Michal Hajek
2013-Nov-27 10:57 UTC
[Samba] Samba4 - ACL not applied/followed (worked in samba 3.0.11)
Hi.
samba 4.1.1.. User has unix rights for writing, but samba denies write
access to him.
On samba server:
amistest at samba:~$ id
uid=6603(amistest) gid=20(users-nis)
groups=20(users-nis),2108(evis),2109(slp),2112(hernie),2126(poj),2133(hto),20000(users)
-> user amistest is in "poj" group
amistest at samba:~$ ls -ld ACLTEST
drwxrwxr-x+ 2 hrubos vema 4096 Nov 27 11:05 ACLTEST
amistest at samba:~$ getfacl ACLTEST/
# file: ACLTEST
# owner: hrubos
# group: vema
user::rwx
group::rwx
group:poj:rwx
mask::rwx
other::r-x
-> group poj can write in ACLTEST directory
amistest at samba:~$ touch ACLTEST/test
amistest at samba:~$ ls -l ACLTEST
total 4
-rw-rwxr--+ 1 hrubos poj 0 Nov 27 10:54 POKUS
-rw-r--r-- 1 amistest users-nis 0 Nov 27 11:35 test
amistest at samba:~$
-> user amistest can write in ACLTEST directory.
On PC, amistest logged into domain (sorry, it is in Czech):
S:\>dir ACLTEST
Svazek v jednotce S je amistest.
S?riov? ??slo svazku je EE7A-B776.
V?pis adres??e S:\ACLTEST
27.11.2013 11:03 <DIR> .
04.11.2013 09:52 <DIR> ..
27.11.2013 10:54 0 POKUS
27.11.2013 11:35 0 test
2 soubor?, 0 bajt?
Adres???: 2, Voln?ch bajt?: 200 429 568
-> user amistest sees ACLTEST directory
S:\>net group /domain poj
Po?adavek bude zpracov?n na prim?rn?m ?adi?i dom?ny NIS.
N?zev skupiny poj
Koment??
?lenov?
-----------------------------------------------------------------------
amistest .....
P??kaz byl ?sp??n? dokon?en.
-> user amistest in in "poj" group (seen from pc)
S:\>mkdir ACLTEST\testdir
P??stup byl odep?en.
-> user amistest can NOT write into the directory.
Homes section of smb.conf:
[homes]
comment = Home Directories
path = /home/%u
read only = No
create mask = 0700
directory mask = 0700
inherit acls = Yes
browseable = No
root preexec = /usr/local/bin/RPE '%u' 'HOMESHARE'
The same configuration worked in samba 3.0.11.
The questions are:
- how to check that samba 4.1.1 was compiled with acl support (I know it is
default, but...)?
- which parameter for samba 4.1.1 am I missing?
Thanks, Michal
Michal Hajek
2013-Dec-09 08:39 UTC
[Samba] Samba4 - ACL not applied/followed (worked in samba 3.0.11)
OK, I will answer myself to myself. Its is because samba3 capabilities is NOT subset of samba4 ones. Samba4 seems not to bother with Linux ACL at all (or maybe only in some magic way, which I did not discovered in a week of searching)! When I compiled and run v3.6, everything works as expected at first try. So for all wondering which version to choose when upgrading to v4 from v3 (with no need of AD ) - if you use -or plan using- linux ACL, your ONLY ONE choice is v3. I can not get that such insidious v4 behaviour is not clearly stated on samba pages. Michal On Wed, Nov 27, 2013 at 11:57 AM, Michal Hajek <Hajek67 at gmail.com> wrote:> Hi. > > samba 4.1.1.. User has unix rights for writing, but samba denies write > access to him. > > On samba server: > amistest at samba:~$ id > uid=6603(amistest) gid=20(users-nis) > groups=20(users-nis),2108(evis),2109(slp),2112(hernie),2126(poj),2133(hto),20000(users) > > -> user amistest is in "poj" group > > amistest at samba:~$ ls -ld ACLTEST > drwxrwxr-x+ 2 hrubos vema 4096 Nov 27 11:05 ACLTEST > amistest at samba:~$ getfacl ACLTEST/ > # file: ACLTEST > # owner: hrubos > # group: vema > user::rwx > group::rwx > group:poj:rwx > mask::rwx > other::r-x > > -> group poj can write in ACLTEST directory > > amistest at samba:~$ touch ACLTEST/test > amistest at samba:~$ ls -l ACLTEST > total 4 > -rw-rwxr--+ 1 