samba - Jan 2024 - permission denied with windows acls

On 1/29/24 13:08, Rowland Penny via samba wrote:
> On Mon, 29 Jan 2024 12:51:37 -0800
> Peter Carlson via samba<samba at lists.samba.org>  wrote:
>
>
>> Just did a quick test, the big T comes after setting permissions in
>> windows
>>
>> root at fs1:/var/log# cd /data
>> root at fs1:/data# mkdir -m 1777 test2
> No it doesn't, you are setting it.
>
> I set the permissions on the share directory like this:
>
> mkdir -p /srv/mtest1
> chown root:"Domain Admins" /srv/mtest1
> chmod 0770 /srv/mtest1
>
> Which is what it shows here:
>
> https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs
>
>> root at fs1:/data# chown root:"CARLSON\\domain admins" test2
>> root at fs1:/data# vi /etc/samba/smb.conf
>> root at fs1:/data# systemctl restart smbd.service
>> root at fs1:/data# ls -ald /data/*
>> drwxrwx--T+ 4 root CARLSON\domain admins 4096 Jan 26 16:13 /data/test
>> drwxrwxrwt? 2 root CARLSON\domain admins 4096 Jan 29 20:43 /data/test2
> No, I take it back (slightly), you set the permissions with 't'
(which
> shows the sticky bit is set) and then when you change the permissions
> from Windows, acl_xattr removes the 'rwx' from 'others',
this changes
> the 't' to a 'T'
>
> At least that is what I think is happening.
>
> The cure, stop setting the permissions to '1777' in the first
place,
> use '0770'
>
> Rowland
>
ok so I reset it and used mode 0770 and it still doesn't mount without 
domain users (or computers) as a permission

root at fs1:/data# rm -fr test2
root at fs1:/data# mkdir -m 0777 test2
root at fs1:/data# chown root:"CARLSON\\domain admins" test2
root at fs1:/data# ls -ald /data/*
drwxrwx--T+ 4 root CARLSON\domain admins 4096 Jan 26 16:13 /data/test
drwxrwx---+ 2 root CARLSON\domain admins 4096 Jan 30 00:30 /data/test2

---------------? Set Windows ACLs ---------------------

Jan 30 00:34:43 U2CLI2 cifs.upcall: handle_krb5_mech: getting service 
ticket for fs1.carlson.lab
Jan 30 00:34:43 U2CLI2 cifs.upcall: handle_krb5_mech: obtained service 
ticket
Jan 30 00:34:43 U2CLI2 cifs.upcall: Exit status 0
Jan 30 00:34:43 U2CLI2 kernel: [?? 20.357105] CIFS: VFS: cifs_mount 
failed w/return code = -13
Jan 30 00:34:43 U2CLI2 mount[652]: mount error(13): Permission denied
Jan 30 00:34:43 U2CLI2 mount[652]: Refer to the mount.cifs(8) manual 
page (e.g. man mount.cifs) and kernel log messages (dmesg)
Jan 30 00:34:43 U2CLI2 systemd[1]: mnt-test2.mount: Mount process 
exited, code=exited, status=32/n/a
Jan 30 00:34:43 U2CLI2 systemd[1]: mnt-test2.mount: Failed with result 
'exit-code'.
Jan 30 00:34:43 U2CLI2 systemd[1]: Failed to mount /mnt/test2.

