samba - May 2020 - Cannot change NTACL for share from Windows

On Sun, 31 May 2020 at 16:47, Rowland penny via samba <samba at
lists.samba.org>
wrote:
> On 31/05/2020 17:20, Viktor Trojanovic wrote:
> >
> >     Is 'SAMDOMAIN' actually 'HQ' ?
> >
> >
> > Yes
> I thought it was, if you are going to sanitise things, do it everywhere ;-)
> >
> >     Is Apparmor (or Selinux) running and denying access ?
> >
> >
> > No Selinux present. As for Apparmor, it doesn't look like it.
> >
> >  ubuntu at fs1:/$ sudo apparmor_status
> > apparmor module is loaded.
>
> Yes it is, you need to find out if Apparmor is your problem (I think it
> is) and how to fix it, if it is. I cannot help you, I always 'apt-get
> purge apparmor'. The problem with Apparmor (and Selinux) is that you
get
> strange 'permission denied' errors and cannot find out why and then
> spend hours trying to fix the problem, only to find the quickest fix is
> to remove Apparmor. Don't get me wrong, Apparmor is a good idea, but
> without something shouting at you "you cannot do that because of
'this',
> you need to do 'this' to fix your problem", you have to be an
Apparmor
> expert to fix it.
>
> It's just what's there from a default Ubuntu (minimal) install...
It looks
like snapd depends on it. Anyway, I don't need either here, so I removed it
entirely. The issue persists, though.

On 31/05/2020 17:55, Viktor Trojanovic wrote:
> It's just what's there from a default Ubuntu (minimal) install...
It
> looks like snapd depends on it. Anyway, I don't need either here, so I 
> removed it entirely. The issue persists, though.
Did you reboot ?

You seem to have a smb.conf? very similar to mine and it works for me 
(not that saying that helps you) and the only difference at first glance 
appears to be that I have never used Apparmor.

Rowland

s

On Sun, 31 May 2020 at 20:18, Rowland penny via samba <samba at
lists.samba.org>
wrote:
> On 31/05/2020 17:55, Viktor Trojanovic wrote:
> > It's just what's there from a default Ubuntu (minimal)
install... It
> > looks like snapd depends on it. Anyway, I don't need either here,
so I
> > removed it entirely. The issue persists, though.
>
> Did you reboot ?
>
> You seem to have a smb.conf  very similar to mine and it works for me
> (not that saying that helps you) and the only difference at first glance
> appears to be that I have never used Apparmor.
>
>
Fair point about the reboot. Just did that, then logged out of Windows and
back in. The error remains, I get access denied when trying to change the
share permissions in any form, changing permissions of underlying folders
is not a problem though.

I've set up Samba 4.11 in an unprivileged container. At this point, I can
only assume that this might be the issue here, though I can't quite
understand why. Does anyone happen to have an explanation, is there maybe a
workaround? I know for a fact that it works with privileged containers,
having used several of these myself.

Viktor