s3:modules:zfsacl improvements to ACL handling

Andrew Walkerrequested to merge
samba-team/devel/samba:anodos325-add-zfsacl-block-special into master
  • Add new optional (off-by-default) parameter "zfsacl:block_special", which automatically adds/removes an empty special ace to prevent ZFS from appending non-inheriting special ACEs during ACL inheritance.
  • Make changes to preferentially use fd-based ACL syscalls. Previously zfsacl was only using acl() rather than facl().
  • Alter circumstances in which DELETE_CHILD is granted alongside WRITE_DATA (only do this when dealing with special aces).

Checklist

  • Commits have Signed-off-by: with name/author being identical to the commit author
  • (optional) This MR is just one part towards a larger feature.
  • (optional, if backport required) Bugzilla bug filed and BUG: tag added
  • Test suite updated with functionality tests
  • Test suite updated with negative tests
  • Documentation updated
  • CI timeout is 3h or higher (see Settings/CICD/General pipelines/ Timeout)

Reviewer's checklist:

  • There is a test suite reasonably covering new functionality or modifications
  • Function naming, parameters, return values, types, etc., are consistent and according to README.Coding.md
  • This feature/change has adequate documentation added
  • No obvious mistakes in the code

Merge request reports