GNOME Bugzilla – Bug 752067
smb backend does not support ACL
Last modified: 2015-07-21 11:51:16 UTC
Looks like the SMB backend does not support ACL rules while accessing remote shares. The scenario looks like this: 1. LDAP authentication for client & server. 2. SMB server with a share accessible to a certain ACL group or user. 3. A user (that should be allowed to access the share: is a member of the group or is an ACL user) accesses the share from a client using nautilus and smb:// URI. Expected result: Access is granted to the resource. Actual result: Permission denied for accessing the resource in question.
Thanks for the report. Can you clarify whether it is possible to access the share at all or whether it is only a particular resource within the share? To get full debug output, please run the following in a terminal: pkill gvfs; GVFS_DEBUG=all GVFS_SMB_DEBUG=10 `find /usr/lib* -name 'gvfsd'` &> ~/log.txt Then attempt to mount the smb share, and upload log.txt in your home directory so we can see a log of what is happening. Thanks
Created attachment 307396 [details] log from mounting the share and trying to access the directories It is possible to access other resources in the share, except for those with ACL rules set. Please find the log attached. To give you some context: the user account I used in this case is user128. I have created 3 resources in the share: dir1 - accessible to all dir2 - with u:user128:rwx ACL rule set dir3 - with g:miners:rwx ACL rule set (user128 is in the group 'miners') Dir1 can be accessed without any issues, accessing dir2 or dir3 ends up with 'permission denied' message.
As can be seen from the log, libsmbclient gives NT_STATUS_ACCESS_DENIED when trying to access dir2 and dir3. It looks like this bug lies within libsmbclient, which GVFS uses for accessing smb shares. Please raise a bug with the Samba project at https://bugzilla.samba.org/ Thanks
It will probably be helpful to attach the above log onto the Samba bug.
(In reply to Ross Lagerwall from comment #3) > As can be seen from the log, libsmbclient gives NT_STATUS_ACCESS_DENIED when > trying to access dir2 and dir3. It looks like this bug lies within > libsmbclient, which GVFS uses for accessing smb shares. Please raise a bug > with the Samba project at https://bugzilla.samba.org/ It seems the log is from smb backend before commit a0aec32. I haven't investigated the code a lot, but I have just idea. Doesn't mean the following debug message that anonymous pass is used? ### SMB: auth_callback - anonymous pass Consequently enumeration on the dir2 and dir3 fails from the obvious reason...
Thank you Ondrej. I have tried applying this patch, but despite the change in the log: ### SMB: auth_callback - kerberos pass ### SMB: auth_callback - out: last_user = 'user128', last_domain = 'WORKGROUP' the outcome is still: smbc errno NT_STATUS_ACCESS_DENIED -> 13 I will file a bug against samba. Thank you.