search for: owner_sid

Two attached patches for samba 2.2.7a and 3.0-alfa22, that I've made today, fix 3 bugs mentioned in my previous e-mail. 1) For each file in addition to ALLOW ACE proper DENY ACE is created. 2) "Take ownership" is shown DENIED for all except root ACEs 3) Read Permissions and read attributes are always shown as allowed, as they are actually allowed. -- Zhitomirsky

...39;t be inherited in this way under POSIX. > Remove it for Windows-style ACLs. */ > - psd->type &= ~SEC_DESC_DACL_PROTECTED; > + psd_blob->type &= ~SEC_DESC_DACL_PROTECTED; > } > } > > if (!(security_info & SECINFO_OWNER)) { > - psd->owner_sid = NULL; > + psd_blob->owner_sid = NULL; > } > if (!(security_info & SECINFO_GROUP)) { > - psd->group_sid = NULL; > + psd_blob->group_sid = NULL; > } > if (!(security_info & SECINFO_DACL)) { > - psd->type &= ~SEC_DESC_DACL_PRESENT; > -...

...39;t be inherited in this way under POSIX. > Remove it for Windows-style ACLs. */ > - psd->type &= ~SEC_DESC_DACL_PROTECTED; > + psd_blob->type &= ~SEC_DESC_DACL_PROTECTED; > } > } > > if (!(security_info & SECINFO_OWNER)) { > - psd->owner_sid = NULL; > + psd_blob->owner_sid = NULL; > } > if (!(security_info & SECINFO_GROUP)) { > - psd->group_sid = NULL; > + psd_blob->group_sid = NULL; > } > if (!(security_info & SECINFO_DACL)) { > - psd->type &= ~SEC_DESC_DACL_PRESENT; > -...

On Fri, Aug 26, 2016 at 04:03:49PM -0700, Jeremy Allison wrote: > On Fri, Aug 26, 2016 at 02:46:19PM -0700, Jeremy Allison via samba wrote: > > On Fri, Aug 26, 2016 at 06:44:05PM +0200, Ralph Böhme wrote: > > > > > > Cheerio! > > > -slow > > > > Still reviewing this - but a few things that will need changing: > > > > When adding the

On Fri, Aug 26, 2016 at 06:33:26PM +0200, Ralph Böhme via samba wrote: > On Thu, Aug 25, 2016 at 12:14:00PM -0700, Jeremy Allison wrote: > > On Wed, Aug 24, 2016 at 04:06:42PM +0200, Ralph Böhme via samba wrote: > > > > > > Yeah, as much as I'd like to avoid adding a new option, I guess we > > > have to do something about it, my latest take on this is >

..._uint8(500) 00ab id_auth[5] : 05 [2002/08/20 18:01:06, 5] rpc_parse/parse_prs.c:prs_uint32s(785) 00ac sub_auths : 00000015 78e3081a b5b9d1db f95de5a2 000003e8 [2002/08/20 18:01:06, 5] smbd/posix_acls.c:unpack_nt_owners(433) unpack_nt_owners: validating owner_sids. [2002/08/20 18:01:06, 5] smbd/posix_acls.c:unpack_nt_owners(474) unpack_nt_owners: owner_sids validated. [2002/08/20 18:01:06, 3] smbd/dosmode.c:unix_mode(111) unix_mode(TestACL) returning 0760 [2002/08/20 18:01:06, 3] smbd/posix_acls.c:convert_canon_ace_to_posix_perms(1809) convert_canon_a...

...: 0x9d17 (40215) 1: SEC_DESC_OWNER_DEFAULTED 1: SEC_DESC_GROUP_DEFAULTED 1: SEC_DESC_DACL_PRESENT 0: SEC_DESC_DACL_DEFAULTED [...] 0: SEC_DESC_RM_CONTROL_VALID 1: SEC_DESC_SELF_RELATIVE owner_sid : * owner_sid : S-1-5-21-197107965-2004198405-1252158227-512 group_sid : * group_sid : S-1-5-21-197107965-2004198405-1252158227-512 sacl : * sacl: struct security_acl...

