similar to: works with 4.7.6, fails with 4.8.2: echo > $(mktemp /mnt/XXXXXX)

Hi Jeremy, Hi Steve, Hi Ronnie, thanks for your replies and the profound discussion. I think, it's best to demonstrate my problem case along an real world example: The following log of a console sesssion shows how I am doing the mounts on behalf Linux Kernel CIFS-FS Module on the client side against a Samba 4.5 file server (both running on Debian Stretch 9.8) via SMB/CIFS resp. SMB2 protocol:

Hi When I mount CIFS share (mount -t cids) with vers=1.0 I can perform getcifsacl sucessfully. But when I mount with vers=2.0, or 2.1, or 3.0, ACL reading fails. getxattr error: 95 REVISION:0x0 CONTROL:0x0 Why getcifsacl depends on SMB protocol version? Can I read ACL via newer SMB protocol? A asked on Serverfault but without reply:

On Wed, 23 Jan 2019 09:47:11 +0100 Miloslav Hůla via samba <samba at lists.samba.org> wrote: > Dne 2019-01-15 v 13:22 Miloslav Hůla via samba napsal(a): > > When I mount CIFS share (mount -t cids) with vers=1.0 I can perform > > getcifsacl sucessfully. But when I mount with vers=2.0, or 2.1, or > > 3.0, ACL reading fails. > > > > getxattr error: 95 >

Sometimes a group sid does not get resolved to its name. Is this a settings problem? Looks like winbind deamon went dormant for a while and then woke up? I am using interface wbcLookupSid provided by the library libwbclient.so for resolving sids to names. These are the winbind related parameters in /etc/samba/smb.conf [global] # separate domain and username with '\', like

On Tue, Feb 26, 2019 at 09:03:41AM -0800, Jeremy Allison via samba wrote: > > Check out the latest cifsfs code. I think Steve > and Aurelian and Ronnie added an ioctl for this. > > I'm here at Vault in Boston with Steve, I'll ask > him :-). Steve says there are two utilities in Linux, getcifsacl and setcifsacl that use a custom ioctl inside the Linux cifsfs kernel

ACL management can be done for SMB2/SMB3 ACLs with two common tools depending on your preference. smbcacls (somewhat similar to using cacls.exe or icacls.exe in Windows but specifying the UNC name rather than a local path name). smbcacls sets up and tears down a network connection each time it is run and uses Samba user space code. or setcifsacl/getcifsacl (which calls cifs.ko to access the

Could you see if anything useful in the logs indicating why the ACL was not returned? Instructions are at: https://wiki.samba.org/index.php/LinuxCIFS_troubleshooting#Enabling_Debugging (it is easier for newer kernels due to dynamic tracing e.g. "trace-cmd record -e cifs" but even with these older kernels it should be enough information in the dmesg logs - if not a wireshark trace

New version 6.10 of cifs-utils has been released. Highlighted changes: - smb3 alias/fstype is added - smb2-quota tool is added to display quota information - smb2-secdesc UI tool to view security descriptors is added - smbinfo is enhanced with capabilities to dump session keys and get/set compression of files - smbinfo bash completion is supported - getcifsacl tool is improved to support

On 9/25/20 5:14 AM, Aur?lien Aptel wrote: > Ken Bass via samba <samba at lists.samba.org> writes: >> Can you please expand on this, I am confused as to what you are >> suggesting.? If 'getent pass' works properly and shows no >> overlap/confusion, this seems to be related to cifsacl. > It's still hard to say at this point. > > cifs.idmap logs

Dear Jeremy, thanks for your instant reply. :-) Along with Linux native getfacl/fetfacl, I also tested getcifsacl/setcifsacl (for sure thoroughly ;-)). Unfortunately, these CIFS client tools seem to have been designed as part of the "old" CIFS Unix Extensions, working only for SMB/CIFS mounts, and are not supposed to work with SMB2/SMB3 mounts, as I guess. During my tests, the

This is a big release that contains many functional changes that are aligned with the recent work done in the Linux SMB3 kernel client. These changes mostly aim to improve user experience by unlocking new features available in modern SMB3 servers: - smbinfo utility is added to query various kinds of information from the server (objectId, snapshots, different FileInfo* classes and other

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Time for a new cifs-utils release! The big bullet point in this release is a new pam_cifscreds module that has been added by Orion Poplawski. This release also cleans some unused cruft out of some of the binaries so they're quite a bit smaller now and fixes a few bugs that Coverity turned up. Go forth and download! webpage:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Time for another cifs-utils release! Most of the patches in this release are for cifs.idmap, getcifsacl and setcifsacl. There were many bugs in those tools, so anyone that's deploying or using them is highly encouraged to upgrade. Highlights: * NFS-style device names are being deprecated in 6.0. Anyone using that sort of device name should

We've had a number of changes since the last release, and we have some other upcoming kernel changes that might require corresponding cifs-utils changes. So it's probably as good a time as any for a new release. Highlights: + fix for a minor security issue that can corrupt the mtab + new getcifsacl/setcifsacl tools that allow you to fetch and set raw Windows ACLs via an xattr. + a

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 With the merge of the new plugin interface, it's probably a good time for a new cifs-utils release. Distro packagers should take special note of the changes with the new plugin interface since it has implications for how the tools are packaged. In particular, it's necessary to set a symlink to the plugin in the correct location

I installed a new Ubuntu 20.4 LTS system (smbd 4.11.6) . Initially I tried using the SSSD and 'realm' to join the domain. Everything worked similar to my Centos 7 install and I thought I was finished. The one thing not working is? cifs shares showing the proper id mapping. Based on some online posts, including from Rowland, I got rid of SSSD and configured samba/winbind only. Lots of

I would like to be able to use SID's in linux so as to have ACL's identical to windows. Example usage why: Say I have an ntfs partitioned disk that I share with a co-worker that uses windows. Currently I am connected to the domain using rfc2307 and that allows me to authenticate using AD and on the nfs through the Isilon the windows users see files correctly permissioned but when I share

In current kernels we have the new IOCTL / QueryInfo passthrough where you can use a simple ioctl() on an object in a SMB2/3 share and pull the full security descriptor. It would be fairly trivial to expand this to allow setting the security descriptor too using SetInfo. We can add that when there is a need. Now, since this is available through a simple ioctl() interface, you can access this

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Things have been relatively quiet lately. Time for a release! Highlights: * A lot of manpage updates, additions and corrections * cifs.idmap can now map uid/gid to SID in addition to the other way around * getcifsacl/setcifsacl are now installed by default in /usr/bin instead of /usr/sbin. The manpages are now in section 1. * cifs.upcall has a

G'day Guys, We are running Centos 6.4, samba4.0.10, compiled from tgz. Has anyone come up with this one before? samba-tool gpo aclcheck ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such element' File "/usr/local/samba/lib64/python2.6/site-packages/samba/netcmd/__init__.py", line 175, in _run return self.run(*args, **kwargs) File