[Bug 783719] New: samba "wide links = yes" does not work after upgrade from OpenSuse 11.2

newer
[Bug 792294] New: make samba lib...

older
[Bug 864166] New: apache2 fails to...

bugzilla_noreply＠novell.com

5 Oct 2012 5 Oct '12

14:49

https://bugzilla.novell.com/show_bug.cgi?id=783719 https://bugzilla.novell.com/show_bug.cgi?id=783719#c0 Summary: samba "wide links = yes" does not work after upgrade from OpenSuse 11.2 Classification: openSUSE Product: openSUSE 12.2 Version: Final Platform: i586 OS/Version: openSUSE 12.2 Status: NEW Severity: Normal Priority: P5 - None Component: Network AssignedTo: bnc-team-screening@forge.provo.novell.com ReportedBy: fischerc@itam.cas.cz QAContact: qa-bugs@suse.de Found By: --- Blocker: --- Created an attachment (id=508381) --> (http://bugzilla.novell.com/attachment.cgi?id=508381) snip of the logfile User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:13.0) Gecko/20100101 Firefox/13.0 After upgrade from 11.2 to 12.2, samba configuration works well except to "wide links = yes" feature. samba share dir "/Rejd/samba" contains sub-direcotry and linked directory drwxrwxrwx 16 root root 4096 Sep 24 08:49 public lrwxrwxrwx 1 root root 19 Sep 24 08:48 linked -> ../linkeddir/ where linked dir is readable: server:/Rejd/samba # ls -l .. drwxr-xr-x 5 root root 82 Oct 5 13:59 samba drwxr-xr-x 6 root root 95 Dec 29 2010 linkeddir linked subdirectory is visible, but not listable smbclient -U guest //localhost/samba Enter guest's password: Domain=[SERVER-NET] OS=[Unix] Server=[Samba 3.6.7-48.12.1-2831-SUSE-SL12.2-i386] smb: \> dir . D 0 Fri Oct 5 13:59:01 2012 .. D 0 Wed Sep 5 07:17:06 2012 public D 0 Mon Sep 24 08:49:37 2012 linked D 0 Mon Sep 24 08:48:35 2012 smb: \> cd linked smb: \linked\> dir NT_STATUS_ACCESS_DENIED listing \linked\* The ordinary subdirectory "public" works well. If I add another (dummy) share pointing to linked directory, everything works as well. smb.conf: [global] map to guest = Bad User domain logons = no domain master = no local master = no preferred master = no security = user unix extensions = no follow symlinks = yes wide links = yes [samba] inherit acls = Yes path = /Rejd/samba read only = no valid users = guest Reproducible: Always Steps to Reproduce: 1. Use config provided 2. Try to access linked directory outside the share tree Actual Results: smb: \linked\> dir NT_STATUS_ACCESS_DENIED listing \linked\* Expected Results: listing of "linked" subdirectory -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Show replies by date

bugzilla_noreply＠novell.com

6 Oct 6 Oct

08:28

New subject: [Bug 783719] samba "wide links = yes" does not work after upgrade from OpenSuse 11.2

https://bugzilla.novell.com/show_bug.cgi?id=783719 https://bugzilla.novell.com/show_bug.cgi?id=783719#c1 --- Comment #1 from Cyril Fischer 2012-10-06 08:28:36 UTC --- The problem is related to AppArmor configuration. Having AppArmor disabled everything work as expected. If samba is started BEFORE Apparmor, links work fine. It seems, that Samba configurator does not generate correct rules (or at least some kind of warnining) for AppArmor. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

12:47

New subject: [Bug 783719] samba "wide links = yes" does not work after upgrade from OpenSuse 11.2

https://bugzilla.novell.com/show_bug.cgi?id=783719 https://bugzilla.novell.com/show_bug.cgi?id=783719#c2 Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |meissner@suse.com AssignedTo|bnc-team-screening@forge.pr |samba-maintainers@SuSE.de |ovo.novell.com | --- Comment #2 from Marcus Meissner 2012-10-06 12:47:24 UTC --- the rules are somehow autogenerated by samba -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

