similar to: Using Access Control Lists with SMB2/SMB3 Mounts on Linux Clients

In current kernels we have the new IOCTL / QueryInfo passthrough where you can use a simple ioctl() on an object in a SMB2/3 share and pull the full security descriptor. It would be fairly trivial to expand this to allow setting the security descriptor too using SetInfo. We can add that when there is a need. Now, since this is available through a simple ioctl() interface, you can access this

On Tue, Feb 26, 2019 at 09:03:41AM -0800, Jeremy Allison via samba wrote: > > Check out the latest cifsfs code. I think Steve > and Aurelian and Ronnie added an ioctl for this. > > I'm here at Vault in Boston with Steve, I'll ask > him :-). Steve says there are two utilities in Linux, getcifsacl and setcifsacl that use a custom ioctl inside the Linux cifsfs kernel

Hi Jeremy, Hi Steve, Hi Ronnie, thanks for your replies and the profound discussion. I think, it's best to demonstrate my problem case along an real world example: The following log of a console sesssion shows how I am doing the mounts on behalf Linux Kernel CIFS-FS Module on the client side against a Samba 4.5 file server (both running on Debian Stretch 9.8) via SMB/CIFS resp. SMB2 protocol:

Thanks for the first reply, Jeremy. What about the (future) implementation of RichACL? Will there be any native Linux Client support along with the SMB2/SMB3 protocol? I know, there is a native implemenation for RichACLs in ext4 FS. Unfortunately, smbcals is not a native Linux ACL Tool and has a very unhandy syntax. I just tested some days ago. ;-) I am looking for a solution that allows the

Dear Jeremy, thanks for your instant reply. :-) Along with Linux native getfacl/fetfacl, I also tested getcifsacl/setcifsacl (for sure thoroughly ;-)). Unfortunately, these CIFS client tools seem to have been designed as part of the "old" CIFS Unix Extensions, working only for SMB/CIFS mounts, and are not supposed to work with SMB2/SMB3 mounts, as I guess. During my tests, the

Dear all, what is about the support for POSIX ACL in Samba protocol implementation of SMB2 and SMB3? >From what I extracted from SNIA and SambaXP developer conference talks and as well as the official Samba Wiki, support for POSIX ACL in SMB2 and SMB3 has been completely abandonned. Am I right? If so, is there any other possibility to allow Linux Clients to natively access access control lists

Could you see if anything useful in the logs indicating why the ACL was not returned? Instructions are at: https://wiki.samba.org/index.php/LinuxCIFS_troubleshooting#Enabling_Debugging (it is easier for newer kernels due to dynamic tracing e.g. "trace-cmd record -e cifs" but even with these older kernels it should be enough information in the dmesg logs - if not a wireshark trace

This is a big release that contains many functional changes that are aligned with the recent work done in the Linux SMB3 kernel client. These changes mostly aim to improve user experience by unlocking new features available in modern SMB3 servers: - smbinfo utility is added to query various kinds of information from the server (objectId, snapshots, different FileInfo* classes and other

New version 6.10 of cifs-utils has been released. Highlighted changes: - smb3 alias/fstype is added - smb2-quota tool is added to display quota information - smb2-secdesc UI tool to view security descriptors is added - smbinfo is enhanced with capabilities to dump session keys and get/set compression of files - smbinfo bash completion is supported - getcifsacl tool is improved to support

On Fri, Mar 01, 2019 at 08:05:52AM +1000, ronnie sahlberg wrote: > In current kernels we have the new IOCTL / QueryInfo passthrough where > you can use a simple ioctl() on an object in a SMB2/3 share and pull > the full security descriptor. > It would be fairly trivial to expand this to allow setting the > security descriptor too using SetInfo. We can add that when there is a >

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Time for another cifs-utils release! Most of the patches in this release are for cifs.idmap, getcifsacl and setcifsacl. There were many bugs in those tools, so anyone that's deploying or using them is highly encouraged to upgrade. Highlights: * NFS-style device names are being deprecated in 6.0. Anyone using that sort of device name should

We've had a number of changes since the last release, and we have some other upcoming kernel changes that might require corresponding cifs-utils changes. So it's probably as good a time as any for a new release. Highlights: + fix for a minor security issue that can corrupt the mtab + new getcifsacl/setcifsacl tools that allow you to fetch and set raw Windows ACLs via an xattr. + a

On Tue, Feb 26, 2019 at 03:05:12PM +0000, Kraus, Sebastian via samba wrote: > Dear all, > what is about the support for POSIX ACL in Samba protocol implementation of SMB2 and SMB3? > From what I extracted from SNIA and SambaXP developer conference talks and as well as the official Samba Wiki, > support for POSIX ACL in SMB2 and SMB3 has been completely abandonned. Am I right? Yes.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 With the merge of the new plugin interface, it's probably a good time for a new cifs-utils release. Distro packagers should take special note of the changes with the new plugin interface since it has implications for how the tools are packaged. In particular, it's necessary to set a symlink to the plugin in the correct location

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Things have been relatively quiet lately. Time for a release! Highlights: * A lot of manpage updates, additions and corrections * cifs.idmap can now map uid/gid to SID in addition to the other way around * getcifsacl/setcifsacl are now installed by default in /usr/bin instead of /usr/sbin. The manpages are now in section 1. * cifs.upcall has a

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Time for a new cifs-utils release! The big bullet point in this release is a new pam_cifscreds module that has been added by Orion Poplawski. This release also cleans some unused cruft out of some of the binaries so they're quite a bit smaller now and fixes a few bugs that Coverity turned up. Go forth and download! webpage:

On Thu, Jun 08, 2017 at 06:43:34PM +0200, Ralph Böhme via samba wrote: > Hi Andy, > > On Thu, Jun 08, 2017 at 09:23:50AM -0700, Andy Qian via samba wrote: > > The smbcacls cmd worked before till recently. Due to the recent Windows > > patch which disables SMB v1, we have to add the following line into the > > [global] section in smb.conf file on Linux machine so that

Hi, all, we run smbcacls tool from linux machine to set file permissions on windows server. here is our environment: Linux machine: Ubuntu 14.04 LTS, kernel version 3.13.0-112-generic Samba version: 4.3.11 Windows machine: Windows server 2012 the cmd we run is something like following: /usr/bin/smbcacls -U 'Domain\Administrator'%'pwd' '//win_server/testshare'

Hi When I mount CIFS share (mount -t cids) with vers=1.0 I can perform getcifsacl sucessfully. But when I mount with vers=2.0, or 2.1, or 3.0, ACL reading fails. getxattr error: 95 REVISION:0x0 CONTROL:0x0 Why getcifsacl depends on SMB protocol version? Can I read ACL via newer SMB protocol? A asked on Serverfault but without reply:

I would like to be able to use SID's in linux so as to have ACL's identical to windows. Example usage why: Say I have an ntfs partitioned disk that I share with a co-worker that uses windows. Currently I am connected to the domain using rfc2307 and that allows me to authenticate using AD and on the nfs through the Isilon the windows users see files correctly permissioned but when I share