http://bugzilla.opensuse.org/show_bug.cgi?id=1145314 http://bugzilla.opensuse.org/show_bug.cgi?id=1145314#c1 --- Comment #1 from Richard Farthing --- Created attachment 813721 --> http://bugzilla.opensuse.org/attachment.cgi?id=813721&action=edit smbd log file (debug level 10) -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1145314 http://bugzilla.opensuse.org/show_bug.cgi?id=1145314#c3 David Mulder changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david.mulder@suse.com --- Comment #3 from David Mulder --- The call stack: create_file_default create_file_unixpath open_file_ntcreate open_file fd_open_atomic fd_open [2019/08/12 17:22:12.210108, 10, pid=26897, effective(1000, 100), real(1000, 0)] ../source3/smbd/open.c:810(fd_open) fd_open: name ., flags = 00 mode = 0744, fd = -1. Permission denied -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1145314 http://bugzilla.opensuse.org/show_bug.cgi?id=1145314#c5 --- Comment #5 from David Mulder --- And could you also post the server debug where share access is successful (the debug only shows a failure accessing /mnt/lvm2, would be good to compare this with a working output). -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1145314 http://bugzilla.opensuse.org/show_bug.cgi?id=1145314#c7 --- Comment #7 from Richard Farthing --- Created attachment 813789 --> http://bugzilla.opensuse.org/attachment.cgi?id=813789&action=edit SMB config file -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1145314 Richard Farthing changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #813788|0 |1 is obsolete| | -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1145314 Richard Farthing changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #813808|0 |1 is obsolete| | -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1145314 http://bugzilla.opensuse.org/show_bug.cgi?id=1145314#c11 --- Comment #11 from David Mulder --- Working: [2019/08/13 10:09:31.118893, 10, pid=20648, effective(30, 8), real(30, 0)] ../source3/smbd/open.c:810(fd_open) fd_open: name ., flags = 00 mode = 0744, fd = 9. Broken: [2019/08/12 17:22:10.259258, 10, pid=26897, effective(1000, 100), real(1000, 0)] ../source3/smbd/open.c:810(fd_open) fd_open: name ., flags = 0200000 mode = 00, fd = -1. Permission denied Which leads me to the function open_directory() where I see this call: #ifdef O_DIRECTORY status = fd_open(conn, fsp, O_RDONLY|O_DIRECTORY, 0); #else /* POSIX allows us to open a directory with O_RDONLY. */ status = fd_open(conn, fsp, O_RDONLY, 0); #endif So the working version calls fd_open without O_DIRECTORY, and the broken version calls with O_DIRECTORY (O_DIRECTORY equals 0200000, the flag param in the debug). This is a compiler directive making this change. Richard, these results are coming from 2 different samba versions (which versions are they)? -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1145314 http://bugzilla.opensuse.org/show_bug.cgi?id=1145314#c13 --- Comment #13 from David Mulder --- (In reply to Richard Farthing from comment #12)

No, I'm afraid not: I only have 1 server, same samba - running the released version for Leap 15.1, YAST says from the main update repo, 13th June 2019, installed 21st July:

4.9.5+git.176.375e1f05788-lp151.2.3.1

Let me know what other tests you need, thx.

