samba - Nov 2021 - Wide-Links For a specific Path

On Mon, Nov 01, 2021 at 09:31:56AM -0400, ralph strebbing via samba
wrote:
>Hi All,
>
>So I'm looking to try and get symlinks for our ZFS Backup share, which
>would be accessed via a user's personal share.
>E.g: User A's Share parent folder (/users/), has a shortcut to
>Backups, which symlinks to the backup share
>(/backup/users/.zfs/snapshots)
>
>We DO have Unix extensions enabled, however we have the shell for all
>users except IT staff set to /bin/false.
>
>From what I've read, we can enable Wide Links to achieve this, but due
>to the security hole, I'm wondering if we can limit this functionality
>to specific paths/shares? Or if there is just a better way to go about
>this as a whole.
Don't enable SMB1 unix extensions. Are you on Linux ? If so,
why not use bind mounts:

https://docs.rackspace.com/support/how-to/bind-mounts-in-linux/

On Mon, Nov 1, 2021 at 12:07 PM Jeremy Allison <jra at samba.org>
wrote:
>
> Don't enable SMB1 unix extensions. Are you on Linux ? If so,
> why not use bind mounts:
So I looked into it deeper, I don't think we are actually using unix
extensions. If there is some way to verify that, I will post the
results.

Some clients will be on linux, but most of this use case is for
clients on Windows.

I did try adding the following in the [global] block on our fileserver:
follow symlinks = yes

But when I try to follow a symlink to another share in Windows, I get
a constant permission denied, despite being both the owner and part of
the group that owns the folder, and setting the POSIX ACL for the user
and group objects to rwx.


Regards,
Ralph