7 Oct 7 Oct

00:12

New subject: [Bug 783719] samba "wide links = yes" does not work after upgrade from OpenSuse 11.2

https://bugzilla.novell.com/show_bug.cgi?id=783719 https://bugzilla.novell.com/show_bug.cgi?id=783719#c3 Christian Boltz changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED CC| |suse-beta@cboltz.de Resolution| |WONTFIX --- Comment #3 from Christian Boltz 2012-10-07 02:12:09 CEST --- Let me start with a little bit of history ;-) There was no AppArmor profile for samba on 11.2, which means it's not surprising that you didn't get anything blocked. Starting with AppArmor 2.5 / openSUSE 11.4 AppArmor came with profiles for samba, which also means that admins had to update the profile manually if they wanted to use non-default shares (/home/ was allowed by default). Starting with (IIRC) openSUSE 12.1, the apparmor rules for samba are autogenerated based on the shares you have configured in your smb.conf. Basically all path= lines are read and a profile sniplet is generated to allow access to all shares (and nothing more - that's the job of AppArmor ;-) In other words: I gave the little finger to samba admins and saved 99% of them lots of work by updating the profile automatically. Now you come with "wide links" and want to take the whole hand. Oh well ;-) I understand your issue, but changing the script that generates the profile sniplet is not really an option here. "wide links" could point everywhere in the filesystem, so we would end up with allowing read and write access to your complete system (/**), which is not really secure ;-) and would make the AppArmor profile superfluous. IMHO your configuration is a corner-case (and would be very hard to support in an automatic way), so you are on your own here and have to update the profile manually. Please edit /etc/apparmor.d/local/usr.sbin.smbd and add the following two lines: /Rejd/linkeddir/ rk, /Rejd/linkeddir/** rwkl, Then reload AppArmor and samba, and everything should work ;-) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

10:35

New subject: [Bug 783719] samba "wide links = yes" does not work after upgrade from OpenSuse 11.2

https://bugzilla.novell.com/show_bug.cgi?id=783719 https://bugzilla.novell.com/show_bug.cgi?id=783719#c4 Lars Müller changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED CC| |samba-maintainers@SuSE.de Resolution|WONTFIX | AssignedTo|samba-maintainers@SuSE.de |lmuelle@suse.com Severity|Normal |Enhancement --- Comment #4 from Lars Müller 2012-10-07 12:35:28 CEST --- Shouldn't we improve the documentation and add a pointer to this issue to make the life for other Samba users easier? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

10:36

New subject: [Bug 783719] samba "wide links = yes" does not work after upgrade from OpenSuse 11.2

bugzilla_noreply＠novell.com

10:37

New subject: [Bug 783719] samba "wide links = yes" does not work after upgrade from OpenSuse 11.2

https://bugzilla.novell.com/show_bug.cgi?id=783719 https://bugzilla.novell.com/show_bug.cgi?id=783719#c Lars Müller changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|samba-maintainers@SuSE.de |lmuelle@suse.com -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

14:07

New subject: [Bug 783719] samba "wide links = yes" does not work after upgrade from OpenSuse 11.2

https://bugzilla.novell.com/show_bug.cgi?id=783719 https://bugzilla.novell.com/show_bug.cgi?id=783719#c5 Christian Boltz changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |REOPENED InfoProvider|suse-beta@cboltz.de | --- Comment #5 from Christian Boltz 2012-10-07 16:07:15 CEST --- Yes, writing documentation is always a good idea ;-) and probably the only sane way to cover "wide links". BTW: you don't need to ask for permission to write documentation ;-) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

20:41

New subject: [Bug 783719] samba "wide links = yes" does not work after upgrade from OpenSuse 11.2

https://bugzilla.novell.com/show_bug.cgi?id=783719 https://bugzilla.novell.com/show_bug.cgi?id=783719#c6 --- Comment #6 from Cyril Fischer 2012-10-07 20:31:48 UTC --- Thanks a lot for explanation and excellent care. Regarding the documentation, I would prefer a warning message in the log file when samba is started. Something like "wide links and AppArmor are active, AppArmor profile has to include targets of all links" or something like that. A short notice in the man page of smb.conf would be helpful too. Once again many thanks. C. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

22:53

New subject: [Bug 783719] samba "wide links = yes" does not work after upgrade from OpenSuse 11.2

https://bugzilla.novell.com/show_bug.cgi?id=783719 https://bugzilla.novell.com/show_bug.cgi?id=783719#c7 --- Comment #7 from Cyril Fischer 2012-10-07 22:52:53 UTC --- Thanks a lot for explanation and excellent care. Just a few points to explain:

...

I don't think that my configuration is too rare - I just need to join several partitions into one samba tree. I completely agree with you that admins should handle such topic, on the other hand I was rather proud on my samba config which lasted for years ;-) and stopped working just after upgrade. AppArmor appeared active without any notice. That was source of my confusion.

