r6149: Fixes bugs #2498 and 2484.

1. using smbc_getxattr() et al, one may now request all access control
   entities in the ACL without getting all other NT attributes.
2. added the ability to exclude specified attributes from the result set
   provided by smbc_getxattr() et al, when requesting all attributes,
   all NT attributes, or all DOS attributes.
3. eliminated all compiler warnings, including when --enable-developer
   compiler flags are in use.  removed -Wcast-qual flag from list, as that
   is specifically to force warnings in the case of casting away qualifiers.

Note: In the process of eliminating compiler warnings, a few nasties were
      discovered.  In the file libads/sasl.c, PRIVATE kerberos interfaces
      are being used; and in libsmb/clikrb5.c, both PRIAVE and DEPRECATED
      kerberos interfaces are being used.  Someone who knows kerberos
      should look at these and determine if there is an alternate method
      of accomplishing the task.
(This used to be commit 994694f7f26da5099f071e1381271a70407f33bb)

37 files changed, 599 insertions, 415 deletions

diff --git a/source3/client/smbspool.c b/source3/client/smbspool.c
index 5df6bfe407..aeb4c91b19 100644
--- a/source3/client/smbspool.c
+++ b/source3/client/smbspool.c
@@ -148,12 +148,12 @@ static int		smb_print(struct cli_state *, char *, FILE *);
     if ((password = strchr_m(username, ':')) != NULL)
       *password++ = '\0';
     else
-      password = "";
+      password = CONST_DISCARD(char *, "");
   }
   else
   {
     username = "";
-    password = "";
+    password = CONST_DISCARD(char *, "");
     server   = uri + 6;
   }
 
diff --git a/source3/configure.in b/source3/configure.in
index 9b2f4b80ce..5ea0939f25 100644
--- a/source3/configure.in
+++ b/source3/configure.in
@@ -248,7 +248,7 @@ fi
 AC_ARG_ENABLE(developer, [  --enable-developer      Turn on developer warnings and debugging (default=no)],
     [if eval "test x$enable_developer = xyes"; then
         developer=yes
-    	CFLAGS="${CFLAGS} -gstabs -Wall -Wshadow -Wstrict-prototypes -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -DDEBUG_PASSWORD -DDEVELOPER"
+    	CFLAGS="${CFLAGS} -gstabs -Wall -Wshadow -Wstrict-prototypes -Wpointer-arith -Wcast-align -Wwrite-strings -DDEBUG_PASSWORD -DDEVELOPER"
 	# Add -Wdeclaration-after-statement if compiler supports it
 	AC_CACHE_CHECK(
           [that the C compiler understands -Wdeclaration-after-statement],
diff --git a/source3/include/includes.h b/source3/include/includes.h
index 982eee1886..20f5304591 100644
--- a/source3/include/includes.h
+++ b/source3/include/includes.h
@@ -1372,4 +1372,7 @@ LDAP *ldap_open_with_timeout(const char *server, int port, unsigned int to);
 #undef HAVE_MMAP
 #endif
 
+#define CONST_DISCARD(type, ptr)      ((type) ((void *) (ptr)))
+#define CONST_ADD(type, ptr)          ((type) ((const void *) (ptr)))
+
 #endif /* _INCLUDES_H */
diff --git a/source3/include/smb_macros.h b/source3/include/smb_macros.h
index 9a78718605..2b3140783b 100644
--- a/source3/include/smb_macros.h
+++ b/source3/include/smb_macros.h
@@ -43,7 +43,7 @@
  * @note You are explicitly allowed to pass NULL pointers -- they will
  * always be ignored.
  **/
-#define SAFE_FREE(x) do { if ((x) != NULL) {free((void *) (x)); x=NULL;} } while(0)
+#define SAFE_FREE(x) do { if ((x) != NULL) {free(CONST_DISCARD(void *, (x))); x=NULL;} } while(0)
 #endif
 
 /* zero a structure */
diff --git a/source3/intl/lang_tdb.c b/source3/intl/lang_tdb.c
index d3422f0d78..d8f7fc8c93 100644
--- a/source3/intl/lang_tdb.c
+++ b/source3/intl/lang_tdb.c
@@ -231,7 +231,7 @@ const char *lang_msg(const char *msgid)
 void lang_msg_free(const char *msgstr)
 {
 	if (!tdb) return;
-	free((void *)msgstr);
+	free(CONST_DISCARD(void *, msgstr));
 }
 
 
@@ -248,7 +248,7 @@ const char *lang_msg_rotate(const char *msgid)
 	static pstring bufs[NUM_LANG_BUFS];
 	static int next;
 
-	msgstr = (char *)lang_msg(msgid);
+	msgstr = CONST_DISCARD(char *, lang_msg(msgid));
 	if (!msgstr) return msgid;
 
 	pstrcpy(bufs[next], msgstr);
diff --git a/source3/lib/access.c b/source3/lib/access.c
index fcc795d1f2..d8e40c99f7 100644
--- a/source3/lib/access.c
+++ b/source3/lib/access.c
@@ -133,7 +133,7 @@ static BOOL string_match(const char *tok,const char *s, char *invalid_char)
 /* client_match - match host name and address against token */
 static BOOL client_match(const char *tok, const char *item)
 {
-	const char **client = (const char **)item;
+        const char **client = CONST_ADD(const char **, item);
 	BOOL match;
 	char invalid_char = '\0';
 
diff --git a/source3/lib/iconv.c b/source3/lib/iconv.c
index d58165fed0..f23e4351c0 100644
--- a/source3/lib/iconv.c
+++ b/source3/lib/iconv.c
@@ -135,7 +135,7 @@ static size_t sys_iconv(void *cd,
 {
 #ifdef HAVE_NATIVE_ICONV
 	size_t ret = iconv((iconv_t)cd, 
-			   (char **)inbuf, inbytesleft, 
+			   CONST_DISCARD(char **, inbuf), inbytesleft, 
 			   outbuf, outbytesleft);
 	if (ret == (size_t)-1) {
 		int saved_errno = errno;
diff --git a/source3/lib/smbldap.c b/source3/lib/smbldap.c
index 78ec249717..cf2f03e0a2 100644
--- a/source3/lib/smbldap.c
+++ b/source3/lib/smbldap.c
@@ -1066,7 +1066,9 @@ int smbldap_search(struct smbldap_state *ldap_state,
 
 	while (another_ldap_try(ldap_state, &rc, &attempts, endtime))
 		rc = ldap_search_s(ldap_state->ldap_struct, base, scope, 
-				   utf8_filter, (char **) attrs, attrsonly, res);
+				   utf8_filter,
+                                   CONST_DISCARD(char **, attrs),
+                                   attrsonly, res);
 	
 	SAFE_FREE(utf8_filter);
 	return rc;
@@ -1471,7 +1473,8 @@ static BOOL smbldap_check_root_dse(struct smbldap_state *ldap_state, const char
 	}
 
 	rc = ldap_search_s(ldap_state->ldap_struct, "", LDAP_SCOPE_BASE, 
-			   "(objectclass=*)", (char **) attrs, 0 , &msg);
+			   "(objectclass=*)", CONST_DISCARD(char **, attrs),
+                           0 , &msg);
 
 	if (rc != LDAP_SUCCESS) {
 		DEBUG(3,("smbldap_check_root_dse: Could not search rootDSE\n"));
diff --git a/source3/lib/util_str.c b/source3/lib/util_str.c
index b13ec1f0da..12ee3dc162 100644
--- a/source3/lib/util_str.c
+++ b/source3/lib/util_str.c
@@ -45,7 +45,7 @@ BOOL next_token(const char **ptr,char *buff, const char *sep, size_t bufsize)
 	if (!ptr)
 		return(False);
 
-	s = (char *)*ptr;
+	s = CONST_DISCARD(char *, *ptr);
 
 	/* default to simple separators */
 	if (!sep)
@@ -109,7 +109,7 @@ void set_first_token(char *ptr)
 
 char **toktocliplist(int *ctok, const char *sep)
 {
-	char *s=(char *)last_ptr;
+        char *s = CONST_DISCARD(char *, last_ptr);
 	int ictok=0;
 	char **ret, **iret;
 
@@ -132,7 +132,7 @@ char **toktocliplist(int *ctok, const char *sep)
 	} while(*s);
 	
 	*ctok=ictok;
-	s=(char *)last_ptr;
+	s = CONST_DISCARD(char *, last_ptr);
 	
 	if (!(ret=iret=SMB_MALLOC_ARRAY(char *,ictok+1)))
 		return NULL;
@@ -1221,7 +1221,7 @@ char *strchr_m(const char *src, char c)
 
 	for (s = src; *s && !(((unsigned char)s[0]) & 0x80); s++) {
 		if (*s == c)
-			return (char *)s;
+			return CONST_DISCARD(char *, s);
 	}
 
 	if (!*s)
@@ -1238,7 +1238,7 @@ char *strchr_m(const char *src, char c)
 		return NULL;
 	*p = 0;
 	pull_ucs2_pstring(s2, ws);
-	return (char *)(s+strlen(s2));
+	return CONST_DISCARD(char *, (s+strlen(s2)));
 }
 
 char *strrchr_m(const char *s, char c)
@@ -1275,7 +1275,7 @@ char *strrchr_m(const char *s, char c)
 					break;
 				}
 				/* No - we have a match ! */
-			       	return (char *)cp;
+			       	return CONST_DISCARD(char *, cp);
 			}
 		} while (cp-- != s);
 		if (!got_mb)
@@ -1294,7 +1294,7 @@ char *strrchr_m(const char *s, char c)
 			return NULL;
 		*p = 0;
 		pull_ucs2_pstring(s2, ws);
-		return (char *)(s+strlen(s2));
+		return CONST_DISCARD(char *, (s+strlen(s2)));
 	}
 }
 