Hi All, I wanted to check the state of the ACL evaluation engine in samba. I have configured my linux sles 10, samba version 3.5.1-3.3-2332 with "ea support = yes", "store dos attributes=yes", "vfs objects = acl_xattr" and get lots of error + some failure messages. I attached the results of running the test against both samba as well as native windows 2003 cifs

...> ??????????????0: SEC_DESC_DACL_AUTO_INHERITED > ??????????????0: SEC_DESC_SACL_AUTO_INHERITED > ??????????????1: SEC_DESC_DACL_PROTECTED > ??????????????0: SEC_DESC_SACL_PROTECTED > ??????????????0: SEC_DESC_RM_CONTROL_VALID > ??????????????1: SEC_DESC_SELF_RELATIVE > ???????owner_sid ???????????????: * > ???????????owner_sid ???????????????: S-1-22-1-1000 > ???????group_sid ???????????????: * > ???????????group_sid ???????????????: > S-1-5-21-337654209-2357861877-656557748-512 > ???????sacl ????????????????????: NULL > ???????dacl ????????????????????: * >...

...0: SEC_DESC_DACL_AUTO_INHERITED > 0: SEC_DESC_SACL_AUTO_INHERITED > 1: SEC_DESC_DACL_PROTECTED > 0: SEC_DESC_SACL_PROTECTED > 0: SEC_DESC_RM_CONTROL_VALID > 1: SEC_DESC_SELF_RELATIVE > owner_sid : * > owner_sid : S-1-22-1-65534 > group_sid : * > group_sid : S-1-22-2-65534 > sacl : NULL > dacl : * > dacl...

On 11/04/2023 13:36, Gary Dale via samba wrote: > On 2023-04-11 04:15, Rowland Penny via samba wrote: >> >> >> What 'Debian distribution-specific' installation did you follow ? > The one linked to in AD DC wiki. Where abouts is this link ? I checked here: https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Active_Directory_Domain_Controller But couldn't

...EC_DESC_DACL_TRUSTED 0: SEC_DESC_SERVER_SECURITY 1: SEC_DESC_DACL_AUTO_INHERIT_REQ 0: SEC_DESC_SACL_AUTO_INHERIT_REQ 0: SEC_DESC_DACL_AUTO_INHERITED 0: SEC_DESC_SACL_AUTO_INHERITED 1: SEC_DESC_DACL_PROTECTED 0: SEC_DESC_SACL_PROTECTED 0: SEC_DESC_RM_CONTROL_VALID 1: SEC_DESC_SELF_RELATIVE owner_sid: * owner_sid: S-1-5-21-940051827-2291820289-3341758437-512 group_sid: * group_sid: S-1-5-21-940051827-2291820289-3341758437-512 sacl: NULL dacl: * dacl: struct security_acl revision: SECURITY_ACL_REVISION_ADS (4) size: 0x00c4 (196) num_aces: 0x00000007 (7) aces: ARRAY(7) aces: struct sec...

...remove a user for access to a file I get the following error: "Unable to save permission change on <filename>. Access is denied". I took a look at my smbd log file and found this: [2002/08/29 10:40:00, 5] smbd/posix_acls.c:unpack_nt_owners(433) unpack_nt_owners: validating owner_sids. [2002/08/29 10:40:00, 5] smbd/posix_acls.c:unpack_nt_owners(474) unpack_nt_owners: owner_sids validated. [2002/08/29 10:40:00, 3] smbd/dosmode.c:unix_mode(111) unix_mode(test5.txt) returning 0777 [2002/08/29 10:40:00, 3] smbd/posix_acls.c:set_nt_acl(2249) set_nt_acl: chmod test5.txt. per...

