samba - Jul 2019 - SAMBA AD DC - Windows explorer.exe crashes on security tab access

Hi Jeremy,
this is what I do to get windows explorer (mine was a virtual machine windows 10
pro upgraded recently to 1903) to crash:

- on samba DC, obtain your sysvol directory from /etc/samba/smb.conf and do a
	sudo mkdir <sysvoldir>/<domain>/test
	validate the directory has permissions like drwxrwx---+ 2 root root    4096 Jul
19 12:58 test.
- on windows PC navigate to \\<dc>\sysvol\<domain>, select test,
right mouse properties, tab security, and boom

I still believe it is two bugs: one in windows explorer crashing, another one in
samba file server not mapping the (missing) ACL to something useful. When I look
at the ACLs with different tools, they all show something different..
On dc try:
- samba-tool ntacl get /var/lib/samba/sysvol/<domain>/test | grep trustee
-> roundabout a dozen entries
- smbclient -e -P \\\\<dc>\\sysvol -c "cd <domain>; getfacl
test;" ->Server doesn't support UNIX CIFS calls.
- smbcacls -P -e //<dc>/sysvol   <domain>/test -> roundabout a
dozen entries
On windows try:
Powershell: get-acl -path \\<dc>\sysvol\<domain>/\test -> one
entry
Cmd: icacls \\<dc>\sysvol\<domain>\test -> two entries

If I modify permissions to drw-------+ 2 root root    4096 Jul 19 12:58 test,
windows explorer does not crash but complains about missing authorizations even
though I am domain administrator.

Joachim 

-----Urspr?ngliche Nachricht-----
Von: samba <samba-bounces at lists.samba.org> Im Auftrag von Rowland penny
via samba
Gesendet: Friday, 19 July 2019 11:18
An: Jeremy Allison <jra at samba.org>
Cc: samba at lists.samba.org
Betreff: Re: [Samba] SAMBA AD DC - Windows explorer.exe crashes on security tab
access

On 18/07/2019 23:39, Jeremy Allison wrote:
> On Mon, Jul 15, 2019 at 09:23:57AM +0100, Rowland penny wrote:
>> On 14/07/2019 22:03, ?brah?m Gyula via samba wrote:
>>> I have a Raspberry Pi 3 B+ with Raspbian Buster and a Samba AD DC
is running on it. Everything works fine, I use Active Directory Users And
Computers and Computer Management on Windows to control the users and the Samba
share permissions. Until this point everything works fine, but the following
error raised on Windows.
>>>
>>> If there is a shared directory which was made by mkdir command and
a UNIX user is the owner and/or a UNIX group is the group owner the following
happens in Windows.
>>>
>>> I do right click on the shared directory, select Properties and on
the property window I select the Security tab the explorer.exe crashes and the
property window being closed.
>>> This phenomenon does not occur if the directory is made on Windows.
>>>
>>> I found a mailing thread about this problem on samba mailing list:
>>>
>>> https://lists.samba.org/archive/samba/2018-August/217676.html
>>>
>>> But the thread ends with no solution unfortunately. The suspect
that this is a bug related to Windows OS. Maybe someone who has met this error
(bug?) and could help?
>> Ah, that thread, this is a Windows bug and if I remember correctly, 
>> they were supposed to be looking into it.
>>
>> Jeremy, did we ever here anything about this ?
> I got sidetracked with other stuff, and didn't bug the Microsoft 
> engineers with it whilst I was up in Redmond recently, sorry.
>
> Can you write up a method of reproducing and I'll see if someone at 
> Microsoft can get the client team to take a look ?
>
> Thanks,
>
> Jeremy.
er, no ;-)

Mainly because I cannot get it to crash any more. It used to be that if the
group on a file was 'root', File Explorer would crash.

Now, for myself, it just works, I have tried Win 7 & 10 against a standalone
server and a Unix domain member.

Has Microsoft silently fixed it ?

Rowland



--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

On 19/07/2019 12:10, Joachim Lindenberg wrote:
> Hi Jeremy,
> this is what I do to get windows explorer (mine was a virtual machine
windows 10 pro upgraded recently to 1903) to crash:
>
> - on samba DC, obtain your sysvol directory from /etc/samba/smb.conf and do
a
> 	sudo mkdir <sysvoldir>/<domain>/test
> 	validate the directory has permissions like drwxrwx---+ 2 root root   
4096 Jul 19 12:58 test.
> - on windows PC navigate to \\<dc>\sysvol\<domain>, select
test, right mouse properties, tab security, and boom
Nope, tried all of the above, but it doesn't crash for myself ;-)

Rowland

Hi Rowland,
i.e. we probably have to help Jeremy finding a setup that makes this
reproducible.
Seriously this implies it can be a difference in users, authorizations, linux,
samba, or windows installation or configuration.
I was testing with a user that is a domain administrator. I just tested with a
non-admin-user, also crashes.
My samba is 4.10.6 from Louis running on Ubuntu 18.04.2 running virtually on
Hyper-V 2019, my Windows is 64bit windows 10 pro 18362.239, also virtual on the
same Hyper-V.
If more on this list can try the same, we can probably see what is relevant to
expose the issue.
Jeremy, maybe I can offer VPN (sstp) access - interested? Not sure about the
round-trip-delay though..
Thanks, Joachim


-----Urspr?ngliche Nachricht-----
Von: samba <samba-bounces at lists.samba.org> Im Auftrag von Rowland penny
via samba
Gesendet: Friday, 19 July 2019 14:28
An: sambalist <samba at lists.samba.org>
Betreff: Re: [Samba] SAMBA AD DC - Windows explorer.exe crashes on security tab
access

On 19/07/2019 12:10, Joachim Lindenberg wrote:
> Hi Jeremy,
> this is what I do to get windows explorer (mine was a virtual machine
windows 10 pro upgraded recently to 1903) to crash:
>
> - on samba DC, obtain your sysvol directory from /etc/samba/smb.conf and do
a
> 	sudo mkdir <sysvoldir>/<domain>/test
> 	validate the directory has permissions like drwxrwx---+ 2 root root   
4096 Jul 19 12:58 test.
> - on windows PC navigate to \\<dc>\sysvol\<domain>, select
test, right mouse properties, tab security, and boom
Nope, tried all of the above, but it doesn't crash for myself ;-)

Rowland



-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba