NameDateSize

..20-Dec-20164

acl.hH A D08-Mar-20152.1 KiB

dinode.hH A D08-Mar-20158.3 KiB

dir.hH A D08-Mar-20155.7 KiB

dirhash.hH A D08-Mar-20155.1 KiB

extattr.hH A D08-Mar-20155.9 KiB

gjournal.hH A D08-Mar-20151.6 KiB

inode.hH A D08-Mar-20157.1 KiB

quota.hH A D08-Mar-20159.3 KiB

README.aclsH A D08-Mar-20153.3 KiB

README.extattrH A D08-Mar-20154.4 KiB

ufs_acl.cH A D08-Mar-201517 KiB

ufs_bmap.cH A D08-Mar-201510.7 KiB

ufs_dirhash.cH A D08-Mar-201536.3 KiB

ufs_extattr.cH A D08-Mar-201533.8 KiB

ufs_extern.hH A D08-Mar-20155.3 KiB

ufs_gjournal.cH A D08-Mar-20153.6 KiB

ufs_inode.cH A D08-Mar-20156.3 KiB

ufs_lookup.cH A D08-Mar-201540.6 KiB

ufs_quota.cH A D08-Mar-201542.8 KiB

ufs_vfsops.cH A D08-Mar-20155.1 KiB

ufs_vnops.cH A D08-Mar-201570 KiB

ufsmount.hH A D08-Mar-20156.1 KiB

README.acls

1$FreeBSD$
2
3  UFS Access Control Lists Copyright
4
5The UFS Access Control Lists implementation is copyright Robert Watson,
6and is made available under a Berkeley-style license.
7
8  About UFS Access Control Lists (ACLs)
9
10Access control lists allow the association of fine-grained discretionary
11access control information with files and directories, extending the
12base UNIX permission model in a (mostly) compatible way.  This
13implementation largely follows the POSIX.1e model, and relies on the
14availability of extended attributes to store extended components of
15the ACL, while maintaining the base permission information in the inode.
16
17  Using UFS Access Control Lists (ACLs)
18
19Support for UFS access control lists may be enabled by adding:
20
21	options UFS_ACL
22
23to your kernel configuration.  As ACLs rely on the availability of extended
24attributes, your file systems must have support for extended attributes.
25For UFS2, this is supported natively, so no further configuration is
26necessary.  For UFS1, you must also enable the optional extended attributes
27support documented in README.extattr.  A summary of the instructions
28and ACL-specific information follows.
29
30To enable support for ACLs on a file system, the 'acls' mount flag
31must be set for the file system.  This may be set using the tunefs
32'-a' flag:
33
34	tunefs -a enable /dev/md0a
35
36Or by using the mount-time flag:
37
38	mount -o acls /dev/md0a /mnt
39
40The flag may also be set in /etc/fstab.  Note that mounting a file
41system previously configured for ACLs without ACL-support will result
42in incorrect application of discretionary protections.  Likewise,
43mounting an ACL-enabled file system without kernel support for ACLs
44will result in incorrect application of discretionary protections.  If
45the kernel is not configured for ACL support, a warning will be
46printed by the kernel at mount-time.  For reliability purposes, it
47is recommended that the superblock flag be used instead of the
48mount-time flag, as this will avoid re-mount isses with the root file
49system.  For reliability and performance reasons, the use of ACLs on
50UFS1 is discouraged; UFS2 extended attributes provide a more reliable
51storage mechanism for ACLs.
52
53Currently, support for ACLs on UFS1 requires the use of UFS1 EAs, which may
54be enabled by adding:
55
56	options UFS_EXTATTR
57
58to your kernel configuration file and rebuilding.  Because of filesystem
59mount atomicity requirements, it is also recommended that:
60
61	options UFS_EXTATTR_AUTOSTART
62
63be added to the kernel so as to support the atomic enabling of the
64required extended attributes with the filesystem mount operation.  To
65enable ACLs, two extended attributes must be available in the
66EXTATTR_NAMESPACE_SYSTEM namespace: "posix1e.acl_access", which holds
67the access ACL, and "posix1e.acl_default" which holds the default ACL
68for directories.  If you're using UFS1 Extended Attributes, the following
69commands may be used to create the necessary EA backing files for
70ACLs in the filesystem root of each filesystem.  In these examples,
71the root filesystem is used; see README.extattr for more details.
72
73  mkdir -p /.attribute/system
74  cd /.attribute/system
75  extattrctl initattr -p / 388 posix1e.acl_access
76  extattrctl initattr -p / 388 posix1e.acl_default
77
78On the next mount of the root filesystem, the attributes will be
79automatically started, and ACLs will be enabled.
80