@@ -1315,7 +1315,7 @@ char *strnrchr_m(const char *s, char c, unsigned int n)
 		return NULL;
 	*p = 0;
 	pull_ucs2_pstring(s2, ws);
-	return (char *)(s+strlen(s2));
+	return CONST_DISCARD(char *, (s+strlen(s2)));
 }
 
 /***********************************************************************
@@ -1334,7 +1334,7 @@ char *strstr_m(const char *src, const char *findstr)
 
 	/* for correctness */
 	if (!findstr[0]) {
-		return (char*)src;
+		return CONST_DISCARD(char *, src);
 	}
 
 	/* Samba does single character findstr calls a *lot*. */
@@ -1351,7 +1351,7 @@ char *strstr_m(const char *src, const char *findstr)
 				findstr_len = strlen(findstr);
 
 			if (strncmp(s, findstr, findstr_len) == 0) {
-				return (char *)s;
+				return CONST_DISCARD(char *, s);
 			}
 		}
 	}
@@ -1392,7 +1392,7 @@ char *strstr_m(const char *src, const char *findstr)
 		DEBUG(0,("strstr_m: dest malloc fail\n"));
 		return NULL;
 	}
-	retp = (char *)(s+strlen(s2));
+	retp = CONST_DISCARD(char *, (s+strlen(s2)));
 	SAFE_FREE(src_w);
 	SAFE_FREE(find_w);
 	SAFE_FREE(s2);
diff --git a/source3/lib/util_unistr.c b/source3/lib/util_unistr.c
index 04985c6ab6..0b4552e1f5 100644
--- a/source3/lib/util_unistr.c
+++ b/source3/lib/util_unistr.c
@@ -398,10 +398,10 @@ size_t strnlen_w(const smb_ucs2_t *src, size_t max)
 smb_ucs2_t *strchr_w(const smb_ucs2_t *s, smb_ucs2_t c)
 {
 	while (*s != 0) {
-		if (c == *s) return (smb_ucs2_t *)s;
+                if (c == *s) return CONST_DISCARD(smb_ucs2_t *, s);
 		s++;
 	}
-	if (c == *s) return (smb_ucs2_t *)s;
+	if (c == *s) return CONST_DISCARD(smb_ucs2_t *, s);
 
 	return NULL;
 }
@@ -422,7 +422,7 @@ smb_ucs2_t *strrchr_w(const smb_ucs2_t *s, smb_ucs2_t c)
 	if (len == 0) return NULL;
 	p += (len - 1);
 	do {
-		if (c == *p) return (smb_ucs2_t *)p;
+		if (c == *p) return CONST_DISCARD(smb_ucs2_t *, p);
 	} while (p-- != s);
 	return NULL;
 }
@@ -443,7 +443,7 @@ smb_ucs2_t *strnrchr_w(const smb_ucs2_t *s, smb_ucs2_t c, unsigned int n)
 			n--;
 
 		if (!n)
-			return (smb_ucs2_t *)p;
+			return CONST_DISCARD(smb_ucs2_t *, p);
 	} while (p-- != s);
 	return NULL;
 }
@@ -461,7 +461,7 @@ smb_ucs2_t *strstr_w(const smb_ucs2_t *s, const smb_ucs2_t *ins)
 		return NULL;
 
 	inslen = strlen_w(ins);
-	r = (smb_ucs2_t *)s;
+	r = CONST_DISCARD(smb_ucs2_t *, s);
 
 	while ((r = strchr_w(r, *ins))) {
 		if (strncmp_w(r, ins, inslen) == 0) 
@@ -732,7 +732,7 @@ smb_ucs2_t *strpbrk_wa(const smb_ucs2_t *s, const char *p)
 		int i;
 		for (i=0; p[i] && *s != UCS2_CHAR(p[i]); i++) 
 			;
-		if (p[i]) return (smb_ucs2_t *)s;
+		if (p[i]) return CONST_DISCARD(smb_ucs2_t *, s);
 		s++;
 	}
 	return NULL;
@@ -747,7 +747,7 @@ smb_ucs2_t *strstr_wa(const smb_ucs2_t *s, const char *ins)
 		return NULL;
 
 	inslen = strlen(ins);
-	r = (smb_ucs2_t *)s;
+	r = CONST_DISCARD(smb_ucs2_t *, s);
 
 	while ((r = strchr_w(r, UCS2_CHAR(*ins)))) {
 		if (strncmp_wa(r, ins, inslen) == 0) 
diff --git a/source3/lib/util_uuid.c b/source3/lib/util_uuid.c
index df70740b33..8b8e70a36e 100644
--- a/source3/lib/util_uuid.c
+++ b/source3/lib/util_uuid.c
@@ -94,7 +94,7 @@ BOOL smb_string_to_uuid(const char *in, struct uuid* uu)
 {
 	BOOL ret = False;
 	const char *ptr = in;
-	char *end = (char *)in;
+	char *end = CONST_DISCARD(char *, in);
 	int i;
 	unsigned v1, v2;
 
diff --git a/source3/libads/kerberos.c b/source3/libads/kerberos.c
index 43ccb18b5a..18820d9e31 100644
--- a/source3/libads/kerberos.c
+++ b/source3/libads/kerberos.c
@@ -89,7 +89,7 @@ int kerberos_kinit_password(const char *principal,
 	}
 	
 	if ((code = krb5_get_init_creds_password(ctx, &my_creds, me,
-                                                 (char *) password, 
+                                                 CONST_DISCARD(char *, password), 
 						 kerb_prompter, 
 						 NULL, 0, NULL, NULL))) {
 		krb5_free_principal(ctx, me);
diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c
index 68103a701b..7a59da5a6d 100644
--- a/source3/libads/ldap.c
+++ b/source3/libads/ldap.c
@@ -481,15 +481,15 @@ ADS_STATUS ads_do_paged_search(ADS_STRUCT *ads, const char *bind_path,
 		ber_printf(cookie_be, "{io}", (ber_int_t) 1000, "", 0);
 	}
 	ber_flatten(cookie_be, &cookie_bv);
-	PagedResults.ldctl_oid = ADS_PAGE_CTL_OID;
+	PagedResults.ldctl_oid = CONST_DISCARD(char *, ADS_PAGE_CTL_OID);
 	PagedResults.ldctl_iscritical = (char) 1;
 	PagedResults.ldctl_value.bv_len = cookie_bv->bv_len;
 	PagedResults.ldctl_value.bv_val = cookie_bv->bv_val;
 
-	NoReferrals.ldctl_oid = ADS_NO_REFERRALS_OID;
+	NoReferrals.ldctl_oid = CONST_DISCARD(char *, ADS_NO_REFERRALS_OID);
 	NoReferrals.ldctl_iscritical = (char) 0;
 	NoReferrals.ldctl_value.bv_len = 0;
-	NoReferrals.ldctl_value.bv_val = "";
+	NoReferrals.ldctl_value.bv_val = CONST_DISCARD(char *, "");
 
 
 	controls[0] = &NoReferrals;
@@ -962,7 +962,7 @@ ADS_STATUS ads_gen_mod(ADS_STRUCT *ads, const char *mod_dn, ADS_MODLIST mods)
 	   non-existent attribute (but allowable for the object) to run
 	*/
 	LDAPControl PermitModify = {
-		ADS_PERMIT_MODIFY_OID,
+                CONST_DISCARD(char *, ADS_PERMIT_MODIFY_OID),
 		{0, NULL},
 		(char) 1};
 	LDAPControl *controls[2];
diff --git a/source3/libads/ldap_printer.c b/source3/libads/ldap_printer.c
index 68e6735891..61275e40d1 100644
--- a/source3/libads/ldap_printer.c
+++ b/source3/libads/ldap_printer.c
@@ -61,8 +61,10 @@ ADS_STATUS ads_find_printers(ADS_STRUCT *ads, void **res)
 
 	/* For the moment only display all printers */
 
-	ldap_expr = "(&(!(showInAdvancedViewOnly=TRUE))(uncName=*)"
-		"(objectCategory=printQueue))";
+	ldap_expr =
+                CONST_DISCARD(char *,
+                                "(&(!(showInAdvancedViewOnly=TRUE))(uncName=*)"
+                                "(objectCategory=printQueue))");
 
 	return ads_search(ads, res, ldap_expr, attrs);
 }
diff --git a/source3/libads/sasl.c b/source3/libads/sasl.c
index 0164b0c740..e657f2114e 100644
--- a/source3/libads/sasl.c
+++ b/source3/libads/sasl.c
@@ -18,6 +18,8 @@
    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
+#define KRB5_PRIVATE    1       /* this file uses PRIVATE interfaces! */
+
 #include "includes.h"
 