hrubos poj 0 Nov 27 10:54 POKUS > -rw-r--r-- 1 amistest users-nis 0 Nov 27 11:35 test > amistest at samba:~$ > > -> user amistest can write in ACLTEST directory. > > On PC, amistest logged into domain (sorry, it is in Czech): > > S:\>dir ACLTEST > > Svazek v jednotce S je amistest. > S?riov? ??slo svazku je EE7A-B776. > > V?pis adres??e S:\ACLTEST > > 27.11.2013 11:03 <DIR> . > 04.11.2013 09:52 <DIR> .. > 27.11.2013 10:54 0 POKUS > 27.11.2013 11:35 0 test > 2 soubor?, 0 bajt? > Adres???: 2, Voln?ch bajt?: 200 429 568 > > -> user amistest sees ACLTEST directory > > > S:\>net group /domain poj > Po?adavek bude zpracov?n na prim?rn?m ?adi?i dom?ny NIS. > > N?zev skupiny poj > Koment?? > > ?lenov? > > ----------------------------------------------------------------------- > amistest ..... > > P??kaz byl ?sp??n? dokon?en. > > -> user amistest in in "poj" group (seen from pc) > > > S:\>mkdir ACLTEST\testdir > P??stup byl odep?en. > > -> user amistest can NOT write into the directory. > > Homes section of smb.conf: > > [homes] > comment = Home Directories > path = /home/%u > read only = No > create mask = 0700 > directory mask = 0700 > inherit acls = Yes > browseable = No > root preexec = /usr/local/bin/RPE '%u' 'HOMESHARE' > > The same configuration worked in samba 3.0.11. > > The questions are: > - how to check that samba 4.1.1 was compiled with acl support (I know it > is default, but...)? > - which parameter for samba 4.1.1 am I missing? > > Thanks, Michal > > > > >
Michal Hajek
2013-Dec-16 11:23 UTC
[Samba] Fwd: Samba4 - ACL not applied/followed (worked in samba 3.0.11)
I start smbd and nmbd (and no winbind), so I expect "v3" behaviour. Including ACL. Am I right? But ACL are not applied on shares. Any new parameters for v4 needed? Michal On Mon, Dec 16, 2013 at 12:13 PM, Rowland Penny <rowlandpenny at googlemail.com> wrote:> On 16/12/13 11:00, Michal Hajek wrote: > > For clarity: By ACL I mean LINUX ACLs (seftacl, getfacl), NOT anything > set from Windows clients. > > On Mon, Dec 16, 2013 at 11:32 AM, Rowland Penny < > rowlandpenny at googlemail.com> wrote: > >> On 09/12/13 08:39, Michal Hajek wrote: >> >>> OK, I will answer myself to myself. >>> >>> Its is because samba3 capabilities is NOT subset of samba4 ones. Samba4 >>> seems not to bother with Linux ACL at all (or maybe only in some magic >>> way, >>> which I did not discovered in a week of searching)! When I compiled and >>> run v3.6, everything works as expected at first try. >>> >> Do you have ACL's turned on for the partions that hold the shares? >> >> > Do you mean on the Linux FS? Yes, of course, as you can see in my first > mail (ACL is on and it works both directly on Linux FS and Samba v3 shares). > If you mean "explicitly in the share section of your smb.conf" then no. > I do not know how to do that. I had spent nice few hours trying to > configure that. (And I must say Samba documentation really sucks.) > > >> >> >>> So for all wondering which version to choose when upgrading to v4 from v3 >>> (with no need of AD ) - if you use -or plan using- linux ACL, your ONLY >>> ONE >>> choice is v3. >>> >>> I can not get that such insidious v4 behaviour is not clearly stated on >>> samba pages. >>> >>> Michal >>> >>> Yes you are right Samba4 does work differently from S3 when running in >> AD mode, it runs like a windows server, but you can run Samba4 just like S3 >> and if that is all you require, then I suggest that this is what you do. S3 >> is in security fixes mode now and will be discontinued sometime in August >> 2014 (approx). >> >> > V 4.1.0 