samba - Dec 2021 - after 4.9 to 4.13 Pro Tools can't write to share

Hello:

I have been successfully using stand-alone Samba as a file server for my
Mac (currently OS 'Big Sur') running Pro Tools (audio workstation)
software
for several years now. I can mount the share on the mac and run Pro Tools
sessions from the share. The Samba host machine has been Proxomox 6.x
(Debian 10 with different kernel and some specialist hypervisor software)
running some version of Samba 4.9 (4.9.5 probably). I upgraded the host to
Proxmox 7.x (Debian 11 based) which bumps Samba to 4.13.13. Underlying
shared disks are BTRFS formatted.

I have also tested using vanilla Debian 10 and Debian 11 (not Proxmox) as
the Samba server host OS with the same result. This was a virtual machine,
virtual disk. Again, 4.9.5 worked fine. 4.13.13 didn't.

On Samba 4.13.13 (Debian 11) Pro Tools has trouble writing files, it can't
create new session files or even do a 'save-as' of an existing session
file
I open. It complains of permissions issues, doesn't have write permissions.
I can verify this -- it tries to write a file and it appears (both in Mac
terminal and on the server side) with permissions "--------x". Note,
other
applications and the Finder have no problems with this set up (Deb 11/Samba
4.13.13). I can create, modify, and save files on the share with normal
results, no weird permissions. Pro Tools is doing something that
annoys Samba, but it works fine on Debian 10 Samba 4.9.5.

I have reviewed the major version changelog of Samba and nothing really
stood out to me as a likely change in defaults or some other change which
would have caused this, but maybe an expert here can help!

I note in Samba 4.10 there is a change in 'prefork children' default
from 1
to 4, but I'm not sure that affects me. I don't use AD or LDAP, just the
single unix user account. I note in Samba 4.11 there is a change in
"Default samba process model" from standard to prefork. Not sure about
that
one either.

Here is the output (slightly redacted) of testparm for each version. 4.9.5
works great. 4.13.13 does not.

4.9.5

# testparm
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Registered MSG_REQ_POOL_USAGE
Registered MSG_REQ_DMALLOC_MARK and LOG_CHANGED
Load smb config files from /etc/samba/smb.conf
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Processing section "[smb49shr1]"
Loaded services file OK.
Server role: ROLE_STANDALONE

Press enter to see a dump of your service definitions

# Global parameters
[global]
dns proxy = No
log file = /var/log/samba/log.%m
logging = file
map to guest = Bad User
max log size = 1000
obey pam restrictions = Yes
panic action = /usr/share/samba/panic-action %d
server role = standalone server
idmap config * : backend = tdb

[smb49shr1]
comment = smb on Deb10VM
force group = sambashare
hide files = /.DS_Store/Network Trash
Folder/TheFindByContentFolder/TheVolumeSettingsFolder/Temporary
Items/.TemporaryItems/.VolumeIcon.icns/Icon?/.FBCIndex/.FBCLockFolder/
locking = No
map acl inherit = Yes
path = /home/user1/smb49shr1
read only = No
valid users = user1
vfs objects = catia fruit streams_xattr
fruit:locking = netatalk

4.13.13

# testparm
Load smb config files from /etc/samba/smb.conf
Loaded services file OK.
Weak crypto is allowed
Server role: ROLE_STANDALONE

Press enter to see a dump of your service definitions

# Global parameters
[global]
dns proxy = No
log file = /var/log/samba/log.%m
logging = file
map to guest = Bad User
max log size = 1000
obey pam restrictions = Yes
pam password change = Yes
panic action = /usr/share/samba/panic-action %d
server role = standalone server
idmap config * : backend = tdb

[smb413shr1]
comment = smb on Deb11VM
force group = sambashare
hide files = /.DS_Store/Network Trash
Folder/TheFindByContentFolder/TheVolumeSettingsFolder/Temporary
Items/.TemporaryItems/.VolumeIcon.icns/Icon?/.FBCIndex/.FBCLockFolder/
locking = No
map acl inherit = Yes
path = /home/user1/smb413shr1
read only = No
valid users = user1
vfs objects = catia fruit streams_xattr
fruit:locking = netatalk
fruit:encoding = native
streams_xattr:prefix = user.
streams_xattr:store_stream_type = no

Thank you in advance for any suggestions.