 #ifdef HAVE_LDAP
@@ -285,7 +287,8 @@ static ADS_STATUS ads_sasl_gssapi_bind(ADS_STRUCT *ads)
 			ENCTYPE_DES_CBC_MD5,
 			ENCTYPE_NULL};
 	gss_OID_desc nt_principal = 
-	{10, "\052\206\110\206\367\022\001\002\002\002"};
+                {10, CONST_DISCARD(char *,
+                                     "\052\206\110\206\367\022\001\002\002\002")};
 
 	/* we need to fetch a service ticket as the ldap user in the
 	   servers realm, regardless of our realm */
diff --git a/source3/libsmb/clikrb5.c b/source3/libsmb/clikrb5.c
index 66c16b69ae..c35b53a9dd 100644
--- a/source3/libsmb/clikrb5.c
+++ b/source3/libsmb/clikrb5.c
@@ -19,6 +19,9 @@
    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
+#define KRB5_PRIVATE    1       /* this file uses PRIVATE interfaces! */
+#define KRB5_DEPRECATED 1       /* this file uses DEPRECATED interfaces! */
+
 #include "includes.h"
 
 #ifdef HAVE_KRB5
diff --git a/source3/libsmb/clispnego.c b/source3/libsmb/clispnego.c
index 85b7bd9e1e..5d07999bc3 100644
--- a/source3/libsmb/clispnego.c
+++ b/source3/libsmb/clispnego.c
@@ -338,7 +338,8 @@ int spnego_gen_negTokenTarg(const char *principal, int time_offset,
 		return retval;
 
 	/* wrap that up in a nice GSS-API wrapping */
-	tkt_wrapped = spnego_gen_krb5_wrap(tkt, TOK_ID_KRB_AP_REQ);
+	tkt_wrapped = spnego_gen_krb5_wrap(
+            tkt, CONST_ADD(const uint8 *, TOK_ID_KRB_AP_REQ));
 
 	/* and wrap that in a shiny SPNEGO wrapper */
 	*targ = gen_negTokenTarg(krb_mechs, tkt_wrapped);
diff --git a/source3/libsmb/libsmbclient.c b/source3/libsmb/libsmbclient.c
index 87ca030b10..ae9a660a09 100644
--- a/source3/libsmb/libsmbclient.c
+++ b/source3/libsmb/libsmbclient.c
@@ -3278,7 +3278,8 @@ static DOS_ATTR_DESC *dos_attr_query(SMBCCTX *context,
         }
 
         /* Obtain the DOS attributes */
-        if (!smbc_getatr(context, srv, (char *) filename, &mode, &size, 
+        if (!smbc_getatr(context, srv, CONST_DISCARD(char *, filename),
+                         &mode, &size, 
                          &c_time, &a_time, &m_time, &inode)) {
         
                 errno = smbc_errno(context, &srv->cli);
@@ -3347,21 +3348,35 @@ retrieve the acls for a file
 *******************************************************/
 static int cacl_get(SMBCCTX *context, TALLOC_CTX *ctx, SMBCSRV *srv,
                     struct cli_state *ipc_cli, POLICY_HND *pol,
-                    char *filename, char *name, char *buf, int bufsize)
+                    char *filename, char *attr_name, char *buf, int bufsize)
 {
 	uint32 i;
         int n = 0;
         int n_used;
         BOOL all;
         BOOL all_nt;
+        BOOL all_nt_acls;
         BOOL all_dos;
         BOOL some_nt;
         BOOL some_dos;
+        BOOL exclude_nt_revision = False;
+        BOOL exclude_nt_owner = False;
+        BOOL exclude_nt_group = False;
+        BOOL exclude_nt_acl = False;
+        BOOL exclude_dos_mode = False;
+        BOOL exclude_dos_size = False;
+        BOOL exclude_dos_ctime = False;
+        BOOL exclude_dos_atime = False;
+        BOOL exclude_dos_mtime = False;
+        BOOL exclude_dos_inode = False;
         BOOL numeric = True;
         BOOL determine_size = (bufsize == 0);
 	int fnum = -1;
 	SEC_DESC *sd;
 	fstring sidstr;
+        fstring name_sandbox;
+        char *name;
+        char *pExclude;
         char *p;
 	time_t m_time = 0, a_time = 0, c_time = 0;
 	SMB_OFF_T size = 0;
@@ -3369,20 +3384,88 @@ static int cacl_get(SMBCCTX *context, TALLOC_CTX *ctx, SMBCSRV *srv,
 	SMB_INO_T ino = 0;
         struct cli_state *cli = &srv->cli;
 
+        /* Copy name so we can strip off exclusions (if any are specified) */
+        strncpy(name_sandbox, attr_name, sizeof(name_sandbox) - 1);
+
+        /* Ensure name is null terminated */
+        name_sandbox[sizeof(name_sandbox) - 1] = '\0';
+
+        /* Play in the sandbox */
+        name = name_sandbox;
+
+        /* If there are any exclusions, point to them and mask them from name */
+        if ((pExclude = strchr(name, '!')) != NULL)
+        {
+                *pExclude++ = '\0';
+        }
+
         all = (StrnCaseCmp(name, "system.*", 8) == 0);
         all_nt = (StrnCaseCmp(name, "system.nt_sec_desc.*", 20) == 0);
+        all_nt_acls = (StrnCaseCmp(name, "system.nt_sec_desc.acl.*", 24) == 0);
         all_dos = (StrnCaseCmp(name, "system.dos_attr.*", 17) == 0);
         some_nt = (StrnCaseCmp(name, "system.nt_sec_desc.", 19) == 0);
         some_dos = (StrnCaseCmp(name, "system.dos_attr.", 16) == 0);
         numeric = (* (name + strlen(name) - 1) != '+');
 
+        /* Look for exclusions from "all" requests */
+        if (all || all_nt || all_dos) {
+
+                /* Exclusions are delimited by '!' */
+                for (; pExclude != NULL; pExclude = (p == NULL ? NULL : p + 1)) {
+
+                /* Find end of this exclusion name */
+                if ((p = strchr(pExclude, '!')) != NULL)
+                {
+                    *p = '\0';
+                }
+
+                /* Which exclusion name is this? */
+                if (StrCaseCmp(pExclude, "nt_sec_desc.revision") == 0) {
+                    exclude_nt_revision = True;
+                }
+                else if (StrCaseCmp(pExclude, "nt_sec_desc.owner") == 0) {
+                    exclude_nt_owner = True;
+                }
+                else if (StrCaseCmp(pExclude, "nt_sec_desc.group") == 0) {
+                    exclude_nt_group = True;
+                }
+                else if (StrCaseCmp(pExclude, "nt_sec_desc.acl") == 0) {
+                    exclude_nt_acl = True;
+                }
+                else if (StrCaseCmp(pExclude, "dos_attr.mode") == 0) {
+                    exclude_dos_mode = True;
+                }
+                else if (StrCaseCmp(pExclude, "dos_attr.size") == 0) {
+                    exclude_dos_size = True;
+                }
+                else if (StrCaseCmp(pExclude, "dos_attr.c_time") == 0) {
+                    exclude_dos_ctime = True;
+                }
+                else if (StrCaseCmp(pExclude, "dos_attr.a_time") == 0) {
+                    exclude_dos_atime = True;
+                }
+                else if (StrCaseCmp(pExclude, "dos_attr.m_time") == 0) {
+                    exclude_dos_mtime = True;
+                }
+                else if (StrCaseCmp(pExclude, "dos_attr.inode") == 0) {
+                    exclude_dos_inode = True;
+                }
+                else {
+                    DEBUG(5, ("cacl_get received unknown exclusion: %s\n",
+                              pExclude));
+                    errno = ENOATTR;
+                    return -1;
+                }
+            }
+        }
+
         n_used = 0;
 
         /*
          * If we are (possibly) talking to an NT or new system and some NT
          * attributes have been requested...
          */
-        if (ipc_cli && (all || some_nt)) {
+        if (ipc_cli && (all || some_nt || all_nt_acls)) {
                 /* Point to the portion after "system.nt_sec_desc." */
                 name += 19;     /* if (all) this will be invalid but unused */
 
@@ -3407,139 +3490,105 @@ static int cacl_get(SMBCCTX *context, TALLOC_CTX *ctx, SMBCSRV *srv,
 
                 cli_close(cli, fnum);
 
-                if (all || all_nt) {
-                        if (determine_size) {
-                                p = talloc_asprintf(ctx,
-                                                    "REVISION:%d",
-                                                    sd->revision);
-                                if (!p) {
-                                        errno = ENOMEM;
-                                        return -1;
+                if (! exclude_nt_revision) {
+                        if (all || all_nt) {
+                                if (determine_size) {
+                                        p = talloc_asprintf(ctx,
+                                                            "REVISION:%d",
+                                                            sd->revision);
+                                        if (!p) {
+                                                errno = ENOMEM;
+                                                return -1;
+                                        }
+                                        n = strlen(p);
+                                } else {
+                                        n = snprintf(buf, bufsize,
+                                                     "REVISION:%d", sd->revision);
                                 }
-                                n = strlen(p);
-                        } else {
-                                n = snprintf(buf, bufsize,
-                                             "REVISION:%d", sd->revision);
-                        }
-                } else if (StrCaseCmp(name, "revision") == 0) {
-                        if (determine_size) {
-                                p = talloc_asprintf(ctx, "%d", sd->revision);
-                                if (!p) {
-                                        errno = ENOMEM;
-                                        return -1;
+                        } else if (StrCaseCmp(name, "revision") == 0) {
+                                if (determine_size) {
+                                        p = talloc_asprintf(ctx, "%d",
+                                                            sd->revision);
+                                        if (!p) {
+                                                errno = ENOMEM;
+                                                return -1;
+                                        }
+                                        n = strlen(p);
+                                } else {
+                                        n = snprintf(buf, bufsize, "%d",
+                                                     sd->revision);
                                 }
-                                n = strlen(p);
-                        } else {
-                                n = snprintf(buf, bufsize, "%d", sd->revision);
                         }
-                }
         
-                if (!determine_size && n > bufsize) {
-                        errno = ERANGE;
-                        return -1;
-                }
-                buf += n;
-                n_used += n;
-                bufsize -= n;
-
-                /* Get owner and group sid */
-
-                if (sd->owner_sid) {
-                        convert_sid_to_string(ipc_cli, pol,
-                                              sidstr, numeric, sd->owner_sid);
-                } else {
-                        fstrcpy(sidstr, "");
+                        if (!determine_size && n > bufsize) {
+                                errno = ERANGE;
+                                return -1;
+                        }
+                        buf += n;
+                        n_used += n;
+                        bufsize -= n;
                 }
 
-                if (all || all_nt) {
-                        if (determine_size) {
-                                p = talloc_asprintf(ctx, ",OWNER:%s", sidstr);
-                                if (!p) {
-                                        errno = ENOMEM;
-                                        return -1;
-                                }
-                                n = strlen(p);
-                        } else {
-                                n = snprintf(buf, bufsize,
-                                             ",OWNER:%s", sidstr);
-                        }
-                } else if (StrnCaseCmp(name, "owner", 5) == 0) {
-                        if (determine_size) {
-                                p = talloc_asprintf(ctx, "%s", sidstr);
-                                if (!p) {
-                                        errno = ENOMEM;
-                                        return -1;
-                                }
-                                n = strlen(p);
+                if (! exclude_nt_owner) {
+                        /* Get owner and group sid */
+                        if (sd->owner_sid) {
+                                convert_sid_to_string(ipc_cli, pol,
+                                                      sidstr,
+                                                      numeric,
+                                                      sd->owner_sid);
                         } else {
-                                n = snprintf(buf, bufsize, "%s", sidstr);
+                                fstrcpy(sidstr, "");
                         }
-                }
 
-                if (!determine_size && n > bufsize) {
-                        errno = ERANGE;
-                        return -1;
-                }
-                buf += n;
-                n_used += n;
-                bufsize -= n;
-
-                if (sd->grp_sid) {
-                        convert_sid_to_string(ipc_cli, pol,
-                                              sidstr, numeric, sd->grp_sid);
-                } else {
-                        fstrcpy(sidstr, "");
-                }
-
-                if (all || all_nt) {
-                        if (determine_size) {
-                                p = talloc_asprintf(ctx, ",GROUP:%s", sidstr);
-                                if (!p) {
-                                        errno = ENOMEM;
-                                        return -1;
+                        if (all || all_nt) {
+                                if (determine_size) {
+                                        p = talloc_asprintf(ctx, ",OWNER:%s",
+                                                            sidstr);
+                                        if (!p) {
+                                                errno = ENOMEM;
+                                                return -1;
+                                        }
+                                        n = strlen(p);
+                                } else {
+                                        n = snprintf(buf, bufsize,
+                                                     ",OWNER:%s", sidstr);
                                 }
-                                n = strlen(p);
-                        } else {
-                                n = snprintf(buf, bufsize,
-                                             ",GROUP:%s", sidstr);
-                        }
-                } else if (StrnCaseCmp(name, "group", 5) == 0) {
-                        if (determine_size) {
-                                p = talloc_asprintf(ctx, "%s", sidstr);
-                                if (!p) {
-                                        errno = ENOMEM;
-                                        return -1;
+                        } else if (StrnCaseCmp(name, "owner", 5) == 0) {
+                                if (determine_size) {
+                                        p = talloc_asprintf(ctx, "%s", sidstr);
+                                        if (!p) {
+                                                errno = ENOMEM;
+                                                return -1;
+                                        }
+                                        n = strlen(p);
+                                } else {
+                                        n = snprintf(buf, bufsize, "%s",
+                                                     sidstr);
                                 }
-                                n = strlen(p);
-                        } else {
-                                n = snprintf(buf, bufsize, "%s", sidstr);
                         }
-                }
 
-                if (!determine_size && n > bufsize) {
-                        errno = ERANGE;
-                        return -1;
+                        if (!determine_size && n > bufsize) {
+                                errno = ERANGE;
+                                return -1;
+                        }
+                        buf += n;
+                        n_used += n;
+                        bufsize -= n;
                 }
-                buf += n;
-                n_used += n;
-                bufsize -= n;
 
-                /* Add aces to value buffer  */
-                for (i = 0; sd->dacl && i < sd->dacl->num_aces; i++) {
-
-                        SEC_ACE *ace = &sd->dacl->ace[i];
-                        convert_sid_to_string(ipc_cli, pol,
-                                              sidstr, numeric, &ace->trustee);
+                if (! exclude_nt_group) {
+                        if (sd->grp_sid) {
+                                convert_sid_to_string(ipc_cli, pol,
+                                                      sidstr, numeric,
+                                                      sd->grp_sid);
+                        } else {
+                                fstrcpy(sidstr, "");
+                        }
 
                         if (all || all_nt) {
                                 if (determine_size) {
-                                        p = talloc_asprintf(ctx, 
-                                                            ",ACL:"
-                                                            "%s:%d/%d/0x%08x", 
-                                                            sidstr,
-                                                            ace->type,
-                                                            ace->flags,
-                                                            ace->info.mask);
+                                        p = talloc_asprintf(ctx, ",GROUP:%s",
+                                                            sidstr);
                                         if (!p) {
                                                 errno = ENOMEM;
                                                 return -1;
@@ -3547,36 +3596,22 @@ static int cacl_get(SMBCCTX *context, TALLOC_CTX *ctx, SMBCSRV *srv,
                                         n = strlen(p);
                                 } else {
                                         n = snprintf(buf, bufsize,
-                                                     ",ACL:%s:%d/%d/0x%08x", 
-                                                     sidstr,
-                                                     ace->type,
-                                                     ace->flags,
-                                                     ace->info.mask);
+                                                     ",GROUP:%s", sidstr);
                                 }
-                        } else if ((StrnCaseCmp(name, "acl", 3) == 0 &&
-                                    StrCaseCmp(name + 3, sidstr) == 0) ||
-                                   (StrnCaseCmp(name, "acl+", 4) == 0 &&
-                                    StrCaseCmp(name + 4, sidstr) == 0)) {
+                        } else if (StrnCaseCmp(name, "group", 5) == 0) {
                                 if (determine_size) {
-                                        p = talloc_asprintf(ctx, 
-                                                            "%d/%d/0x%08x", 
-                                                            ace->type,
-                                                            ace->flags,
-                                                            ace->info.mask);
+                                        p = talloc_asprintf(ctx, "%s", sidstr);
                                         if (!p) {
                                                 errno = ENOMEM;
                                                 return -1;
                                         }
                                         n = strlen(p);
                                 } else {
-                                        n = snprintf(buf, bufsize,
-                                                     "%d/%d/0x%08x", 
-                                                     ace->type,
-                                                     ace->flags,
-                                                     ace->info.mask);
+                                        n = snprintf(buf, bufsize, "%s", sidstr);
                                 }
                         }
-                        if (n > bufsize) {
+
+                        if (!determine_size && n > bufsize) {
                                 errno = ERANGE;
                                 return -1;
                         }
@@ -3585,6 +3620,97 @@ static int cacl_get(SMBCCTX *context, TALLOC_CTX *ctx, SMBCSRV *srv,
                         bufsize -= n;
                 }
 