Huh, very strange. I'm not sure where else it might be picking up that flag change. I'll have to look around. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1145314 http://bugzilla.opensuse.org/show_bug.cgi?id=1145314#c15 --- Comment #15 from David Mulder --- Just for curiosity, could you test this setup with the latest samba? The repo is here: https://download.opensuse.org/repositories/network:/samba:/STABLE/openSUSE_L... -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1145314 http://bugzilla.opensuse.org/show_bug.cgi?id=1145314#c17 --- Comment #17 from Richard Farthing --- Hmm, progress of sorts... I updated to Samba 4.10 as suggested, but the samba-tool returned python errors, not sure why. Samba tool not available in released 4.9.5 it appears. ha-server:/mnt/lvm1 # samba-tool ntacl get /mnt/lvm1/CCTV ERROR(runtime): uncaught exception - Unable to load default file File "/usr/lib64/python2.7/site-packages/samba/netcmd/__init__.py", line 177, in _run return self.run(*args, **kwargs) File "/usr/lib64/python2.7/site-packages/samba/netcmd/ntacl.py", line 145, in run lp = sambaopts.get_loadparm() File "/usr/lib64/python2.7/site-packages/samba/getopt.py", line 94, in get_loadparm self._lp.load_default() However LVM2 sprang into life with the 4.10. LVM1 (and a symlink into LVM1 from BACKUP) still refuses to work with "permission denied". The config couldn't be simpler: [lvm2] path = /mnt/lvm2 writeable = yes [lvm1] path = /mnt/lvm1 writeable = yes The smbd.log is no longer showing the same detail despite debug level 10 (I had this issue before - in comments above crossed out - and can't explain, seems hit-and-miss). I reverted to 4.9.5 and LVM2 is still working, LVM1 still not! Clutching at straws, I noted that LVM1 was allocated sequentially LV VG Attr LSize Pool Origin Data% Meta% Move Log Cpy%Sync Convert lvm0 system -wi-ao---- 3.64t lvm1 system -wc-ao---- 1.82t lvm2-test system -wi-ao---- 10.00g I changed LVM1 back to the default: anywhere - on the distant offchance that it makes a difference - it doesn't. I rebooted the machine also. I also tried accessing from a Debian 10 machine running samba client, with the same result. The difference is that the Windows machine is using a domain logons, the Debian one is just using username/password, the result is the same. This is getting really weird... Anything else to try? -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1145314 http://bugzilla.opensuse.org/show_bug.cgi?id=1145314#c19 --- Comment #19 from Richard Farthing --- OK, thanks, removing include = /etc/samba/dhcp.conf from the smb.conf got it. I ran the tool for each share, LVM0, LVM1 and LVM2 - they all report the same, I checked with a diff. (I assume you just want the security descriptor below) a-server:/ # samba-tool ntacl get /mnt/lvm1 INFO: Current debug levels: all: 10 tdb: 10 printdrivers: 10 lanman: 10 smb: 10 rpc_parse: 10 rpc_srv: 10 rpc_cli: 10 passdb: 10 sam: 10 auth: 10 winbind: 10 vfs: 10 idmap: 10 quota: 10 acls: 10 locking: 10 msdfs: 10 dmapi: 10 registry: 10 scavenger: 10 dns: 10 ldb: 10 tevent: 10 auth_audit: 10 auth_json_audit: 10 kerberos: 10 drs_repl: 10 smb2: 10 smb2_credits: 10 dsdb_audit: 10 dsdb_json_audit: 10 dsdb_password_audit: 10 dsdb_password_json_audit: 10 dsdb_transaction_audit: 10 dsdb_transaction_json_audit: 10 dsdb_group_audit: 10 dsdb_group_json_audit: 10 NOTE: Service music is flagged unavailable. INFO: Current debug levels: all: 10 tdb: 10 printdrivers: 10 lanman: 10 smb: 10 rpc_parse: 10 rpc_srv: 10 rpc_cli: 10 passdb: 10 sam: 10 auth: 10 winbind: 10 vfs: 10 idmap: 10 quota: 10 acls: 10 locking: 10 msdfs: 10 dmapi: 10 registry: 10 scavenger: 10 dns: 10 ldb: 10 tevent: 10 auth_audit: 10 auth_json_audit: 10 kerberos: 10 drs_repl: 10 smb2: 10 smb2_credits: 10 dsdb_audit: 10 dsdb_json_audit: 10 dsdb_password_audit: 10 dsdb_password_json_audit: 