samba - Mar 2017 - Samba 4.4.4: ACLs not work property with recycle vfs object enable

Samba file server (Server role: ROLE_DOMAIN_MEMBER) joined to Win2008
ADDC

I have a strange problem with ACLs and "vfs object = recycle" enabled

This is my share entry
> [dati]
>         comment = Cartella Dati x tutti
>         path = /u/samba/dati/
>         read only = no
> 
>         Veto files = /*.pst/*.ost/
> 
>         inherit acls = yes
>         inherit permissions = yes
> 
> ;       vfs objects = recycle
> ;       recycle:repository = /u/samba/cestino/%U
> ;       recycle:touch=yes
> ;       recycle:maxsize=10000000
> ;       recycle:keeptree = yes
> ;       recycle:versions = yes
> ;       recycle:exclude=*.TMP,*.tmp,*.temp,*.o,*.obj,~$*
If I remove comment from recycle session directive, the acls of folder
and files into share [dati] do not work property and Windows some time
show a error message if I try change file and folder permission.

If I remove the vfs object recycle session or comment the lines (like
example above) all work fine.

What am I doing wrong?

if you need more info let me know

thanks in advance for your help

-- 
Dario Lesca
(inviato dal mio Linux Fedora 25 Workstation)

Il giorno mar, 07/03/2017 alle 21.23 +0100, Dario Lesca via samba ha
scritto:
> Samba file server (Server role: ROLE_DOMAIN_MEMBER) joined to Win2008
> ADDC
> 
> I have a strange problem with ACLs and "vfs object = recycle"
enabled
> 
> This is my share entry
> 
> > [dati]
> >         comment = Cartella Dati x tutti
> >         path = /u/samba/dati/
> >         read only = no
> > 
> >         Veto files = /*.pst/*.ost/
> > 
> >         inherit acls = yes
> >         inherit permissions = yes
> > 
> > ;       vfs objects = recycle
> > ;       recycle:repository = /u/samba/cestino/%U
> > ;       recycle:touch=yes
> > ;       recycle:maxsize=10000000
> > ;       recycle:keeptree = yes
> > ;       recycle:versions = yes
> > ;       recycle:exclude=*.TMP,*.tmp,*.temp,*.o,*.obj,~$*
> 
> If I remove comment from recycle session directive, the acls of
> folder
> and files into share [dati] do not work property and Windows some
> time
> show a error message if I try change file and folder permission.
> 
> If I remove the vfs object recycle session or comment the lines (like
> example above) all work fine.
> 
> What am I doing wrong?
> 
> if you need more info let me know
> 
> thanks in advance for your help
> 
I have found this tread:
https://lists.samba.org/archive/samba/2014-May/181651.html

Then I have resolve my problem.

In [global] I had for all shares

    vfs objects = acl_xattr

And into share [dati] I had:

    vfs objects = recycle

This setting add recycle vfs object to this share, but also remove
acl_xattr from it!

The solution is set in share session both vfs object needed:

    vfs objects = acl_xattr recycle

So, with this setting, now all work fine.

Thank to all.

-- 
Dario Lesca
(inviato dal mio Linux Fedora 25 Workstation)

On Tue, Mar 7, 2017 at 3:18 PM, Dario Lesca via samba <samba at
lists.samba.org
> wrote:
> The solution is set in share session both vfs object needed:
>
>     vfs objects = acl_xattr recycle
>
> So, with this setting, now all work fine.
>
Thanks for posting this. You explained an issue I have had for some time
now. I knew that some of my shares weren't using acl_xattr, but I didn't
realize it was the ones that also had recycle. Now it makes sense. I'm not
sure I'm going to change it, since the normal posix permissions seem to be
all I need, but at least I understand it now.