+                if (! exclude_nt_acl) {
+                        /* Add aces to value buffer  */
+                        for (i = 0; sd->dacl && i < sd->dacl->num_aces; i++) {
+
+                                SEC_ACE *ace = &sd->dacl->ace[i];
+                                convert_sid_to_string(ipc_cli, pol,
+                                                      sidstr, numeric,
+                                                      &ace->trustee);
+
+                                if (all || all_nt) {
+                                        if (determine_size) {
+                                                p = talloc_asprintf(
+                                                        ctx, 
+                                                        ",ACL:"
+                                                        "%s:%d/%d/0x%08x", 
+                                                        sidstr,
+                                                        ace->type,
+                                                        ace->flags,
+                                                        ace->info.mask);
+                                                if (!p) {
+                                                        errno = ENOMEM;
+                                                        return -1;
+                                                }
+                                                n = strlen(p);
+                                        } else {
+                                                n = snprintf(
+                                                        buf, bufsize,
+                                                        ",ACL:%s:%d/%d/0x%08x", 
+                                                        sidstr,
+                                                        ace->type,
+                                                        ace->flags,
+                                                        ace->info.mask);
+                                        }
+                                } else if ((StrnCaseCmp(name, "acl", 3) == 0 &&
+                                            StrCaseCmp(name + 3, sidstr) == 0) ||
+                                           (StrnCaseCmp(name, "acl+", 4) == 0 &&
+                                            StrCaseCmp(name + 4, sidstr) == 0)) {
+                                        if (determine_size) {
+                                                p = talloc_asprintf(
+                                                        ctx, 
+                                                        "%d/%d/0x%08x", 
+                                                        ace->type,
+                                                        ace->flags,
+                                                        ace->info.mask);
+                                                if (!p) {
+                                                        errno = ENOMEM;
+                                                        return -1;
+                                                }
+                                                n = strlen(p);
+                                        } else {
+                                                n = snprintf(buf, bufsize,
+                                                             "%d/%d/0x%08x", 
+                                                             ace->type,
+                                                             ace->flags,
+                                                             ace->info.mask);
+                                        }
+                                } else if (all_nt_acls) {
+                                        if (determine_size) {
+                                                p = talloc_asprintf(
+                                                        ctx, 
+                                                        "%s%s:%d/%d/0x%08x",
+                                                        i ? "," : "",
+                                                        sidstr,
+                                                        ace->type,
+                                                        ace->flags,
+                                                        ace->info.mask);
+                                                if (!p) {
+                                                        errno = ENOMEM;
+                                                        return -1;
+                                                }
+                                                n = strlen(p);
+                                        } else {
+                                                n = snprintf(buf, bufsize,
+                                                             "%s%s:%d/%d/0x%08x",
+                                                             i ? "," : "",
+                                                             sidstr,
+                                                             ace->type,
+                                                             ace->flags,
+                                                             ace->info.mask);
+                                        }
+                                }
+                                if (n > bufsize) {
+                                        errno = ERANGE;
+                                        return -1;
+                                }
+                                buf += n;
+                                n_used += n;
+                                bufsize -= n;
+                        }
+                }
+
                 /* Restore name pointer to its original value */
                 name -= 19;
         }
@@ -3602,231 +3728,250 @@ static int cacl_get(SMBCCTX *context, TALLOC_CTX *ctx, SMBCSRV *srv,
                         
                 }
                 
-                if (all || all_dos) {
-                        if (determine_size) {
-                                p = talloc_asprintf(ctx,
-                                                    "%sMODE:0x%x",
-                                                    (ipc_cli &&
-                                                     (all || some_nt)
-                                                     ? ","
-                                                     : ""),
-                                                    mode);
-                                if (!p) {
-                                        errno = ENOMEM;
-                                        return -1;
+                if (! exclude_dos_mode) {
+                        if (all || all_dos) {
+                                if (determine_size) {
+                                        p = talloc_asprintf(ctx,
+                                                            "%sMODE:0x%x",
+                                                            (ipc_cli &&
+                                                             (all || some_nt)
+                                                             ? ","
+                                                             : ""),
+                                                            mode);
+                                        if (!p) {
+                                                errno = ENOMEM;
+                                                return -1;
+                                        }
+                                        n = strlen(p);
+                                } else {
+                                        n = snprintf(buf, bufsize,
+                                                     "%sMODE:0x%x",
+                                                     (ipc_cli &&
+                                                      (all || some_nt)
+                                                      ? ","
+                                                      : ""),
+                                                     mode);
                                 }
-                                n = strlen(p);
-                        } else {
-                                n = snprintf(buf, bufsize,
-                                             "%sMODE:0x%x",
-                                             (ipc_cli &&
-                                              (all || some_nt)
-                                              ? ","
-                                              : ""),
-                                             mode);
-                        }
-                } else if (StrCaseCmp(name, "mode") == 0) {
-                        if (determine_size) {
-                                p = talloc_asprintf(ctx, "0x%x", mode);
-                                if (!p) {
-                                        errno = ENOMEM;
-                                        return -1;
+                        } else if (StrCaseCmp(name, "mode") == 0) {
+                                if (determine_size) {
+                                        p = talloc_asprintf(ctx, "0x%x", mode);
+                                        if (!p) {
+                                                errno = ENOMEM;
+                                                return -1;
+                                        }
+                                        n = strlen(p);
+                                } else {
+                                        n = snprintf(buf, bufsize, "0x%x", mode);
                                 }
-                                n = strlen(p);
-                        } else {
-                                n = snprintf(buf, bufsize, "0x%x", mode);
                         }
-                }
         
-                if (!determine_size && n > bufsize) {
-                        errno = ERANGE;
-                        return -1;
+                        if (!determine_size && n > bufsize) {
+                                errno = ERANGE;
+                                return -1;
+                        }
+                        buf += n;
+                        n_used += n;
+                        bufsize -= n;
                 }
-                buf += n;
-                n_used += n;
-                bufsize -= n;
-
-                if (all || all_dos) {
-                        if (determine_size) {
-                                p = talloc_asprintf(ctx,
-                                                    ",SIZE:%llu",
-                                                    (unsigned long long) size);
-                                if (!p) {
-                                        errno = ENOMEM;
-                                        return -1;
+
+                if (! exclude_dos_size) {
+                        if (all || all_dos) {
+                                if (determine_size) {
+                                        p = talloc_asprintf(
+                                                ctx,
+                                                ",SIZE:%llu",
+                                                (unsigned long long) size);
+                                        if (!p) {
+                                                errno = ENOMEM;
+                                                return -1;
+                                        }
+                                        n = strlen(p);
+                                } else {
+                                        n = snprintf(buf, bufsize,
+                                                     ",SIZE:%llu",
+                                                     (unsigned long long) size);
                                 }
-                                n = strlen(p);
-                        } else {
-                                n = snprintf(buf, bufsize,
-                                             ",SIZE:%llu",
-                                             (unsigned long long) size);
-                        }
-                } else if (StrCaseCmp(name, "size") == 0) {
-                        if (determine_size) {
-                                p = talloc_asprintf(ctx,
-                                                    "%llu",
-                                                    (unsigned long long) size);
-                                if (!p) {
-                                        errno = ENOMEM;
-                                        return -1;
+                        } else if (StrCaseCmp(name, "size") == 0) {
+                                if (determine_size) {
+                                        p = talloc_asprintf(
+                                                ctx,
+                                                "%llu",
+                                                (unsigned long long) size);
+                                        if (!p) {
+                                                errno = ENOMEM;
+                                                return -1;
+                                        }
+                                        n = strlen(p);
+                                } else {
+                                        n = snprintf(buf, bufsize,
+                                                     "%llu",
+                                                     (unsigned long long) size);
                                 }
-                                n = strlen(p);
-                        } else {
-                                n = snprintf(buf, bufsize,
-                                             "%llu",
-                                             (unsigned long long) size);
                         }
-                }
         
-                if (!determine_size && n > bufsize) {
-                        errno = ERANGE;
-                        return -1;
+                        if (!determine_size && n > bufsize) {
+                                errno = ERANGE;
+                                return -1;
+                        }
+                        buf += n;
+                        n_used += n;
+                        bufsize -= n;
                 }
-                buf += n;
-                n_used += n;
-                bufsize -= n;
-
-                if (all || all_dos) {
-                        if (determine_size) {
-                                p = talloc_asprintf(ctx,
-                                                    ",C_TIME:%lu", c_time);
-                                if (!p) {
-                                        errno = ENOMEM;
-                                        return -1;
+
+                if (! exclude_dos_ctime) {
+                        if (all || all_dos) {
+                                if (determine_size) {
+                                        p = talloc_asprintf(ctx,
+                                                            ",C_TIME:%lu",
+                                                            c_time);
+                                        if (!p) {
+                                                errno = ENOMEM;
+                                                return -1;
+                                        }
+                                        n = strlen(p);
+                                } else {
+                                        n = snprintf(buf, bufsize,
+                                                     ",C_TIME:%lu", c_time);
                                 }
-                                n = strlen(p);
-                        } else {
-                                n = snprintf(buf, bufsize,
-                                             ",C_TIME:%lu", c_time);
-                        }
-                } else if (StrCaseCmp(name, "c_time") == 0) {
-                        if (determine_size) {
-                                p = talloc_asprintf(ctx, "%lu", c_time);
-                                if (!p) {
-                                        errno = ENOMEM;
-                                        return -1;
+                        } else if (StrCaseCmp(name, "c_time") == 0) {
+                                if (determine_size) {
+                                        p = talloc_asprintf(ctx, "%lu", c_time);
+                                        if (!p) {
+                                                errno = ENOMEM;
+                                                return -1;
+                                        }
+                                        n = strlen(p);
+                                } else {
+                                        n = snprintf(buf, bufsize, "%lu", c_time);
                                 }
-                                n = strlen(p);
-                        } else {
-                                n = snprintf(buf, bufsize, "%lu", c_time);
                         }
-                }
         
