samba - Aug 2018 - explorer.exe crashes on security tab access

By primary group I mean the group that is set by chgrp. that is the group
returned after the pound key (#) from getfacl. In other words the Unix
group and not the one managed by ACLs.

/ Kacper
> Hello,
>
> I've seem to have found what looks like a bug in Samba 4.8.3. It's
> the same problem as described in
> https://lists.samba.org/archive/samba/2018-March/214589.html. When
> accessing the Security tab on files and folder from a share
> explorer.exe crashes.
>> It doesn't crash for me.
>
> I've been able to track down that it only happens when the primary
> group of a file or folder is a Unix group. Using an AD group as the
> primary group of files and folders does not crash Windows.
>> Can you expand on what you mean by 'primary group'
>
> I would appreciate any pointers or assistance in collecting as much
> valuable information to create a bug report.
>> Let's make sure it is a bug first ;-)
>> Rowland

On Thu, 16 Aug 2018 16:59:22 +0200
Kacper <kacper at kacper.se> wrote:
> By primary group I mean the group that is set by chgrp. that is the
> group returned after the pound key (#) from getfacl. In other words
> the Unix group and not the one managed by ACLs.
> 
That is not necessarily the users primary group, the users primary
group is the one displayed by 'getent passwd username' e.g.

root at dc4:~# getent passwd SAMDOM\\rowland
SAMDOM\rowland:*:10000:10000:Rowland Penny:/home/rowland:/bin/bash

The second number is the users primary group, in this case '10000',
which is:

root at dc4:~# getent group 10000
SAMDOM\domain users:x:10000:

But if I create a file in a share and ensure it belongs to the user
with a group that isn't the users primary group (which seems to be what
you are describing), I get:

root at dc4:~# ls -la /srv/samba/Demo/test.txt 
-rw-rwxr--+ 1 SAMDOM\rowland SAMDOM\unixgroup 0 Aug 16 11:29
/srv/samba/Demo/test.txt

And getfacl shows:

root at dc4:~# getfacl /srv/samba/Demo/test.txt 
getfacl: Removing leading '/' from absolute path names
# file: srv/samba/Demo/test.txt
# owner: SAMDOM\134rowland
# group: SAMDOM\134unixgroup
user::rw-
user:root:rw-
user:SAMDOM\134rowland:rw-
group::r--
group:SAMDOM\134unixgroup:r--
group:SAMDOM\134unix\040admins:rw-
mask::rwx
other::r--

If I now go to a Win7 machine, log in as 'rowland', open explorer and
navigate to the file, right click it, select 'Properties' ->
'Security', it opens correctly (without crashing) and displays the
owners etc.

The share in smb.conf is this:
[Demo]
       path = /srv/samba/Demo/
       read only = no

If it is crashing for you, we need to know why.
What OS ?
What version of Samba ?
What is in your smb.conf ?
What is the DC ?

Rowland

I've noticed myself similiar issue.

Windows 10 (v 1803) - window with security tab open crashes on certain 
files (yes, just the window, not whole OS). Just before crash i see 
unresolved SID which looks like nothing I know (doesn't look like domain 
SID - maybe local user SID from samba member server?). All files that 
cause this issue are from any of the samba servers.

Same files I can vew and edit "security" tab no problem on older 
micrososft OS (win 2012 r2 server or windows 7).

I have samba 4.8.3 DC's.

I didn't dig too much into it, so I can't help, other than confirm, that
there is an issue with security tab under specific circumstances.

W dniu 16.08.2018 o 17:22, Rowland Penny via samba
pisze:
> On Thu, 16 Aug 2018 16:59:22 +0200
> Kacper <kacper at kacper.se> wrote:
>
>> By primary group I mean the group that is set by chgrp. that is the
>> group returned after the pound key (#) from getfacl. In other words
>> the Unix group and not the one managed by ACLs.
>>
> That is not necessarily the users primary group, the users primary
> group is the one displayed by 'getent passwd username' e.g.
>
> root at dc4:~# getent passwd SAMDOM\\rowland
> SAMDOM\rowland:*:10000:10000:Rowland Penny:/home/rowland:/bin/bash
>
> The second number is the users primary group, in this case '10000',
> which is:
>
> root at dc4:~# getent group 10000
> SAMDOM\domain users:x:10000:
>
> But if I create a file in a share and ensure it belongs to the user
> with a group that isn't the users primary group (which seems to be what
> you are describing), I get:
>
> root at dc4:~# ls -la /srv/samba/Demo/test.txt
> -rw-rwxr--+ 1 SAMDOM\rowland SAMDOM\unixgroup 0 Aug 16 11:29
/srv/samba/Demo/test.txt
>
> And getfacl shows:
>
> root at dc4:~# getfacl /srv/samba/Demo/test.txt
> getfacl: Removing leading '/' from absolute path names
> # file: srv/samba/Demo/test.txt
> # owner: SAMDOM\134rowland
> # group: SAMDOM\134unixgroup
> user::rw-
> user:root:rw-
> user:SAMDOM\134rowland:rw-
> group::r--
> group:SAMDOM\134unixgroup:r--
> group:SAMDOM\134unix\040admins:rw-
> mask::rwx
> other::r--
>
> If I now go to a Win7 machine, log in as 'rowland', open explorer
and
> navigate to the file, right click it, select 'Properties' ->
> 'Security', it opens correctly (without crashing) and displays the
> owners etc.
>
> The share in smb.conf is this:
> [Demo]
>         path = /srv/samba/Demo/
>         read only = no
>
> If it is crashing for you, we need to know why.
> What OS ?
> What version of Samba ?
> What is in your smb.conf ?
> What is the DC ?
>
> Rowland
>   
>
-- 

Z poważaniem,
Kacper Wirski
tel. +48 608 421 424


tel:   + 48 22 637 50 01
fax:   + 48 22 637 50 04

Babka Medica Spółka z ograniczonš odpowiedzialnoœciš Spółka komandytowa
ul. Słomińskiego 19 lok.517, 00-195 Warszawa
Sšd Rejonowy dla M.St. Warszawy w Warszawie  XII Wydział Gospodarczy KRS 
0000491764
NIP 525-234-00-28

www.babkamedica.pl <http://www.babkamedica.pl/>


----------------------------------------------------------------------------

Informacja zawarta w niniejszej korespondencji jest poufna. Korespondencja
skierowana jest wyłšcznie do osoby (firmy) wymienionej wyżej.
Rozpowszechnianie, kopiowanie, ujawnianie lub przekazywanie osobom trzecim w
jakiejkolwiek formie informacji zawartych w niniejszym dokumencie w całoœci
lub w częœci jest zakazane bez uprzedniej pisemnej (pod rygorem nieważnoœci)
zgody Babka Medica Sp. z o.o. Sp. k.