On Mon, 29 Jan 2024 16:42:20 -0800
Peter Carlson via samba <samba at lists.samba.org> wrote:
> 
> On 1/29/24 13:08, Rowland Penny via samba wrote:
> > On Mon, 29 Jan 2024 12:51:37 -0800
> > Peter Carlson via samba<samba at lists.samba.org>  wrote:
> >
> >
> >> Just did a quick test, the big T comes after setting permissions
in
> >> windows
> >>
> >> root at fs1:/var/log# cd /data
> >> root at fs1:/data# mkdir -m 1777 test2
> > No it doesn't, you are setting it.
> >
> > I set the permissions on the share directory like this:
> >
> > mkdir -p /srv/mtest1
> > chown root:"Domain Admins" /srv/mtest1
> > chmod 0770 /srv/mtest1
> >
> > Which is what it shows here:
> >
> > https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs
> >
> >> root at fs1:/data# chown root:"CARLSON\\domain admins"
test2
> >> root at fs1:/data# vi /etc/samba/smb.conf
> >> root at fs1:/data# systemctl restart smbd.service
> >> root at fs1:/data# ls -ald /data/*
> >> drwxrwx--T+ 4 root CARLSON\domain admins 4096 Jan 26 16:13
> >> /data/test drwxrwxrwt? 2 root CARLSON\domain admins 4096 Jan 29
> >> 20:43 /data/test2
> > No, I take it back (slightly), you set the permissions with
't'
> > (which shows the sticky bit is set) and then when you change the
> > permissions from Windows, acl_xattr removes the 'rwx' from
> > 'others', this changes the 't' to a 'T'
> >
> > At least that is what I think is happening.
> >
> > The cure, stop setting the permissions to '1777' in the first
place,
> > use '0770'
> >
> > Rowland
> >
> ok so I reset it and used mode 0770 and it still doesn't mount
> without domain users (or computers) as a permission
> 
> root at fs1:/data# rm -fr test2
> root at fs1:/data# mkdir -m 0777 test2
> root at fs1:/data# chown root:"CARLSON\\domain admins" test2
> root at fs1:/data# ls -ald /data/*
> drwxrwx--T+ 4 root CARLSON\domain admins 4096 Jan 26 16:13 /data/test
> drwxrwx---+ 2 root CARLSON\domain admins 4096 Jan 30 00:30 /data/test2
> 
> ---------------? Set Windows ACLs ---------------------
> 
I don't understand this.

I can just start the VM (debian 12, Samba 4.19.4)
log in as 'rowland'
go to 'Places' -> 'Computer'
Double click 'File System'
Double click '/mnt'
All the mounted shares are there and I can interact with them.

If I run 'mount', I find these lines:

adminuser at testdm12:~$ mount
.................
//devstation.samdom.example.com/data on /mnt/test type cifs
(rw,relatime,vers=3.1.1,sec=krb5,cruid=0,cache=strict,multiuser,uid=0,noforceuid,gid=0,noforcegid,addr=192.168.1.141,file_mode=0755,dir_mode=0755,soft,nounix,serverino,mapposix,noperm,rsize=4194304,wsize=4194304,bsize=1048576,echo_interval=60,actimeo=1,closetimeo=1)
//devstation.samdom.example.com/Mtest1 on /mnt/testmount1 type cifs
(rw,relatime,vers=3.1.1,sec=krb5,cruid=0,cache=strict,multiuser,uid=0,noforceuid,gid=0,noforcegid,addr=192.168.1.141,file_mode=0755,dir_mode=0755,soft,nounix,serverino,mapposix,noperm,rsize=4194304,wsize=4194304,bsize=1048576,echo_interval=60,actimeo=1,closetimeo=1)
//devstation.samdom.example.com/Mtest on /mnt/testmount type cifs
(rw,relatime,vers=3.1.1,sec=krb5,cruid=0,cache=strict,multiuser,uid=0,noforceuid,gid=0,noforcegid,addr=192.168.1.141,file_mode=0755,dir_mode=0755,soft,nounix,serverino,mapposix,noperm,rsize=4194304,wsize=4194304,bsize=1048576,echo_interval=60,actimeo=1,closetimeo=1)

Now remember that these are mounts, so the permissions on the client are
going to look wrong:

adminuser at testdm12:~$ sudo ls -la /mnt/testmount1
total 12
drwxr-xr-x 2 root root    0 Jan 30 09:44 .
drwxr-xr-x 6 root root 4096 Jan 29 19:11 ..
-rwxr-xr-x 1 root root   11 Jan 30 09:44 doctest1

I have to go to the server to find the correct permissions:

rowland at devstation:~$ ls -la /srv/mtest1
total 20
drwxrwx---+  2 root    domain admins 4096 Jan 30 09:44 .
drwxr-xr-x  23 root    root          4096 Jan 29 18:54 ..
-rwxrwxr-x+  1 rowland domain users    11 Jan 30 09:44 doctest1

rowland at devstation:~$ getfacl /srv/mtest1/doctest1
getfacl: Removing leading '/' from absolute path names
# file: srv/mtest1/doctest1
# owner: rowland
# group: domain\040users
user::rwx
user:domain\040users:r-x
group::r-x
group:domain\040users:r-x
group:rowland:rwx
mask::rwx
other::r-x

There must be some difference between your machines and mine, but I do
not know what.

Rowland