samba - Jul 2012 - 3.6.5: NT_STATUS_ACCESS_DENIED from Win7 to 750 dir

Hello,

after upgrading from Samba 3.5.6 to 3.6.5 I encounter some strange
NT_STATUS_ACCESS_DENIED trouble when trying to access group readable
directories from Windows 7 or Windows 2008 Terminal Server.

Very strange stuff is that it works fine using smbclient from a Linux
machine using the same userid and Kerberos authentication.

The Server is fully integrated into active directory and uses
"kerberos method = system keytab". Username and group mapping also
looks fine. 

Here is the relevant part of the logfile:

[2012/07/18 13:56:24.486879,  5]
auth/token_util.c:527(debug_unix_user_token)
  UNIX token of user 18026
  Primary group is 1800 and contains 6 supplementary groups
  Group[  0]: 4294967295
  Group[  1]: 1802
  Group[  2]: 1000000
  Group[  3]: 1000001
  Group[  4]: 1000002
  Group[  5]: 55001
[2012/07/18 13:56:24.486974,  5] smbd/uid.c:317(change_to_user_internal)
  Impersonated user: uid=(0,18026), gid=(0,1800)
[2012/07/18 13:56:24.487007,  4] smbd/vfs.c:780(vfs_ChDir)
  vfs_ChDir to /storage/debug-iad
[2012/07/18 13:56:24.487052,  5] smbd/filename.c:257(unix_convert)
  unix_convert called on file "testdir-geg"
[2012/07/18 13:56:24.487080,  5] smbd/filename.c:416(unix_convert)
  unix_convert begin: name = testdir-geg, dirpath = , start = testdir-geg
[2012/07/18 13:56:24.487109,  5] smbd/statcache.c:143(stat_cache_add)
  stat_cache_add: Added entry (7f89d661e810:size b) TESTDIR-GEG ->
testdir-geg
[2012/07/18 13:56:24.487135,  5] smbd/filename.c:439(unix_convert)
  conversion of base_name finished testdir-geg -> testdir-geg
[2012/07/18 13:56:24.487159,  3] smbd/vfs.c:905(check_reduced_name)
  check_reduced_name [testdir-geg] [/storage/debug-iad]
[2012/07/18 13:56:24.487188,  3] smbd/vfs.c:1039(check_reduced_name)
  check_reduced_name: testdir-geg reduced to /storage/debug-iad/testdir-geg
[2012/07/18 13:56:24.487219,  5] smbd/files.c:126(file_new)
  allocated file structure 9869, fnum = 13965 (1 used)
[2012/07/18 13:56:24.487256,  3] smbd/dosmode.c:159(unix_mode)
  unix_mode(testdir-geg) returning 0744
[2012/07/18 13:56:24.487283,  8] smbd/dosmode.c:621(dos_mode)
  dos_mode: testdir-geg
[2012/07/18 13:56:24.487308,  8] smbd/dosmode.c:199(dos_mode_from_sbuf)
  dos_mode_from_sbuf returning d
[2012/07/18 13:56:24.487338,  8] smbd/dosmode.c:672(dos_mode)
  dos_mode returning d
[2012/07/18 13:56:24.487388,  4] smbd/open.c:2069(open_file_ntcreate)
  calling open_file with flags=0x0 flags2=0x0 mode=0744, access_mask= 0x81,
open_access_mask = 0x81
[2012/07/18 13:56:24.487429,  5] smbd/files.c:464(file_free)
  freed files structure 13965 (0 used)
[2012/07/18 13:56:24.487455,  5] smbd/open.c:2597(open_directory)
  open_directory: opening directory testdir-geg, access_mask = 0x81,
share_access = 0x7 create_options = 0x0, create_disposition = 0x1,
file_attributes = 0x10
[2012/07/18 13:56:24.487583,  3] smbd/error.c:81(error_packet_set)
  error packet at smbd/error.c(161) cmd=162 (SMBntcreateX)
NT_STATUS_ACCESS_DENIED

Any Idea?

Sven

-- 
"If you don't make lower-resolution mapping data publicly
available, there will be people with their cars and GPS
devices, driving around with their laptops" (Tim Berners-Lee)
/me is giggls at ircnet, http://sven.gegg.us/ on the Web

Is SMB2 enabled?
If Yes, does this happen with SMB?

OA

On Wed, 18 Jul 2012 12:27:56 +0000 (UTC), Sven Geggus
<lists at fuchsschwanzdomain.de> wrote:
>Hello,
>
>after upgrading from Samba 3.5.6 to 3.6.5 I encounter some strange
>NT_STATUS_ACCESS_DENIED trouble when trying to access group readable
>directories from Windows 7 or Windows 2008 Terminal Server.
>
>Very strange stuff is that it works fine using smbclient from a Linux
>machine using the same userid and Kerberos authentication.
>
>The Server is fully integrated into active directory and uses
>"kerberos method = system keytab". Username and group mapping also
>looks fine.