On Thu, 2021-12-30 at 19:22 +0000, Casey Stone via samba
wrote:
> Hello:
> 
> I have been successfully using stand-alone Samba as a file server for
> my
> Mac (currently OS 'Big Sur') running Pro Tools (audio workstation)
> software
> for several years now. I can mount the share on the mac and run Pro
> Tools
> sessions from the share. The Samba host machine has been Proxomox 6.x
> (Debian 10 with different kernel and some specialist hypervisor
> software)
> running some version of Samba 4.9 (4.9.5 probably). I upgraded the
> host to
> Proxmox 7.x (Debian 11 based) which bumps Samba to 4.13.13.
> Underlying
> shared disks are BTRFS formatted.
At a guess, 'Pro Tools' doesn't like the change from SMBv1 to SMBv2
at
Samba 4.11.0

Rowland

On 12/30/21 20:22, Casey Stone via samba wrote:
> Thank you in advance for any suggestions.
just a wild guess, but you may try setting

   fruit:nfs_aces = no

in the global section. Same for

   fruit:zero_file_id = yes

You can also try removing

 > streams_xattr:prefix = user.
 > streams_xattr:store_stream_type = no

as both are rarely used and not tested in our CI.

-slow

-- 
Ralph Boehme, Samba Team                 https://samba.org/
SerNet Samba Team Lead      https://sernet.de/en/team-samba
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.samba.org/pipermail/samba/attachments/20211230/b75130ed/OpenPGP_signature.sig>

On Thu, Dec 30, 2021 at 8:19 PM Ralph Boehme <slow at samba.org> wrote:
>
> just a wild guess, but you may try setting
>
>    fruit:nfs_aces = no
>
> in the global section. Same for
>
>    fruit:zero_file_id = yes
>
> You can also try removing
>
>  > streams_xattr:prefix = user.
>  > streams_xattr:store_stream_type = no
>
> as both are rarely used and not tested in our CI.
>
Thank you Rowland and Ralph for your quick responses.

Ralph, after quite a bit of experimentation I believe adding fruit:nfs_aces
= no was the key to solving the problem. I went around in circles a bit so
I can't be sure about some others. I am wary about changing the
streams_xattr options as I have some precious old (pre-OSX) files I want to
be able to read back, though I don't understand whether or not these two
options would affect anything actually used by MacOS in reading/writing
files -- please inform me! I think I added those due to some postings you
made back in about 2013.

When I first set up this samba system it was a migration from Netatalk and
also I had one Win10 workstation I wanted to stay as compatible as possible
with. Now however, it's only Macs (or Linux) using the samba shares and
Netatalk is over. One problem I have is though file permissions look right
on the server side, when viewed in the MacOS terminal any files written (by
any app) have executable permissions set. It's unsightly and worrying, but
maybe not causing any problems. I have tried a number of options but
nothing I did changed it.

Here's my current smb.conf directives set, if you have any comments for me,
I would appreciate it (Spotlight is not working, but that's for another
thread):

[global]
   workgroup = WORKGROUP
   dns proxy = no
   interfaces = vmbr0 vmbr1 vmbr2 vmbr3
   bind interfaces only = yes
   log file = /var/log/samba/log.%m
   max log size = 1000
   panic action = /usr/share/samba/panic-action %d
   server role = standalone server
   passdb backend = tdbsam
   unix password sync = no
   guest account = smbguest
   map to guest = Bad User

# recent changes
  fruit:nfs_aces = no
  unix extensions = no
  rpc_server:mdsvc = embedded

#======================= Share Definitions ======================
[PT-Data1]
comment = smb share on pvea with btrfs 970
path = /ptnvme
hide files = /.DS_Store/Network Trash
Folder/TheFindByContentFolder/TheVolumeSettingsFolder/Temporary
Items/.TemporaryItems/.VolumeIcon.icns/Icon?/.FBCIndex/.FBCLockFolder/
store dos attributes = yes
locking = no
ea support = yes
spotlight = yes
spotlight backend = elasticsearch
create mask = 0000
force create mode = 0600
read only = no
valid users = user1
force group = sambashare
vfs objects = catia fruit streams_xattr
streams_xattr:store_stream_type = no
streams_xattr:prefix = user.
fruit:encoding = native
fruit:locking = none
fruit:zero_file_id = yes