I am trying to move my windows shares to TrueNAS via SMB share but some of the files are read only and the copy fails with permission denied. I used the restricted preset and my group and user are both set to Full Control. Sure I can remove the read only flag and copy them but I know if I have copies that fail just because a file is set to read only then this means some people using the share are going to complain about the error or worse they are not going to have their files backed up and will risk losing their data. If I can't resolve this then I will have to go back to Windows Server for the shares. Can anyone offer a solution?
-
Important Announcement for the TrueNAS Community.
The TrueNAS Community has now been moved. This forum has become READ-ONLY for historical purposes. Please feel free to join us on the new TrueNAS Community Forums
Can't copy read only files to TrueNAS
- Thread starter tony95
- Start date
- Joined
- Jan 1, 2016
- Messages
- 9,703
How exactly are you doing that... it's probably an issue with the method, not the share.
I doubt it. All the other files copy fine. I am just copying from the windows share to the TrueNAS share. Even if I copy to my local hard drive and try to copy to the TrueNAS share it gives me the same error "you need permission to perform this action".
- Joined
- Jan 1, 2016
- Messages
- 9,703
Not sure what you are asking then. Right click copy then right click paste? Drag drop from my hard drive to the SMB share on TrueNAS, same difference I believe?
winnielinnie
MVP
- Joined
- Oct 22, 2019
- Messages
- 3,641
"Read-only" files that are saved locally on your Windows drive cannot be copied to the SMB network share? Yet they can be copied to another local folder on the Windows drive?
What about trying to copy said files to a different external drive?
What about trying to copy said files to a different external drive?
- Joined
- Mar 6, 2014
- Messages
- 9,554
There was a bug regarding copies of local readonly files (DOS bit) that had alternate data streams present. Scheduled to be fixed in 13.1 / 23.10.2 / 24.04-RC1.
winnielinnie
MVP
- Joined
- Oct 22, 2019
- Messages
- 3,641
Is it possible to bypass this in the meantime if you disable Alternate Data Streams in the SMB share's configuration?
Yes, they can be copied anywhere but the TrueNAS share. It is very strange. I can mark another file on my PC read only and copy it to the TrueNAS share no problem. But the files on the old Windows Share that were read only won't copy until I remove the read only flag. So I have a png that already exists on my PC and if I mark it read only it copies to the TrueNAS share without a problem, but the file that was previously on the old Windows Share won't copy to TrueNAS until I remove the read only flag. This is bizarre because looking at the security permissions and owner on the two file they appear to be identical.
- Joined
- Mar 6, 2014
- Messages
- 9,554
It's because of the way that the files are opened. The client requests to
1. open a file
2. set it read-only
3. write data
4. alternate data streams
3. succeeds because we re-use same file open file descriptor.
4 fails in 13.0 (Samba 4.15) because we open new fd (which forces evaluation of readonly bit at that point) and in later versions because of internal ZFS permission check on xattr writes.
- Joined
- Mar 6, 2014
- Messages
- 9,554
Yes, and then you lose information because you're stripping alternate data streams.
Hmmm, I had to recreate the share to do this. I don't think this is the best way to handle it. These PNG file might be rare cases and most users here probably aren't going to have an issue. I am wondering if they were created on a MAC which would be rare since no computer in the office is a MAC and it would have probably come from outside. Since I can copy a read only file from my own computer then maybe this issue will never come up again.
- Joined
- Mar 6, 2014
- Messages
- 9,554
Typically windows clients will store zone identifier information. MacOS clients can store mac equivalent of that, finder color tags, preview images, etc, etc.
[MS-FSCC]: Zone.Identifier Stream Name
Windows Internet Explorer uses the stream name Zone.Identifier for storage of URL security zones. The fully qualified
learn.microsoft.com
I just went to the windows share and removed all the read only flags. If it is not a problem with read only in general then it probably won't affect anyone. Like I said, I can copy read only files that were created on my PC without an issue. I guess we will see over time.Typically windows clients will store zone identifier information. MacOS clients can store mac equivalent of that, finder color tags, preview images, etc, etc.
[MS-FSCC]: Zone.Identifier Stream Name
Windows Internet Explorer uses the stream name Zone.Identifier for storage of URL security zones. The fully qualifiedlearn.microsoft.com
- Joined
- Jan 1, 2016
- Messages
- 9,703
I see we probably got to the bottom of the issue here already, but for future reference, there are many ways to "copy" a file, one is via windows (the way or ways you were using), others are things like file sync apps, robocopy, rsync or other command line tools... which can make a big difference depending on which one you use and what settings you're using for them.
- Joined
- Mar 6, 2014
- Messages
- 9,554
That's correct. As I mentioned above, it's very much about order of operations for this. For example, if the client creates the file, writes data, writes ADS, and then sets readonly it wouldn't be a problem. In this case what is actually required from an SMB server is basically not documented by MS, but we fixed our SMB server to do the same as Windows (just have to wait for update / new version or work around it).
winnielinnie
MVP
- Joined
- Oct 22, 2019
- Messages
- 3,641
In Windows PowerShell, you can use "Get-Item" to see if a file has an alternate data stream (anything other than
If you see something like this:
Then you can view this alternate data stream's contents with "Get-Content" like so:
You might find such information to be pointless, thus giving you the peace of mind that you don't need to preserve it.
$DATA):Code:
Get-Item filename.txt -Stream *
If you see something like this:
PSChildName : filename.txt:Something.WhateverThen you can view this alternate data stream's contents with "Get-Content" like so:
Code:
Get-Content filename.txt -Stream Something.Whatever
You might find such information to be pointless, thus giving you the peace of mind that you don't need to preserve it.