-                if (!determine_size && n > bufsize) {
-                        errno = ERANGE;
-                        return -1;
+                        if (!determine_size && n > bufsize) {
+                                errno = ERANGE;
+                                return -1;
+                        }
+                        buf += n;
+                        n_used += n;
+                        bufsize -= n;
                 }
-                buf += n;
-                n_used += n;
-                bufsize -= n;
-
-                if (all || all_dos) {
-                        if (determine_size) {
-                                p = talloc_asprintf(ctx,
-                                                    ",A_TIME:%lu", a_time);
-                                if (!p) {
-                                        errno = ENOMEM;
-                                        return -1;
+
+                if (! exclude_dos_atime) {
+                        if (all || all_dos) {
+                                if (determine_size) {
+                                        p = talloc_asprintf(ctx,
+                                                            ",A_TIME:%lu",
+                                                            a_time);
+                                        if (!p) {
+                                                errno = ENOMEM;
+                                                return -1;
+                                        }
+                                        n = strlen(p);
+                                } else {
+                                        n = snprintf(buf, bufsize,
+                                                     ",A_TIME:%lu", a_time);
                                 }
-                                n = strlen(p);
-                        } else {
-                                n = snprintf(buf, bufsize,
-                                             ",A_TIME:%lu", a_time);
-                        }
-                } else if (StrCaseCmp(name, "a_time") == 0) {
-                        if (determine_size) {
-                                p = talloc_asprintf(ctx, "%lu", a_time);
-                                if (!p) {
-                                        errno = ENOMEM;
-                                        return -1;
+                        } else if (StrCaseCmp(name, "a_time") == 0) {
+                                if (determine_size) {
+                                        p = talloc_asprintf(ctx, "%lu", a_time);
+                                        if (!p) {
+                                                errno = ENOMEM;
+                                                return -1;
+                                        }
+                                        n = strlen(p);
+                                } else {
+                                        n = snprintf(buf, bufsize, "%lu", a_time);
                                 }
-                                n = strlen(p);
-                        } else {
-                                n = snprintf(buf, bufsize, "%lu", a_time);
                         }
-                }
         
-                if (!determine_size && n > bufsize) {
-                        errno = ERANGE;
-                        return -1;
+                        if (!determine_size && n > bufsize) {
+                                errno = ERANGE;
+                                return -1;
+                        }
+                        buf += n;
+                        n_used += n;
+                        bufsize -= n;
                 }
-                buf += n;
-                n_used += n;
-                bufsize -= n;
-
-                if (all || all_dos) {
-                        if (determine_size) {
-                                p = talloc_asprintf(ctx,
-                                                    ",M_TIME:%lu", m_time);
-                                if (!p) {
-                                        errno = ENOMEM;
-                                        return -1;
+
+                if (! exclude_dos_mtime) {
+                        if (all || all_dos) {
+                                if (determine_size) {
+                                        p = talloc_asprintf(ctx,
+                                                            ",M_TIME:%lu",
+                                                            m_time);
+                                        if (!p) {
+                                                errno = ENOMEM;
+                                                return -1;
+                                        }
+                                        n = strlen(p);
+                                } else {
+                                        n = snprintf(buf, bufsize,
+                                                     ",M_TIME:%lu", m_time);
                                 }
-                                n = strlen(p);
-                        } else {
-                                n = snprintf(buf, bufsize,
-                                             ",M_TIME:%lu", m_time);
-                        }
-                } else if (StrCaseCmp(name, "m_time") == 0) {
-                        if (determine_size) {
-                                p = talloc_asprintf(ctx, "%lu", m_time);
-                                if (!p) {
-                                        errno = ENOMEM;
-                                        return -1;
+                        } else if (StrCaseCmp(name, "m_time") == 0) {
+                                if (determine_size) {
+                                        p = talloc_asprintf(ctx, "%lu", m_time);
+                                        if (!p) {
+                                                errno = ENOMEM;
+                                                return -1;
+                                        }
+                                        n = strlen(p);
+                                } else {
+                                        n = snprintf(buf, bufsize, "%lu", m_time);
                                 }
-                                n = strlen(p);
-                        } else {
-                                n = snprintf(buf, bufsize, "%lu", m_time);
                         }
-                }
         
-                if (!determine_size && n > bufsize) {
-                        errno = ERANGE;
-                        return -1;
+                        if (!determine_size && n > bufsize) {
+                                errno = ERANGE;
+                                return -1;
+                        }
+                        buf += n;
+                        n_used += n;
+                        bufsize -= n;
                 }
-                buf += n;
-                n_used += n;
-                bufsize -= n;
-
-                if (all || all_dos) {
-                        if (determine_size) {
-                                p = talloc_asprintf(ctx,
-                                                    ",INODE:%llu",
-                                                    (unsigned long long) ino);
-                                if (!p) {
-                                        errno = ENOMEM;
-                                        return -1;
+
+                if (! exclude_dos_inode) {
+                        if (all || all_dos) {
+                                if (determine_size) {
+                                        p = talloc_asprintf(
+                                                ctx,
+                                                ",INODE:%llu",
+                                                (unsigned long long) ino);
+                                        if (!p) {
+                                                errno = ENOMEM;
+                                                return -1;
+                                        }
+                                        n = strlen(p);
+                                } else {
+                                        n = snprintf(buf, bufsize,
+                                                     ",INODE:%llu",
+                                                     (unsigned long long) ino);
                                 }
-                                n = strlen(p);
-                        } else {
-                                n = snprintf(buf, bufsize,
-                                             ",INODE:%llu",
-                                             (unsigned long long) ino);
-                        }
-                } else if (StrCaseCmp(name, "inode") == 0) {
-                        if (determine_size) {
-                                p = talloc_asprintf(ctx,
-                                                    "%llu",
-                                                    (unsigned long long) ino);
-                                if (!p) {
-                                        errno = ENOMEM;
-                                        return -1;
+                        } else if (StrCaseCmp(name, "inode") == 0) {
+                                if (determine_size) {
+                                        p = talloc_asprintf(
+                                                ctx,
+                                                "%llu",
+                                                (unsigned long long) ino);
+                                        if (!p) {
+                                                errno = ENOMEM;
+                                                return -1;
+                                        }
+                                        n = strlen(p);
+                                } else {
+                                        n = snprintf(buf, bufsize,
+                                                     "%llu",
+                                                     (unsigned long long) ino);
                                 }
-                                n = strlen(p);
-                        } else {
-                                n = snprintf(buf, bufsize,
-                                             "%llu",
-                                             (unsigned long long) ino);
                         }
-                }
         
-                if (!determine_size && n > bufsize) {
-                        errno = ERANGE;
-                        return -1;
+                        if (!determine_size && n > bufsize) {
+                                errno = ERANGE;
+                                return -1;
+                        }
+                        buf += n;
+                        n_used += n;
+                        bufsize -= n;
                 }
-                buf += n;
-                n_used += n;
-                bufsize -= n;
 
                 /* Restore name pointer to its original value */
                 name -= 16;
@@ -3873,7 +4018,8 @@ static int cacl_set(TALLOC_CTX *ctx, struct cli_state *cli,
                         the_acl = p + 1;
                 }
 
-                sd = sec_desc_parse(ctx, ipc_cli, pol, numeric, (char *) the_acl);
+                sd = sec_desc_parse(ctx, ipc_cli, pol, numeric,
+                                    CONST_DISCARD(char *, the_acl));
 
                 if (!sd) {
                         errno = EINVAL;
@@ -4380,9 +4526,13 @@ int smbc_getxattr_ctx(SMBCCTX *context,
 
         /* Are they requesting a supported attribute? */
         if (StrCaseCmp(name, "system.*") == 0 ||
+            StrnCaseCmp(name, "system.*!", 9) == 0 ||
             StrCaseCmp(name, "system.*+") == 0 ||
+            StrnCaseCmp(name, "system.*+!", 10) == 0 ||
             StrCaseCmp(name, "system.nt_sec_desc.*") == 0 ||
+            StrnCaseCmp(name, "system.nt_sec_desc.*!", 21) == 0 ||
             StrCaseCmp(name, "system.nt_sec_desc.*+") == 0 ||
+            StrnCaseCmp(name, "system.nt_sec_desc.*+!", 22) == 0 ||
             StrCaseCmp(name, "system.nt_sec_desc.revision") == 0 ||
             StrCaseCmp(name, "system.nt_sec_desc.owner") == 0 ||
             StrCaseCmp(name, "system.nt_sec_desc.owner+") == 0 ||
@@ -4391,6 +4541,7 @@ int smbc_getxattr_ctx(SMBCCTX *context,
             StrnCaseCmp(name, "system.nt_sec_desc.acl", 22) == 0 ||
             StrnCaseCmp(name, "system.nt_sec_desc.acl+", 23) == 0 ||
             StrCaseCmp(name, "system.dos_attr.*") == 0 ||
+            StrnCaseCmp(name, "system.dos_attr.*!", 18) == 0 ||
             StrCaseCmp(name, "system.dos_attr.mode") == 0 ||
             StrCaseCmp(name, "system.dos_attr.size") == 0 ||
             StrCaseCmp(name, "system.dos_attr.c_time") == 0 ||
@@ -4401,7 +4552,9 @@ int smbc_getxattr_ctx(SMBCCTX *context,
                 /* Yup. */
                 ret = cacl_get(context, ctx, srv,
                                ipc_srv == NULL ? NULL : &ipc_srv->cli, 
-                               &pol, path, (char *) name, (char *) value, size);
+                               &pol, path,
+                               CONST_DISCARD(char *, name),
+                               CONST_DISCARD(char *, value), size);
                 if (ret < 0 && errno == 0) {
                         errno = smbc_errno(context, &srv->cli);
                 }
@@ -4540,6 +4693,7 @@ int smbc_listxattr_ctx(SMBCCTX *context,
                 "system.nt_sec_desc.owner+\0"
                 "system.nt_sec_desc.group\0"
                 "system.nt_sec_desc.group+\0"
+                "system.nt_sec_desc.acl.*\0"
                 "system.nt_sec_desc.acl\0"
                 "system.nt_sec_desc.acl+\0"
                 "system.nt_sec_desc.*\0"
diff --git a/source3/libsmb/spnego.c b/source3/libsmb/spnego.c
index 090148d415..0387e8f67d 100644
--- a/source3/libsmb/spnego.c
+++ b/source3/libsmb/spnego.c
@@ -47,7 +47,9 @@ static BOOL read_negTokenInit(ASN1_DATA *asn1, negTokenInit_t *token)
 				     0 < asn1_tag_remaining(asn1); i++) {
 				token->mechTypes = 
 					SMB_REALLOC_ARRAY(token->mechTypes, const char *, i + 2);
-				asn1_read_OID(asn1, (char **) (token->mechTypes + i));
+				asn1_read_OID(asn1,
+                                              CONST_DISCARD(char **,
+                                                              (token->mechTypes + i)));
 			}
 			token->mechTypes[i] = NULL;
 			