Regarding the documentation, I would prefer a warning message in the log file when samba is started. Something like "wide links and AppArmor are active, AppArmor profile has to include targets of all links" or something like that. A short notice in the "wide links part" of man page of smb.conf would be helpful too. Once again many thanks. C. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

22:54

New subject: [Bug 783719] samba "wide links = yes" does not work after upgrade from OpenSuse 11.2

https://bugzilla.novell.com/show_bug.cgi?id=783719 https://bugzilla.novell.com/show_bug.cgi?id=783719#c8 --- Comment #8 from Cyril Fischer 2012-10-07 22:54:07 UTC --- Thanks a lot for explanation and excellent care. Just a few points to explain: :: I don't think that my configuration is too rare - I just need to join several partitions into one samba tree. :: I completely agree with you that admins should handle such topic, on the other hand I was rather proud on my samba config which lasted for years ;-) and stopped working just after upgrade. :: AppArmor appeared active without any notice. That was source of my confusion. Regarding the documentation, I would prefer a warning message in the log file when samba is started. Something like "wide links and AppArmor are active, AppArmor profile has to include targets of all links" or something like that. A short notice in the "wide links part" of man page of smb.conf would be helpful too. Once again many thanks. C. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

20 Oct 20 Oct

14:02

New subject: [Bug 783719] samba "wide links = yes" does not work after upgrade from OpenSuse 11.2

https://bugzilla.novell.com/show_bug.cgi?id=783719 https://bugzilla.novell.com/show_bug.cgi?id=783719#c9 --- Comment #9 from Christian Boltz 2012-10-20 16:02:30 CEST --- Created an attachment (id=510313) --> (http://bugzilla.novell.com/attachment.cgi?id=510313) patch for update-apparmor-samba-profile - log warning if "wide links" are enabled Lars, please apply this patch to update-apparmor-samba-profile -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

26 Oct 26 Oct

18:17

New subject: [Bug 783719] samba "wide links = yes" does not work after upgrade from OpenSuse 11.2

https://bugzilla.novell.com/show_bug.cgi?id=783719 https://bugzilla.novell.com/show_bug.cgi?id=783719#c10 Lars Müller changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |NEEDINFO InfoProvider| |fischerc@itam.cas.cz --- Comment #10 from Lars Müller 2012-10-26 20:17:33 CEST --- Starting with build source times tamp 2845 the update-apparmor-samba-profile helper script writes a warning like this one into the smbd log file [2012/10/26 20:12:15] update-apparmor-samba-profile WARNING: "wide links" enabled. You might need to modify the smbd apparmor profile manually. Packages including this enhancement soon will be published at http://download.opensuse.org/repositories/network:/samba:/STABLE/ Please test and report back if that works for you. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

29 Oct 29 Oct

18:00

New subject: [Bug 783719] samba "wide links = yes" does not work after upgrade from OpenSuse 11.2

https://bugzilla.novell.com/show_bug.cgi?id=783719 https://bugzilla.novell.com/show_bug.cgi?id=783719#c11 --- Comment #11 from Bernhard Wiedemann 2012-10-29 19:00:09 CET --- This is an autogenerated message for OBS integration: This bug (783719) was mentioned in https://build.opensuse.org/request/show/139712 Factory / samba -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

20:00

New subject: [Bug 783719] samba "wide links = yes" does not work after upgrade from OpenSuse 11.2

https://bugzilla.novell.com/show_bug.cgi?id=783719 https://bugzilla.novell.com/show_bug.cgi?id=783719#c12 --- Comment #12 from Bernhard Wiedemann 2012-10-29 21:00:08 CET --- This is an autogenerated message for OBS integration: This bug (783719) was mentioned in https://build.opensuse.org/request/show/139721 Factory / samba -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

20 Nov 20 Nov

20:16

New subject: [Bug 783719] samba "wide links = yes" does not work after upgrade from OpenSuse 11.2

https://bugzilla.novell.com/show_bug.cgi?id=783719 https://bugzilla.novell.com/show_bug.cgi?id=783719#c Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard| |maint:running:50102:low -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

17 Dec 17 Dec

16:33

New subject: [Bug 783719] samba "wide links = yes" does not work after upgrade from OpenSuse 11.2

https://bugzilla.novell.com/show_bug.cgi?id=783719 https://bugzilla.novell.com/show_bug.cgi?id=783719#c13 Lars Müller changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |RESOLVED InfoProvider|fischerc@itam.cas.cz | Resolution| |FIXED --- Comment #13 from Lars Müller 2012-12-17 17:32:58 CET --- Closing as fixed even if the requested feedback is still missing. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