compiled, started, ACL on shares not working. > V 3.6.22 compiled, started, ACL on shares working (the same smb.conf). > > How can I "run Samba4 just like S3"? It is possible I am missing some > additional v4 parameter/setting, but I did not find which one. > > Thanks, > Michal > > > >> Rowland >> >> >> >>> On Wed, Nov 27, 2013 at 11:57 AM, Michal Hajek <Hajek67 at gmail.com> >>> wrote: >>> >>> Hi. >>>> >>>> samba 4.1.1.. User has unix rights for writing, but samba denies write >>>> access to him. >>>> >>>> On samba server: >>>> amistest at samba:~$ id >>>> uid=6603(amistest) gid=20(users-nis) >>>> >>>> groups=20(users-nis),2108(evis),2109(slp),2112(hernie),2126(poj),2133(hto),20000(users) >>>> >>>> -> user amistest is in "poj" group >>>> >>>> amistest at samba:~$ ls -ld ACLTEST >>>> drwxrwxr-x+ 2 hrubos vema 4096 Nov 27 11:05 ACLTEST >>>> amistest at samba:~$ getfacl ACLTEST/ >>>> # file: ACLTEST >>>> # owner: hrubos >>>> # group: vema >>>> user::rwx >>>> group::rwx >>>> group:poj:rwx >>>> mask::rwx >>>> other::r-x >>>> >>>> -> group poj can write in ACLTEST directory >>>> >>>> amistest at samba:~$ touch ACLTEST/test >>>> amistest at samba:~$ ls -l ACLTEST >>>> total 4 >>>> -rw-rwxr--+ 1 hrubos poj 0 Nov 27 10:54 POKUS >>>> -rw-r--r-- 1 amistest users-nis 0 Nov 27 11:35 test >>>> amistest at samba:~$ >>>> >>>> -> user amistest can write in ACLTEST directory. >>>> >>>> On PC, amistest logged into domain (sorry, it is in Czech): >>>> >>>> S:\>dir ACLTEST >>>> >>>> Svazek v jednotce S je amistest. >>>> S?riov? ??slo svazku je EE7A-B776. >>>> >>>> V?pis adres??e S:\ACLTEST >>>> >>>> 27.11.2013 11:03 <DIR> . >>>> 04.11.2013 09:52 <DIR> .. >>>> 27.11.2013 10:54 0 POKUS >>>> 27.11.2013 11:35 0 test >>>> 2 soubor?, 0 bajt? >>>> Adres???: 2, Voln?ch bajt?: 200 429 568 >>>> >>>> -> user amistest sees ACLTEST directory >>>> >>>> >>>> S:\>net group /domain poj >>>> Po?adavek bude zpracov?n na prim?rn?m ?adi?i dom?ny NIS. >>>> >>>> N?zev skupiny poj >>>> Koment?? >>>> >>>> ?lenov? >>>> >>>> ----------------------------------------------------------------------- >>>> amistest ..... >>>> >>>> P??kaz byl ?sp??n? dokon?en. >>>> >>>> -> user amistest in in "poj" group (seen from pc) >>>> >>>> >>>> S:\>mkdir ACLTEST\testdir >>>> P??stup byl odep?en. >>>> >>>> -> user amistest can NOT write into the directory. >>>> >>>> Homes section of smb.conf: >>>> >>>> [homes] >>>> comment = Home Directories >>>> path = /home/%u >>>> read only = No >>>> create mask = 0700 >>>> directory mask = 0700 >>>> inherit acls = Yes >>>> browseable = No >>>> root preexec = /usr/local/bin/RPE '%u' 'HOMESHARE' >>>> >>>> The same configuration worked in samba 3.0.11. >>>> >>>> The questions are: >>>> - how to check that samba 4.1.1 was compiled with acl support (I know it >>>> is default, but...)? >>>> - which parameter for samba 4.1.1 am I missing? >>>> >>>> Thanks, Michal >>>> >>>> >>>> >>>> >>>> >>>> >> > When you provision S4 and then run it in AD mode, you start the samba > daemon, this in turn starts the smbd daemon, you should then consider it to > be a windows server and connect to it as if it was one. > > But you can set S4 just up like S3 and start the smbd & nmbd daemons (and > optionally the winbind daemon), it will then work just an S3 machine, so > you can set it up as an old style NT PDC, a standalone server or a > memberserver joined to an AD domain, in fact anything an S3 machine can do, > a S4 machine can do. > > If you do run S4 as an AD server, then connect to it as if it was a > windows server and you will not go far wrong. > > Rowland > >