@@ -182,7 +184,7 @@ static BOOL read_negTokenTarg(ASN1_DATA *asn1, negTokenTarg_t *token)
 			break;
 		case ASN1_CONTEXT(1):
 			asn1_start_tag(asn1, ASN1_CONTEXT(1));
-			asn1_read_OID(asn1, (char **) &token->supportedMech);
+			asn1_read_OID(asn1, CONST_DISCARD(char **, &token->supportedMech));
 			asn1_end_tag(asn1);
 			break;
 		case ASN1_CONTEXT(2):
@@ -317,7 +319,8 @@ BOOL free_spnego_data(SPNEGO_DATA *spnego)
 		if (spnego->negTokenInit.mechTypes) {
 			int i;
 			for (i = 0; spnego->negTokenInit.mechTypes[i]; i++) {
-				free((void *) spnego->negTokenInit.mechTypes[i]);
+				free(CONST_DISCARD(void *,
+                                                     spnego->negTokenInit.mechTypes[i]));
 			}
 			free(spnego->negTokenInit.mechTypes);
 		}
@@ -326,7 +329,7 @@ BOOL free_spnego_data(SPNEGO_DATA *spnego)
 		break;
 	case SPNEGO_NEG_TOKEN_TARG:
 		if (spnego->negTokenTarg.supportedMech) {
-			free((void *) spnego->negTokenTarg.supportedMech);
+			free(CONST_DISCARD(void *, spnego->negTokenTarg.supportedMech));
 		}
 		data_blob_free(&spnego->negTokenTarg.responseToken);
 		data_blob_free(&spnego->negTokenTarg.mechListMIC);
diff --git a/source3/modules/getdate.c b/source3/modules/getdate.c
index 491c51294e..2ce07f898c 100644
--- a/source3/modules/getdate.c
+++ b/source3/modules/getdate.c
@@ -120,11 +120,10 @@
    the right thing about local DST.  Unlike previous versions, this
    version is reentrant.  */
 
-#ifdef HAVE_CONFIG_H
-# include <config.h>
-# ifdef HAVE_ALLOCA_H
-#  include <alloca.h>
-# endif
+#include <config.h>
+
+#ifdef HAVE_ALLOCA_H
+# include <alloca.h>
 #endif
 
 /* Since the code of getdate.y is not included in the Emacs executable
diff --git a/source3/modules/getdate.y b/source3/modules/getdate.y
index aab37f4d23..ecae7311ac 100644
--- a/source3/modules/getdate.y
+++ b/source3/modules/getdate.y
@@ -25,11 +25,10 @@
    the right thing about local DST.  Unlike previous versions, this
    version is reentrant.  */
 
-#ifdef HAVE_CONFIG_H
-# include <config.h>
-# ifdef HAVE_ALLOCA_H
-#  include <alloca.h>
-# endif
+#include <config.h>
+
+#ifdef HAVE_ALLOCA_H
+# include <alloca.h>
 #endif
 
 /* Since the code of getdate.y is not included in the Emacs executable
diff --git a/source3/modules/weird.c b/source3/modules/weird.c
index 3c59fd9d61..e4809a64c4 100644
--- a/source3/modules/weird.c
+++ b/source3/modules/weird.c
@@ -26,8 +26,8 @@ static struct {
 	char *to;
 	int len;
 } weird_table[] = {
-	{'q', "^q^", 3},
-	{'Q', "^Q^", 3},
+	{'q', CONST_DISCARD(char *, "^q^"), 3},
+	{'Q', CONST_DISCARD(char *, "^Q^"), 3},
 	{0, NULL}
 };
 
diff --git a/source3/nsswitch/wb_common.c b/source3/nsswitch/wb_common.c
index 9caf7affc3..6ba0cbbf42 100644
--- a/source3/nsswitch/wb_common.c
+++ b/source3/nsswitch/wb_common.c
@@ -26,6 +26,9 @@
 
 #include "winbind_client.h"
 
+#define CONST_DISCARD(type, ptr)      ((type) ((void *) (ptr)))
+#define CONST_ADD(type, ptr)          ((type) ((const void *) (ptr)))
+
 /* Global variables.  These are effectively the client state information */
 
 int winbindd_fd = -1;           /* fd for winbindd socket */
@@ -606,14 +609,14 @@ NSS_STATUS winbindd_request(int req_type,
 
 BOOL winbind_off( void )
 {
-	static char *s = WINBINDD_DONT_ENV "=1";
+        static char *s = CONST_DISCARD(char *, WINBINDD_DONT_ENV "=1");
 
 	return putenv(s) != -1;
 }
 
 BOOL winbind_on( void )
 {
-	static char *s = WINBINDD_DONT_ENV "=0";
+	static char *s = CONST_DISCARD(char *, WINBINDD_DONT_ENV "=0");
 
 	return putenv(s) != -1;
 }
diff --git a/source3/nsswitch/winbindd_nss.h b/source3/nsswitch/winbindd_nss.h
index 838ba1e211..06ebd68f8f 100644
--- a/source3/nsswitch/winbindd_nss.h
+++ b/source3/nsswitch/winbindd_nss.h
@@ -11,7 +11,7 @@
 */
 
 #ifndef SAFE_FREE
-#define SAFE_FREE(x) do { if(x) {free((void *) (x)); x=NULL;} } while(0)
+#define SAFE_FREE(x) do { if(x) {free(CONST_DISCARD(void *, (x))); x=NULL;} } while(0)
 #endif
 
 #ifndef _WINBINDD_NTDOM_H
diff --git a/source3/nsswitch/winbindd_rpc.c b/source3/nsswitch/winbindd_rpc.c
index 5e974736e3..1dfa810a8d 100644
--- a/source3/nsswitch/winbindd_rpc.c
+++ b/source3/nsswitch/winbindd_rpc.c
@@ -789,7 +789,7 @@ static int get_ldap_seq(const char *server, int port, uint32 *seq)
 	to.tv_usec = 0;
 
 	if (ldap_search_st(ldp, "", LDAP_SCOPE_BASE, "(objectclass=*)",
-                           (char **) &attrs[0], 0, &to, &res))
+                           CONST_DISCARD(char **, &attrs[0]), 0, &to, &res))
 		goto done;
 
 	if (ldap_count_entries(ldp, res) != 1)
diff --git a/source3/nsswitch/winbindd_util.c b/source3/nsswitch/winbindd_util.c
index 3d03d6f4cc..9ae24e401f 100644
--- a/source3/nsswitch/winbindd_util.c
+++ b/source3/nsswitch/winbindd_util.c
@@ -636,7 +636,7 @@ BOOL parse_domain_user(const char *domuser, fstring domain, fstring user)
 */
 void fill_domain_username(fstring name, const char *domain, const char *user)
 {
-        strlower_m( (char *) user );
+        strlower_m(CONST_DISCARD(char *, user));
 
 	if (assume_domain(domain)) {
 		strlcpy(name, user, sizeof(fstring));
diff --git a/source3/passdb/pdb_get_set.c b/source3/passdb/pdb_get_set.c
index 4b59b5fdf9..99afac133a 100644
--- a/source3/passdb/pdb_get_set.c
+++ b/source3/passdb/pdb_get_set.c
@@ -1195,7 +1195,7 @@ BOOL pdb_set_plaintext_passwd (SAM_ACCOUNT *sampass, const char *plaintext)
 			/* We need to make sure we don't have a race condition here - the
 			   account policy history length can change between when the pw_history
 			   was first loaded into the SAM_ACCOUNT struct and now.... JRA. */
-			pwhistory = (uchar *)pdb_get_pw_history(sampass, &current_history_len);
+			pwhistory = CONST_DISCARD(uchar *, pdb_get_pw_history(sampass, &current_history_len));
 
 			if (current_history_len != pwHistLen) {
 				/* After closing and reopening SAM_ACCOUNT the history
diff --git a/source3/rpc_server/srv_svcctl_nt.c b/source3/rpc_server/srv_svcctl_nt.c
index cb04ef1d10..a76e68a312 100644
--- a/source3/rpc_server/srv_svcctl_nt.c
+++ b/source3/rpc_server/srv_svcctl_nt.c
@@ -27,14 +27,14 @@
  * sertup the \PIPE\svcctl db API
  */
  
-static TDB_CONTEXT *svcctl_tdb; /* used for share security descriptors */
-
 #define SCVCTL_DATABASE_VERSION_V1 1
 
 /********************************************************************
 ********************************************************************/
 