10 dsdb_transaction_audit: 10 dsdb_transaction_json_audit: 10 dsdb_group_audit: 10 dsdb_group_json_audit: 10 doing parameter workgroup = KEYNET doing parameter name resolve order = wins lmhosts host bcast doing parameter dns proxy = yes doing parameter write raw = no doing parameter winbind gid = 10000-20000 doing parameter min wins ttl = 1800 doing parameter logon drive = H: doing parameter dos filetime resolution = Yes doing parameter max wins ttl = 3600 doing parameter hide special files = yes doing parameter winbind uid = 10000-20000 doing parameter smb ports = 139 doing parameter log level = 1 NOTE: Service music is flagged unavailable. security_descriptor: struct security_descriptor revision : SECURITY_DESCRIPTOR_REVISION_1 (1) type : 0x9004 (36868) 0: SEC_DESC_OWNER_DEFAULTED 0: SEC_DESC_GROUP_DEFAULTED 1: SEC_DESC_DACL_PRESENT 0: SEC_DESC_DACL_DEFAULTED 0: SEC_DESC_SACL_PRESENT 0: SEC_DESC_SACL_DEFAULTED 0: SEC_DESC_DACL_TRUSTED 0: SEC_DESC_SERVER_SECURITY 0: SEC_DESC_DACL_AUTO_INHERIT_REQ 0: SEC_DESC_SACL_AUTO_INHERIT_REQ 0: SEC_DESC_DACL_AUTO_INHERITED 0: SEC_DESC_SACL_AUTO_INHERITED 1: SEC_DESC_DACL_PROTECTED 0: SEC_DESC_SACL_PROTECTED 0: SEC_DESC_RM_CONTROL_VALID 1: SEC_DESC_SELF_RELATIVE owner_sid : * owner_sid : S-1-22-1-0 group_sid : * group_sid : S-1-22-2-0 sacl : NULL dacl : * dacl: struct security_acl revision : SECURITY_ACL_REVISION_NT4 (2) size : 0x004c (76) num_aces : 0x00000003 (3) aces: ARRAY(3) aces: struct security_ace type : SEC_ACE_TYPE_ACCESS_ALLOWED (0) flags : 0x00 (0) 0: SEC_ACE_FLAG_OBJECT_INHERIT 0: SEC_ACE_FLAG_CONTAINER_INHERIT 0: SEC_ACE_FLAG_NO_PROPAGATE_INHERIT 0: SEC_ACE_FLAG_INHERIT_ONLY 0: SEC_ACE_FLAG_INHERITED_ACE 0x00: SEC_ACE_FLAG_VALID_INHERIT (0) 0: SEC_ACE_FLAG_SUCCESSFUL_ACCESS 0: SEC_ACE_FLAG_FAILED_ACCESS size : 0x0018 (24) access_mask : 0x001f01ff (2032127) object : union security_ace_object_ctr(case 0) trustee : S-1-22-1-0 aces: struct security_ace type : SEC_ACE_TYPE_ACCESS_ALLOWED (0) flags : 0x00 (0) 0: SEC_ACE_FLAG_OBJECT_INHERIT 0: SEC_ACE_FLAG_CONTAINER_INHERIT 0: SEC_ACE_FLAG_NO_PROPAGATE_INHERIT 0: SEC_ACE_FLAG_INHERIT_ONLY 0: SEC_ACE_FLAG_INHERITED_ACE 0x00: SEC_ACE_FLAG_VALID_INHERIT (0) 0: SEC_ACE_FLAG_SUCCESSFUL_ACCESS 0: SEC_ACE_FLAG_FAILED_ACCESS size : 0x0018 (24) access_mask : 0x001200a9 (1179817) object : union security_ace_object_ctr(case 0) trustee : S-1-22-2-0 aces: struct security_ace type : SEC_ACE_TYPE_ACCESS_ALLOWED (0) flags : 0x00 (0) 0: SEC_ACE_FLAG_OBJECT_INHERIT 0: SEC_ACE_FLAG_CONTAINER_INHERIT 0: SEC_ACE_FLAG_NO_PROPAGATE_INHERIT 0: SEC_ACE_FLAG_INHERIT_ONLY 0: SEC_ACE_FLAG_INHERITED_ACE 0x00: SEC_ACE_FLAG_VALID_INHERIT (0) 0: SEC_ACE_FLAG_SUCCESSFUL_ACCESS 0: SEC_ACE_FLAG_FAILED_ACCESS size : 0x0014 (20) access_mask : 0x001200a9 (1179817) object : union security_ace_object_ctr(case 0) trustee : S-1-1-0 -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1145314 http://bugzilla.opensuse.org/show_bug.cgi?id=1145314#c21 --- Comment #21 from Richard Farthing --- Further testing shows that new shares appear OK, but give "permission denied" outside existing shared directories: even new shares in the root partition fail, even if given 777 permission, so the problem doesn't appear to be specific to LVM. Reverting to the released samba (4.9.5), the new LVM1 and LVM2 shares now give permission denied again when browsing, but reinstalling latest 4.10 samba doesn't fix it - it appears quite random in a bad way, though the older existing shares consistently work through all the changes - very unusual. As a test, I also stripped back smb.conf to the bare minimum, but the problems remain. The lack of debug info in log.smbd was caused by Webmin setting the "debug level" not "log level". I can now create more detailed logs consistently using log level -- You are receiving this mail because: You are on the CC list for the bug.