Maybe I'm doing somthing really stupid, but while copying some windows share onto a samba server, on some random subdirectory robocopy says ERROR 87 (0x00000057) Copying NTFS Security to Destination Directory... The samba logfile has lots of these lines. modules/vfs_posixacl.c:349(smb_acl_to_posix) smb_acl_to_posix: ACL is invalid for set (Das Argument ist ung?ltig) The strange thing is

...to grab some debug=10 logs, and here's the relevant snippet: --- LOG BEGINS --- [2003/01/09 12:24:52, 10] smbd/posix_acls.c:set_nt_acl(2177) set_nt_acl: called for file Corp Services/mytestdir [2003/01/09 12:24:52, 5] smbd/posix_acls.c:unpack_nt_owners(433) unpack_nt_owners: validating owner_sids. [2003/01/09 12:24:52, 10] nsswitch/wb_client.c:winbind_lookup_sid(111) winbind_lookup_sid: SUCCESS: SID S-1-5-21-1881940921-547036892-925700815-500 -> BEDROCK Administrator [2003/01/09 12:24:52, 10] smbd/uid.c:sid_to_uid(657) sid_to_uid: winbindd S-1-5-21-1881940921-547036892-925700815-...

...t version 7.2; Samba version 3.0.7 Below is from the client log after turning the debug level to 10: [2004/09/21 15:06:46, 10] smbd/posix_acls.c:set_nt_acl(2990) set_nt_acl: called for file test1.txt [2004/09/21 15:06:46, 5] smbd/posix_acls.c:unpack_nt_owners(909) unpack_nt_owners: validating owner_sids. [2004/09/21 15:06:46, 10] passdb/lookup_sid.c:sid_to_uid(401) sid_to_uid: winbind lookup for non-local sid S-1-5-21-1951701912-1418144344-1147873810-2551 failed [2004/09/21 15:06:46, 3] smbd/posix_acls.c:unpack_nt_owners(927) unpack_nt_owners: unable to validate owner sid for S-1-5-21-1951701...

...1: SEC_DESC_OWNER_DEFAULTED > 1: SEC_DESC_GROUP_DEFAULTED > 1: SEC_DESC_DACL_PRESENT > 0: SEC_DESC_DACL_DEFAULTED > [...] > > 0: SEC_DESC_RM_CONTROL_VALID > 1: SEC_DESC_SELF_RELATIVE > owner_sid : * > owner_sid : > S-1-5-21-197107965-2004198405-1252158227-512 > group_sid : * > group_sid : > S-1-5-21-197107965-2004198405-1252158227-512 > sacl : * >...

...nect to service EA initially as user nau (uid=10000, gid=10000) (pid 23491) ... [2011/04/05 12:18:16.348517, 3] smbd/vfs.c:1038(check_reduced_name) check_reduced_name: D reduced to /smb/X/D [2011/04/05 12:18:16.350387, 5] smbd/posix_acls.c:1191(unpack_nt_owners) unpack_nt_owners: validating owner_sids. [2011/04/05 12:18:16.350434, 5] smbd/posix_acls.c:1238(unpack_nt_owners) unpack_nt_owners: owner_sids validated. [2011/04/05 12:18:16.351005, 2] smbd/posix_acls.c:2903(set_canon_ace_list) set_canon_ace_list: sys_acl_set_file type file failed for file D (Operation not applicable). [2011/04/0...

...0: SEC_DESC_SACL_AUTO_INHERITED >>> 1: SEC_DESC_DACL_PROTECTED >>> 0: SEC_DESC_SACL_PROTECTED >>> 0: SEC_DESC_RM_CONTROL_VALID >>> 1: SEC_DESC_SELF_RELATIVE >>> owner_sid : * >>> owner_sid : S-1-22-1-65534 >>> group_sid : * >>> group_sid : S-1-22-2-65534 >>> sacl : NULL >>> dacl...

...But if I change primary GID of the user to another one (in this example - user1, old 38916 -> new 38901) I get the access denied error with the following in logs (level 10, some private data masked): [2007/06/18 16:22:33, 5] smbd/posix_acls.c:unpack_nt_owners(919) unpack_nt_owners: validating owner_sids. [2007/06/18 16:22:33, 10] passdb/lookup_sid.c:sid_to_uid(407) sid_to_uid: winbind lookup for non-local sid S-1-5-21-XXXXXXXXXX-XXXXXXXXX-XXXXXXXXXX-XXXXX failed [2007/06/18 16:22:33, 3] passdb/lookup_sid.c:fetch_gid_from_cache(253) fetch gid from cache 38916 -> S-1-5-21-273419216-XXXXXXXXX...