-#if 0 /* unused static function */
+#if 0 /* unused static function and static variable*/
+
+static TDB_CONTEXT *svcctl_tdb; /* used for share security descriptors */
 
 static BOOL init_svcctl_db( void )
 {
diff --git a/source3/smbd/notify_kernel.c b/source3/smbd/notify_kernel.c
index 8fcc18a09f..c368fd79a1 100644
--- a/source3/smbd/notify_kernel.c
+++ b/source3/smbd/notify_kernel.c
@@ -101,8 +101,9 @@ static BOOL kernel_check_notify(connection_struct *conn, uint16 vuid, char *path
 			close((int)fd_pending_array[i]);
 			fd_pending_array[i] = (SIG_ATOMIC_T)-1;
 			if (signals_received - i - 1) {
-				memmove((void *)&fd_pending_array[i], (void *)&fd_pending_array[i+1],
-						sizeof(SIG_ATOMIC_T)*(signals_received-i-1));
+				memmove(CONST_DISCARD(void *, &fd_pending_array[i]),
+                                        CONST_DISCARD(void *, &fd_pending_array[i+1]),
+                                        sizeof(SIG_ATOMIC_T)*(signals_received-i-1));
 			}
 			data->directory_handle = -1;
 			signals_received--;
@@ -129,8 +130,9 @@ static void kernel_remove_notify(void *datap)
 			if (fd == (int)fd_pending_array[i]) {
 				fd_pending_array[i] = (SIG_ATOMIC_T)-1;
 				if (signals_received - i - 1) {
-					memmove((void *)&fd_pending_array[i], (void *)&fd_pending_array[i+1],
-							sizeof(SIG_ATOMIC_T)*(signals_received-i-1));
+					memmove(CONST_DISCARD(void *, &fd_pending_array[i]),
+                                                CONST_DISCARD(void *, &fd_pending_array[i+1]),
+                                                sizeof(SIG_ATOMIC_T)*(signals_received-i-1));
 				}
 				data->directory_handle = -1;
 				signals_received--;
diff --git a/source3/smbd/oplock_linux.c b/source3/smbd/oplock_linux.c
index 5de9dd56e6..fe324577e1 100644
--- a/source3/smbd/oplock_linux.c
+++ b/source3/smbd/oplock_linux.c
@@ -69,16 +69,21 @@ static void set_capability(unsigned capability)
 #define _LINUX_CAPABILITY_VERSION 0x19980330
 #endif
 	/* these can be removed when they are in glibc headers */
-	struct  {
+	struct  cap_user_header {
 		uint32 version;
 		int pid;
 	} header;
-	struct {
+	struct cap_user_data {
 		uint32 effective;
 		uint32 permitted;
 		uint32 inheritable;
 	} data;
 
+        extern int capget(struct cap_user_header * hdrp,
+                          struct cap_user_data * datap);
+        extern int capset(struct cap_user_header * hdrp,
+                          const struct cap_user_data * datap);
+
 	header.version = _LINUX_CAPABILITY_VERSION;
 	header.pid = 0;
 
@@ -133,7 +138,8 @@ static BOOL linux_oplock_receive_message(fd_set *fds, char *buffer, int buffer_l
 	fsp = file_find_fd(fd);
 	fd_pending_array[0] = (SIG_ATOMIC_T)-1;
 	if (signals_received > 1)
-		memmove((void *)&fd_pending_array[0], (void *)&fd_pending_array[1],
+                memmove(CONST_DISCARD(void *, &fd_pending_array[0]),
+                        CONST_DISCARD(void *, &fd_pending_array[1]),
 			sizeof(SIG_ATOMIC_T)*(signals_received-1));
 	signals_received--;
 	/* now we can receive more signals */
diff --git a/source3/smbd/sesssetup.c b/source3/smbd/sesssetup.c
index 48524b472d..60867df653 100644
--- a/source3/smbd/sesssetup.c
+++ b/source3/smbd/sesssetup.c
@@ -313,7 +313,9 @@ static int reply_spnego_kerberos(connection_struct *conn,
 
         /* wrap that up in a nice GSS-API wrapping */
 	if (NT_STATUS_IS_OK(ret)) {
-		ap_rep_wrapped = spnego_gen_krb5_wrap(ap_rep, TOK_ID_KRB_AP_REP);
+		ap_rep_wrapped = spnego_gen_krb5_wrap(
+                        ap_rep,
+                        CONST_ADD(const uint8 *, TOK_ID_KRB_AP_REP));
 	} else {
 		ap_rep_wrapped = data_blob(NULL, 0);
 	}
diff --git a/source3/tdb/tdb.c b/source3/tdb/tdb.c
index 0644b64da0..f153e2f258 100644
--- a/source3/tdb/tdb.c
+++ b/source3/tdb/tdb.c
@@ -128,7 +128,7 @@
 
 /* free memory if the pointer is valid and zero the pointer */
 #ifndef SAFE_FREE
-#define SAFE_FREE(x) do { if ((x) != NULL) {free((void *) (x)); (x)=NULL;} } while(0)
+#define SAFE_FREE(x) do { if ((x) != NULL) {free(CONST_DISCARD(void *, (x))); (x)=NULL;} } while(0)
 #endif
 
 #define BUCKET(hash) ((hash) % tdb->header.hash_size)
diff --git a/source3/tdb/tdbutil.c b/source3/tdb/tdbutil.c
index 29fbd25904..4fcfb6185a 100644
--- a/source3/tdb/tdbutil.c
+++ b/source3/tdb/tdbutil.c
@@ -43,7 +43,7 @@ static void gotalarm_sig(void)
 TDB_DATA make_tdb_data(const char *dptr, size_t dsize)
 {
 	TDB_DATA ret;
-	ret.dptr = (char *) dptr;
+	ret.dptr = CONST_DISCARD(char *, dptr);
 	ret.dsize = dsize;
 	return ret;
 }
@@ -62,7 +62,7 @@ static int tdb_chainlock_with_timeout_internal( TDB_CONTEXT *tdb, TDB_DATA key,
 	/* Allow tdb_chainlock to be interrupted by an alarm. */
 	int ret;
 	gotalarm = 0;
-	tdb_set_lock_alarm((sig_atomic_t *) &gotalarm);
+	tdb_set_lock_alarm(CONST_DISCARD(sig_atomic_t *, &gotalarm));
 
 	if (timeout) {
 		CatchSignal(SIGALRM, SIGNAL_CAST gotalarm_sig);
diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c
index 83fdb08a9a..34a357cd46 100644
--- a/source3/utils/net_ads.c
+++ b/source3/utils/net_ads.c
@@ -81,7 +81,7 @@ static int net_ads_lookup(int argc, const char **argv)
 		d_printf("Didn't find the cldap server!\n");
 		return -1;
 	} if (!ads->config.realm) {
-                ads->config.realm = (char *) opt_target_workgroup;
+                ads->config.realm = CONST_DISCARD(char *, opt_target_workgroup);
 		ads->ldap_port = 389;
 	}
 
@@ -1168,7 +1168,7 @@ static int net_ads_password(int argc, const char **argv)
 	}
 
 	if (argv[1]) {
-		new_password = (char *)argv[1];
+		new_password = CONST_DISCARD(char *, argv[1]);
 	} else {
 		asprintf(&prompt, "Enter new password for %s:", user);
 		new_password = getpass(prompt);
diff --git a/source3/utils/net_lookup.c b/source3/utils/net_lookup.c
index 7f7a88c66d..9ddfe62508 100644
--- a/source3/utils/net_lookup.c
+++ b/source3/utils/net_lookup.c
@@ -193,7 +193,7 @@ static int net_lookup_kdc(int argc, const char **argv)
 	}
 
 	if (argc>0) {
-		realm.data = (krb5_pointer) argv[0];
+                realm.data = CONST_DISCARD(krb5_pointer, argv[0]);
 		realm.length = strlen(argv[0]);
 	} else if (lp_realm() && *lp_realm()) {
 		realm.data = (krb5_pointer) lp_realm();
diff --git a/source3/utils/smbcontrol.c b/source3/utils/smbcontrol.c
index 154bc5b1ae..5a7b6548c2 100644
--- a/source3/utils/smbcontrol.c
+++ b/source3/utils/smbcontrol.c
@@ -428,7 +428,8 @@ static BOOL do_printnotify(const pid_t pid, const int argc, const char **argv)
 			return False;
 		}
 
-		notify_printer_byname(argv[2], attribute, (char *) argv[4]);
+		notify_printer_byname(argv[2], attribute,
+                                      CONST_DISCARD(char *, argv[4]));
 
 		goto send;
 	}
diff --git a/source3/web/neg_lang.c b/source3/web/neg_lang.c
index ca671822d8..cc2924afde 100644
--- a/source3/web/neg_lang.c
+++ b/source3/web/neg_lang.c
@@ -54,8 +54,8 @@ struct pri_list {
 };
 
 static int qsort_cmp_list(const void *x, const void *y) {
-	struct pri_list *a = (struct pri_list *)x;
-	struct pri_list *b = (struct pri_list *)y;
+        struct pri_list *a = CONST_DISCARD(struct pri_list *, x);
+	struct pri_list *b = CONST_DISCARD(struct pri_list *, y);
 	if (a->pri > b->pri) return -1;
 	if (a->pri == b->pri) return 0;
 	return 1;