samba - Jun 2019 - error when trying to copy file from samba share to old Windows CE share

On Wed, Jun 19, 2019 at 3:41 PM Jeremy Allison <jra at samba.org>
wrote:
> Weren't you getting a NT_STATUS_NOT_IMPLEMENTED level
> error return ?
>
> Look for the specific error return you see on the WinCE
> client in the trace.
Figured out the issue...

After comparing a good vs bad file copy in wireshark for a while, I
have found where it goes wrong. On the good copy I see an "NT Create
AndX Request" with a response that says it created the file. On the
bad copy it instead does a "NT Trans Request, NT CREATE" with an
additional "NT CREATE data" that has the SELinux context in it.
Comparing the old vs new smb.conf man page it looks like "ea support"
in the older samba version was default to no, while it is default to
yes in the newer samba version. Windows is some how storing those
extended attributes, and fails when trying to transfer a file with the
selinux extended attribute.

Setting "ea support = no" fixed the issue.

Thanks,
Dan

On Thu, Jun 20, 2019 at 10:09:08AM -0400, Dan Arena
wrote:
> On Wed, Jun 19, 2019 at 3:41 PM Jeremy Allison <jra at samba.org>
wrote:
> > Weren't you getting a NT_STATUS_NOT_IMPLEMENTED level
> > error return ?
> >
> > Look for the specific error return you see on the WinCE
> > client in the trace.
> 
> Figured out the issue...
> 
> After comparing a good vs bad file copy in wireshark for a while, I
> have found where it goes wrong. On the good copy I see an "NT Create
> AndX Request" with a response that says it created the file. On the
> bad copy it instead does a "NT Trans Request, NT CREATE" with an
> additional "NT CREATE data" that has the SELinux context in it.
> Comparing the old vs new smb.conf man page it looks like "ea
support"
> in the older samba version was default to no, while it is default to
> yes in the newer samba version. Windows is some how storing those
> extended attributes, and fails when trying to transfer a file with the
> selinux extended attribute.
> 
> Setting "ea support = no" fixed the issue.
Interesting. Where did it get the SeLinux context EA from ?

Aren't they in the "system." namespace ?

We filter these out on listing EA's on a file inside

get_ea_list_from_file_path() by the following code:

               if (strnequal(names[i], "system.", 7)
                    || samba_private_attr_name(names[i]))
                        continue;

They are in "security.selinux"

On Thu, Jun 20, 2019 at 2:16 PM Jeremy Allison <jra at samba.org>
wrote:
>
> On Thu, Jun 20, 2019 at 10:09:08AM -0400, Dan Arena wrote:
> > On Wed, Jun 19, 2019 at 3:41 PM Jeremy Allison <jra at
samba.org> wrote:
> > > Weren't you getting a NT_STATUS_NOT_IMPLEMENTED level
> > > error return ?
> > >
> > > Look for the specific error return you see on the WinCE
> > > client in the trace.
> >
> > Figured out the issue...
> >
> > After comparing a good vs bad file copy in wireshark for a while, I
> > have found where it goes wrong. On the good copy I see an "NT
Create
> > AndX Request" with a response that says it created the file. On
the
> > bad copy it instead does a "NT Trans Request, NT CREATE"
with an
> > additional "NT CREATE data" that has the SELinux context in
it.
> > Comparing the old vs new smb.conf man page it looks like "ea
support"
> > in the older samba version was default to no, while it is default to
> > yes in the newer samba version. Windows is some how storing those
> > extended attributes, and fails when trying to transfer a file with the
> > selinux extended attribute.
> >
> > Setting "ea support = no" fixed the issue.
>
> Interesting. Where did it get the SeLinux context EA from ?
>
> Aren't they in the "system." namespace ?
>
> We filter these out on listing EA's on a file inside
>
> get_ea_list_from_file_path() by the following code:
>
>                if (strnequal(names[i], "system.", 7)
>                     || samba_private_attr_name(names[i]))
>                         continue;