README.extattr

1$FreeBSD$
2
3  UFS Extended Attributes Copyright
4
5The UFS Extended Attributes implementation is copyright Robert Watson, and
6is made available under a Berkeley-style license.
7
8  About UFS Extended Attributes
9
10Extended attributes allow the association of additional arbitrary
11meta-data with files and directories.  Extended attributes are defined in
12the form name=value, where name is an nul-terminated string in the style
13of a filename, and value is a binary blob of zero or more bytes. The UFS
14extended attribute service layers support for extended attributes onto a
15backing file, in the style of the quota implementation, meaning that it
16requires no underlying format changes in the filesystem.  This design
17choice exchanges simplicity, usability and easy deployment for
18performance.  When defined, extended attribute names exist in a series of
19disjoint namespaces: currently, two namespaces are defined:
20EXTATTR_NAMESPACE_SYSTEM and EXTATTR_NAMESPACE_USER.  The primary
21distinction lies in the protection model: USER EAs are protected using the
22normal inode protections, whereas SYSTEM EAs require privilege to access
23or modify.
24
25  Using UFS Extended Attributes
26
27Support for UFS extended attributes is natively available in UFS2, and
28requires no special configuration.  For reliability, administrative,
29and performance reasons, if you plan to use extended attributes, it
30is recommended that you use UFS2 in preference to UFS1.
31
32Support for UFS extended attributes may be enabled for UFS1 by adding:
33
34	options UFS_EXTATTR
35
36to your kernel configuration file.  This allows UFS-based filesystems to
37support extended attributes, but requires manual administration of EAs
38using the extattrctl tool, including the starting of EA support for each
39filesystem, and the enabling of individual attributes for the file
40system.  The extattrctl utility may be used to initialize backing files
41before first use, to start and stop EA service on a filesystem, and to
42enable and disable named attributes.  The command lines for extattrctl
43take the following forms:
44
45  extattrctl start [path]
46  extattrctl stop [path]
47  extattrctl initattr [-f] [-p path] [attrsize] [attrfile]
48  extattrctl enable [path] [attrnamespace] [attrname] [attrfile]
49  extattrctl disable [path] [attrnamespace] [attrname]
50
51In each case, [path] is used to indicate the mounted filesystem on which
52to perform the operation.  [attrnamespace] refers to the namespace in
53which the attribute is being manipulated, and may be "system" or "user".  
54The [attrname] is the attribute name to use for the operation. The
55[attrfile] argument specifies the attribute backing file to use. When
56using the "initattr" function to initialize a backing file, the maximum
57size of attribute data must be defined in bytes using the [attrsize]
58field.  Optionally, the [-p path] argument may be used to indicate to
59extattrctl that it should pre-allocate space for EA data, rather than
60creating a sparse backing file.  This prevents attribute operations from
61failing in low disk-space conditions (which can be important when EAs are
62used for security purposes), but pre-allocation will consume space
63proportional to the product of the defined maximum attribute size and
64number of attributes on the specified filesystem.
65
66Manual configuration increases administrative overhead, but also
67introduces the possibility of race conditions during filesystem mount, if
68EAs are used to support other features, as starting the EAs manually is
69not atomic with the mount operation.  To address this problem, an
70additional kernel option may be defined to auto-start EAs on a UFS file
71system based on special directories at mount-time:
72
73	options UFS_EXTATTR_AUTOSTART
74
75If this option is defined, UFS will search for a ".attribute"
76sub-directory of the filesystem root during the mount operation.  If it
77is found, EA support will be started for the filesystem.  UFS will then
78search for "system" and "user" sub-directories of the ".attribute"
79directory for any potential backing files, and enable an EA for each valid
80backing file with the name of the backing file as the attribute name.  
81For example, by creating the following tree, the two EAs,
82posix1e.acl_access and posix1e.acl_default will be enabled in the system
83namespace of the root filesystem, reserving space for attribute data:
84
85  mkdir -p /.attribute/system
86  cd /.attribute/system
87  extattrctl initattr -p / 388 posix1e.acl_access
88  extattrctl initattr -p / 388 posix1e.acl_default
89
90On the next mount of the root filesystem, the attributes will be
91automatically started.
92