21 Dec 21 Dec

18:06

New subject: [Bug 783719] samba "wide links = yes" does not work after upgrade from OpenSuse 11.2

https://bugzilla.novell.com/show_bug.cgi?id=783719 https://bugzilla.novell.com/show_bug.cgi?id=783719#c14 Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard|maint:running:50102:low |maint:running:50102:low | |maint:released:sle11-sp2:50 | |237 --- Comment #14 from Swamp Workflow Management 2012-12-21 18:06:07 UTC --- Update released for: cifs-mount, ldapsmb, libldb-devel, libldb1, libldb1-32bit, libldb1-x86, libnetapi-devel, libnetapi0, libsmbclient-devel, libsmbclient0, libsmbclient0-32bit, libsmbclient0-x86, libsmbsharemodes-devel, libsmbsharemodes0, libtalloc-devel, libtalloc1, libtalloc1-32bit, libtalloc1-debuginfo, libtalloc1-debuginfo-32bit, libtalloc1-debuginfo-x86, libtalloc1-debugsource, libtalloc1-x86, libtalloc2, libtalloc2-32bit, libtalloc2-x86, libtdb-devel, libtdb1, libtdb1-32bit, libtdb1-x86, libtevent-devel, libtevent0, libtevent0-32bit, libtevent0-x86, libwbclient-devel, libwbclient0, libwbclient0-32bit, libwbclient0-x86, samba, samba-32bit, samba-client, samba-client-32bit, samba-client-x86, samba-debuginfo, samba-debuginfo-32bit, samba-debuginfo-x86, samba-debugsource, samba-devel, samba-krb-printing, samba-vscan, samba-winbind, samba-winbind-32bit, samba-winbind-x86, samba-x86 Products: SLE-DEBUGINFO 11-SP2 (i386, ia64, ppc64, s390x, x86_64) SLE-DESKTOP 11-SP2 (i386, x86_64) SLE-SDK 11-SP2 (i386, ia64, ppc64, s390x, x86_64) SLE-SERVER 11-SP2 (i386, ia64, ppc64, s390x, x86_64) SLES4VMWARE 11-SP2 (i386, x86_64) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

27 Dec 27 Dec

14:23

New subject: [Bug 783719] samba "wide links = yes" does not work after upgrade from OpenSuse 11.2

https://bugzilla.novell.com/show_bug.cgi?id=783719 https://bugzilla.novell.com/show_bug.cgi?id=783719#c Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard|maint:running:50102:low |maint:released:sle11-sp2:50 |maint:released:sle11-sp2:50 |237 |237 | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

4 Feb 4 Feb

12:33

New subject: [Bug 783719] samba "wide links = yes" does not work after upgrade from OpenSuse 11.2

https://bugzilla.novell.com/show_bug.cgi?id=783719 https://bugzilla.novell.com/show_bug.cgi?id=783719#c Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard|maint:released:sle11-sp2:50 |maint:released:sle11-sp2:50 |237 |237 | |obs:running:1300:moderate -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

12 Feb 12 Feb

09:09

New subject: [Bug 783719] samba "wide links = yes" does not work after upgrade from OpenSuse 11.2

https://bugzilla.novell.com/show_bug.cgi?id=783719 https://bugzilla.novell.com/show_bug.cgi?id=783719#c15 --- Comment #15 from Swamp Workflow Management 2013-02-12 09:08:58 UTC --- openSUSE-SU-2013:0277-1: An update that solves two vulnerabilities and has 15 fixes is now available. Category: security (moderate) Bug References: 741623,742504,755663,759731,764577,770056,779269,783384,783719,786677,787983,788159,790741,791183,792340,799641,800982 CVE References: CVE-2013-0213,CVE-2013-0214 Sources used: openSUSE 12.2 (src): samba-3.6.7-48.16.1, samba-doc-3.6.7-48.16.1 openSUSE 12.1 (src): samba-3.6.3-34.16.1, samba-doc-3.6.3-34.16.1 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

19 Feb 19 Feb

05:49

New subject: [Bug 783719] samba "wide links = yes" does not work after upgrade from OpenSuse 11.2

3360

Age (days ago)

4227

Last active (days ago)

List overview

Download

21 comments

1 participants

participants (1)

bugzilla_noreply＠novell.com

[Bug 783719] New: samba "wide links = yes" does not work after upgrade from OpenSuse 11.2

tags

participants (1)