <= (short)32767) && ((__u16)new != (__u16)cur)) > + > +bool validate_lease_state_change(__u32 old_state, __u32 new_state, > + __u16 old_epoch, __u16 new_epoch); > + > /* > * One of these for each file inode > */ > diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c > index ec36bed54b0b..6e0ce114fc08 100644 > --- a/fs/smb/client/smb2ops.c > +++ b/fs/smb/client/smb2ops.c > @@ -3922,7 +3922,7 @@ smb3_downgrade_oplock(struct TCP_Server_Info *server, > __u16 old_epoch = cinode->epoch; > unsigned int new_state; > > - if (epoch > old_epoch) { > + if (IS_NEWER_EPOCH(epoch, old_epoch)) { > smb21_set_oplock_level(cinode, oplock, 0, NULL); > cinode->epoch = epoch; > } > @@ -3998,39 +3998,92 @@ smb21_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock, > &cinode->netfs.inode); > } > > +/* helper function to ascertain that the incoming lease state is valid */ > +bool > +validate_lease_state_change(__u32 old_state, __u32 new_state, > + __u16 old_epoch, __u16 new_epoch) > +{ > + if (new_state == 0) > + return true; > + > + if (old_state == CIFS_CACHE_RH_FLG && new_state == CIFS_CACHE_READ_FLG) > + return false; > + > + if (old_state == CIFS_CACHE_RHW_FLG) { > + if (new_state == CIFS_CACHE_READ_FLG || new_state == CIFS_CACHE_RH_FLG) > + return false; > + } > + > + // lease state changes should not be possible without a valid epoch change > + if (old_state != new_state) { > + if (IS_SAME_EPOCH(new_epoch, old_epoch)) > + return false; > + } else { > + if ((old_state & new_state) == CIFS_CACHE_RHW_FLG) { > + if (!IS_SAME_EPOCH(new_epoch, old_epoch)) > + return false; > + } > + } > + > + return true; > +} > + > static void > smb3_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock, > __u16 epoch, bool *purge_cache) > { > unsigned int old_oplock = cinode->oplock; > + unsigned int new_oplock = oplock; > + > + if (!validate_lease_state_change(cinode->oplock, oplock, cinode->epoch, epoch)) { > + cifs_dbg(FYI, "Invalid lease state change on inode %p\n", &cinode->netfs.inode); > + return; > + } > > - smb21_set_oplock_level(cinode, oplock, epoch, purge_cache); > + /* if the epoch returned by the server is older than the current one, > + * the new lease state is stale. > + * In this case, just retain the existing lease level. > + */ > + if (IS_NEWER_EPOCH(cinode->epoch, epoch)) { > + cifs_dbg(FYI, > + "Stale lease epoch received for inode %p, ignoring state change\n", > + &cinode->netfs.inode); > + return; > + } > > - if (purge_cache) { > + if (purge_cache && old_oplock != 0) { > *purge_cache = false; > - if (old_oplock == CIFS_CACHE_READ_FLG) { > - if (cinode->oplock == CIFS_CACHE_READ_FLG && > - (epoch - cinode->epoch > 0)) > - *purge_cache = true; > - else if (cinode->oplock == CIFS_CACHE_RH_FLG && > - (epoch - cinode->epoch > 1)) > - *purge_cache = true; > - else if (cinode->oplock == CIFS_CACHE_RHW_FLG && > - (epoch - cinode->epoch > 1)) > - *purge_cache = true; > - else if (cinode->oplock == 0 && > - (epoch - cinode->epoch > 0)) > + > + /* case 1: lease state remained the same, > + * - if epoch change is 0, no action > + * - if epoch change is > 0, purge cache > + */ > + if (old_oplock == new_oplock) { > + if (IS_NEWER_EPOCH(epoch, cinode->epoch)) > *purge_cache = true; > - } else if (old_oplock == CIFS_CACHE_RH_FLG) { > - if (cinode->oplock == CIFS_CACHE_RH_FLG && > - (epoch - cinode->epoch > 0)) > + } > + > + /* case 2: lease state upgraded, > + * - if epoch change is 1, upgrade > + * - if epoch change is > 1, upgrade and purge cache > + * we do not handle lease upgrades, so just purging the cache is ok. > + */ > + else if (old_oplock == (new_oplock & old_oplock)) { > + if (IS_NEWER_EPOCH(epoch-1, cinode->epoch)) > *purge_cache = true; > - else if (cinode->oplock == CIFS_CACHE_RHW_FLG && > - (epoch - cinode->epoch > 1)) > + } > + > + /* case 3: lease state downgraded, > + * - if epoch change > 0, purge cache > + */ > + else { > + if (IS_NEWER_EPOCH(epoch, cinode->epoch)) > *purge_cache = true; > } > - cinode->epoch = epoch; > } > + > + smb21_set_oplock_level(cinode, new_oplock, epoch, purge_cache); > + cinode->epoch = epoch; > } > > #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY From keesvanvloten at gmail.com Thu Feb 6 19:26:53 2025 From: keesvanvloten at gmail.com (Kees van Vloten) Date: Thu, 6 Feb 2025 20:26:53 +0100 Subject: error accessing the wiki In-Reply-To: References: Message-ID: <698d243e-c39f-4a28-9fa7-88ca64aa4f7d@gmail.com> Op 06-02-2025 om 16:56 schreef Elias Pereira via samba-technical: > hello, > > The wiki is returning the error below: > > Sorry! This site is experiencing technical difficulties. > > Try waiting a few minutes and reloading. > > (Cannot access the database) > > Backtrace: > > #0 /usr/share/mediawiki/includes/libs/rdbms/loadbalancer/LoadBalancer.php(972): > Wikimedia\Rdbms\LoadBalancer->reportConnectionError() > #1 /usr/share/mediawiki/includes/libs/rdbms/loadbalancer/LoadBalancer.php(944): > Wikimedia\Rdbms\LoadBalancer->getServerConnection() > #2 /usr/share/mediawiki/includes/libs/rdbms/database/DBConnRef.php(95): > Wikimedia\Rdbms\LoadBalancer->getConnectionInternal() > #3 /usr/share/mediawiki/includes/libs/rdbms/database/DBConnRef.php(101): > Wikimedia\Rdbms\DBConnRef->ensureConnection() > #4 /usr/share/mediawiki/includes/libs/rdbms/database/DBConnRef.php(313): > Wikimedia\Rdbms\DBConnRef->__call() > #5 /usr/share/mediawiki/includes/language/LCStoreDB.php(61): > Wikimedia\Rdbms\DBConnRef->selectField() > #6 /usr/share/mediawiki/includes/language/LocalisationCache.php(496): > LCStoreDB->get() > #7 /usr/share/mediawiki/includes/language/LocalisationCache.php(542): > LocalisationCache->isExpired() > #8 /usr/share/mediawiki/includes/language/LocalisationCache.php(453): > LocalisationCache->initLanguage() > #9 /usr/share/mediawiki/includes/language/LocalisationCache.php(352): > LocalisationCache->loadSubitem() > #10 /usr/share/mediawiki/includes/language/LocalisationCache.php(368): > LocalisationCache->getSubitem() > #11 /usr/share/mediawiki/includes/language/MessageCache.php(1147): > LocalisationCache->getSubitemWithSource() > #12 /usr/share/mediawiki/includes/language/MessageCache.php(1097): > MessageCache->getMessageForLang() > #13 /usr/share/mediawiki/includes/language/MessageCache.php(1036): > MessageCache->getMessageFromFallbackChain() > #14 /usr/share/mediawiki/includes/language/Message.php(1473): > MessageCache->get() > #15 /usr/share/mediawiki/includes/language/Message.php(970): > Message->fetchMessage() > #16 /usr/share/mediawiki/includes/language/Message.php(1053): Message->format() > #17 /usr/share/mediawiki/includes/title/MalformedTitleException.php(55): > Message->text() > #18 /usr/share/mediawiki/includes/title/MediaWikiTitleCodec.php(92): > MalformedTitleException->__construct() > #19 /usr/share/mediawiki/includes/title/MediaWikiTitleCodec.php(405): > MediaWikiTitleCodec::{closure}() > #20 /usr/share/mediawiki/includes/Title.php(2984): > MediaWikiTitleCodec->splitTitleString() > #21 /usr/share/mediawiki/includes/Title.php(480): Title->secureAndSplit() > #22 /usr/share/mediawiki/includes/MediaWiki.php(89): Title::newFromURL() > #23 /usr/share/mediawiki/includes/MediaWiki.php(162): MediaWiki->parseTitle() > #24 /usr/share/mediawiki/includes/MediaWiki.php(860): MediaWiki->getTitle() > #25 /usr/share/mediawiki/includes/MediaWiki.php(562): MediaWiki->main() > #26 /usr/share/mediawiki/index.php(50): MediaWiki->run() > #27 /usr/share/mediawiki/index.php(46): wfIndexMain() > #28 {main} > > Same here, the wiki is broken :-( - Kees. From beremour at gmail.com Sun Feb 9 17:49:56 2025 From: beremour at gmail.com (Sergey Yudin) Date: Sun, 9 Feb 2025 20:49:56 +0300 Subject: facl function vfs_zfsacl.c in linux Message-ID: I am trying to build samba 4.21.3 with "vfs_zfsacl,vfs_nfs4acl_xattr" on RockyLinux inside Podman container. "ZFS on linux" built and installed. Module vfs_zfsacl.c using calls to function "facl" , which seems to be from sun/solaris systems. Calls like this: rv = facl(fd, ACE_SETACL, naces, acebuf); Linux libacl seems NOT to have one. What linux library can provide "facl" functions ?. I saw sunacl library, but it provides facl for FreeBSD. -- Regards..