samba - Jul 2019 - SAMBA AD DC - Windows explorer.exe crashes on security tab access

Hey Joachim,

So 2 things!

1. Accessing unix created samba share from Windows. Can you provide your
share definition or complete smb.conf? It will better to repro and
investigate.

2. I believe samba-tool needs investigation!

# /usr/local/samba/bin/samba-tool ntacl sysvolcheck
.........
ERROR(runtime): uncaught exception - samdb_domain_sid failed
? File
"/usr/local/samba/lib64/python3.6/site-packages/samba/netcmd/__init__.py",
line 185, in _run
??? return self.run(*args, **kwargs)
? File
"/usr/local/samba/lib64/python3.6/site-packages/samba/netcmd/ntacl.py",
line 451, in run
??? domain_sid = security.dom_sid(samdb.domain_sid)
? File
"/usr/local/samba/lib64/python3.6/site-packages/samba/samdb.py",
line 677, in get_domain_sid
??? return dsdb._samdb_get_domain_sid(self)

Amit


On 07/16/2019 12:50 AM, ?brah?m Gyula via samba wrote:
> Hi Joachim,
>
> I tried to use samba-tool ntacl sysvolreset command, but the it did not
resolve the problem.
>
> It it very interesting there are not much reports about this bug. Why? Is
it not a common problem? Especially if it is related to a Windows bug.
>
> Best,
>
> Abraham
>
> ________________________________
> Felad?: samba <samba-bounces at lists.samba.org>, meghatalmaz?:
Joachim Lindenberg via samba <samba at lists.samba.org>
> Elk?ldve: 2019. j?lius 15., h?tf? 14:07
> C?mzett: 'Rowland penny'; '?brah?m Gyula'; 'Jeremy
Allison'
> M?solatot kap: samba at lists.samba.org
> T?rgy: Re: [Samba] SAMBA AD DC - Windows explorer.exe crashes on security
tab access
>
> I experienced a Windows Explorer crash in
https://lists.samba.org/archive/samba/2019-July/224346.html as well...
> Try samba-tool ntacl sysvolreset (or check first).
> Joachim Lindenberg
>
> -----Urspr?ngliche Nachricht-----
> Von: Rowland penny <rpenny at samba.org>
> Gesendet: Monday, 15 July 2019 10:24
> An: samba at lists.samba.org
> Cc: Jeremy Allison <jra at samba.org>
> Betreff: Re: [Samba] SAMBA AD DC - Windows explorer.exe crashes on security
tab access
>
> On 14/07/2019 22:03, ?brah?m Gyula via samba wrote:
>> I have a Raspberry Pi 3 B+ with Raspbian Buster and a Samba AD DC is
running on it. Everything works fine, I use Active Directory Users And Computers
and Computer Management on Windows to control the users and the Samba share
permissions. Until this point everything works fine, but the following error
raised on Windows.
>>
>> If there is a shared directory which was made by mkdir command and a
UNIX user is the owner and/or a UNIX group is the group owner the following
happens in Windows.
>>
>> I do right click on the shared directory, select Properties and on the
property window I select the Security tab the explorer.exe crashes and the
property window being closed.
>> This phenomenon does not occur if the directory is made on Windows.
>>
>> I found a mailing thread about this problem on samba mailing list:
>>
>> https://lists.samba.org/archive/samba/2018-August/217676.html
>>
>> But the thread ends with no solution unfortunately. The suspect that
this is a bug related to Windows OS. Maybe someone who has met this error (bug?)
and could help?
> Ah, that thread, this is a Windows bug and if I remember correctly, they
were supposed to be looking into it.
>
> Jeremy, did we ever here anything about this ?
>
> Rowland
>
>
>
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba

1)	I agree to Rowland that there is a bug in Windows Explorer. Client software
shall never crash in case it get?s unexpected responses from a server but
display an error message. However I don?t expect a fix soon, as it is probably
triggered very infrequently except for...

2)	There is probably a bug in Samba with ACL mapping for linux created
directories.  You may want to compare the ACLs displayed for a windows created
directory to one created by linux, using samba-tool ntacl. You may want to
create an ACL on linux to prevent the crash. Nevertheless, Samba should not
return anything to the client that causes clients to crash, but maybe an ACL
that just contains SYSTEM.

I apologize for not reading sufficiently into the problem, sysvolreset would
have fixed the issue only on sysvol and not on an arbitrary share. But as I
wrote already, I experienced the windows bug with sysvol and noticed the ACLs on
original and copy using smbclient are different.
@Amit, as I was not the one experiencing that issue, I cannot provide more to
further elaborate.

Best Regards, Joachim

On 16/07/2019 14:27, Joachim Lindenberg via samba wrote:
> 1)	I agree to Rowland that there is a bug in Windows Explorer. Client
software shall never crash in case it get?s unexpected responses from a server
but display an error message. However I don?t expect a fix soon, as it is
probably triggered very infrequently except for...
>
> 2)	There is probably a bug in Samba with ACL mapping for linux created
directories.  You may want to compare the ACLs displayed for a windows created
directory to one created by linux, using samba-tool ntacl. You may want to
create an ACL on linux to prevent the crash. Nevertheless, Samba should not
return anything to the client that causes clients to crash, but maybe an ACL
that just contains SYSTEM.
No, there isn't a Samba bug, it is just that Samba has never used the 
same ACL's for Sysvol as the ones that Windows uses.

I tried to fix this once, but failed because the ntacl C code didn't 
know all the Windows users (or was it groups?)

see bug: https://bugzilla.samba.org/show_bug.cgi?id=12924

Rowland