CIFS - "The permissions on *** are incorrectly ordered"

[joeschmuck]

I did a search for this problem on the on the FreeNAS forum and didn't get a single hit. Hopefully someone could guide me to the right path.

I'm using CIFS in a home dedicated system, allowing Guest Access to all the files. Through Windoze I am able to create, delete, rename, and execute files just fine.

The problem: When I select the file Properties-Security tab I get the error message:
"The permissions on [filename] are incorrectly ordered, which may cause some entries to be ineffective." The file permissions shown are: Read and Special permissions. I am unable to change these.

I do not want to use Active Directory and my old NAS unit doesn't use AD but does display permissions correctly. I will futz around with it a little more to see if there is anything I can change to fix this. Any advice would be appreciated.

I am running 8r7209 at this moment.

 

[joeschmuck]

Submitted a ticket but it looks like this problem can only be fixed with ZFS V28.

 

[Thomas Haggren]

Permissions incorrectly ordered...?

Hi

After upgrade to FreeNAS 8.0.1 I get a strange error when trying to view security properties on a file located on my FreeNAS box (please see attachment). I have tried both Unix and Windows ACL with the same result.



Does anybody experience this error also?

Furthermore I get this error when copying files from my hard drive to the FreeNAS box using ROBOCOPY.



It seems like ROBOCOPY fails when copying the attributes. Maybe this error is related with the error above.

Details about my box:
FreeNAS Build: FreeNAS-8.0.1-RELEASE-amd64 (8081)
Platform: Intel(R) Core(TM)2 Duo CPU E8400 @ 3.00GHz
Memory: 5964MB
OS Version: FreeBSD 8.2-RELEASE-p3
Storage: 3 x 2TB WD in RAID-Z1
Sharing: CIFS

 

[olegsomphane]

Yes, I recall seeing a bug (http://support.freenas.org/ticket/647) stating that this will not be fixed until ZFS V28 is implemeneted.

 

[Janz]

Temp Fix to resolve Windows IOP errors (incorrectly ordered permission structure )

Submitted a ticket but it looks like this problem can only be fixed with ZFS V28.

Hi joeschmuck,

Thanks for the possible solution...

FYI for what it is worth - i have the same issues with permissions - and i HOPE they resolve this ASAP. Very unsettling to have this kind of error!
Mainly because it 'may' be OK for some who don't care - likely they only have a small amount of insignificant data on a handful of old HD's.
For myself i have all our PDF's and suchlike downloaded onto my NAS - and then via AD integrated into our domain.
(Don't think AD makes a diff at all - IMHO it is CIFS or ZFS - format of the disk and the translation to share)
But for my system that i manage - it's quite large! And very important.
Many camera recordings (training sessions and presentations), all our odd files and a massive folder of all our PC backups are all on my Freenas 1 v8.02.
So if the proverbial "stuff" hits the fan due to permissions - wow, i don't want to think of that!

In any case - for me/us using CIFS is the only way to share the folders easily.
(PS - NFS needs lots of work - and i get lots of errors about UID/GID authentication - even after trying some tweaks i found Googe'ling similar intrepid Freenas 8 users. So that's not even a plan B for us yet)

OK - my CIFS are all set to inherit permissions - and because most of the data/files came along from the early Freenas 7 days
( just the hardware upgraded and so the files just moved on up the chain)
And the folders are pretty much a rigid structure as we use them daily.
Especially in the light of mapping drives and pointing backups to specific NAS folders. (About ~15TB of data so far - a 3/4 full NAS1)

So some folders existed, some i did do a name change - and - a few were added/new.
Unfortunately i cannot recall in FN7 (freenas 7) if this "incorrectly ordered Permissions" (IOP) error was present there then?
Somehow i don't think so as i made many folders into "Windose system folders" to enable icons and folder colours etc.
That way finding folders are easier (and the eyecandy actually is useful to depict folder values)

And this is where i found Freenas 8 giving the IOP errors!

Just try setting the +S attribute or even changing the UID/GID - bang - IOS error!
And once it is there it is STUCK forever.

I tried WinSCP and Putty and such to change permissions and files recursively and all manner of ways - but naught came to fruition.

Now: Can one ignore it? I don't like that idea! Also i found browsing the folders (whilst IOP errors were present) to be very much slower!
Granted this is subjective - but as an IT Admin i can see dramatic changes versus normal "variances".
However it may be - the browsing of the gazillions of files and folders i have was pathetic to begin with.
(I thought my very basic hardware port multipliers were to blame? And Windose 7 which is notoriously laggy on network /UNC paths.)
But as i applied my fix the system has speeded up in that respect - browsing the UNC or mapped folders of the NAS is now nearly like a local drive.
So that means LOTS.
Does that relate to IOS errors? Don't know but it helps.
Even copying is faster as windows 7 is not ever so often "refreshing" (Overall small files are a sloooow pain, bigger ones average 35 ~ 45MB/s)

So here is a quick summary and "fix" to temporarily let the IOP error go away.

Root Cause:
Do not change any permissions on the NAS at all!!
Once set it matters not if you use an (S)FTP client like WinSCP or even Putty - you make a change the IOS error is back.
Mainly the main "root" folder...for files i think one can recover/alter - but i have not done a thorough testing as it was a further waste of time IMHO.
If the Folder cannot change then for me the goal of custom icons /backgrounds is not an option.

This means plan ahead - especially for AD as else it may be a schlepp later on to do the "quick fix".

Temp fix (workaround):
So how to get 15TB of files and folders all free of IOS errors???
Well, no space or handy spare NAS box's to recreate the folders and copy all the files over to! (i asked father Xmas...)
(And my backup NAS 2 is only 12TB (minus what FN8 realizes after my RAIDZ2 is created - which is another weird topic for later - incorrect space)
So the fix is simply a variation of copying all to a new NAS.
(i found i could copy an existing IOS error folder to the same NAS and the resultant "copy" had no errors at all!!)

1. So just RENAME the problem IOS folder (e.g. PC_BACKUPS becomes PC_BACKUPSzzz)
2. Then create a new folder of the "wanted/original name"
3. So we now have these two folders called "PC_BACKUPS" and "PC_BACKUPSzzz"
(Thus the new "good" folder (check it with Windows - Properties - Security) and then the old IOS error with the z's tagged on)
4. Then simply copy all the "zzz" folder contents to the new folder.
I use Teracopy - overwrite if older - it still takes LOTS of time (a week) - but it's the best i could think of.
(Rsync on FN7 was strange to me, so the FN8 "version" is a major unknown to even attempt)

Suggestion:
Do it portion by portion and check as you go along - but soon one gets the hang and then a final check of the new folder - before deleting the old!

I mention portions as that may be necessary to manage the space on an already full NAS/RAIDZ system.
But if you have lots of free space then directory per directory is no sweat.

Done!

OK - that just fixes (eyecandy?) the IOS error for the interim - so i really hope the ZFS v28 is along soon.
Any info on the roadmap and when we can expect this to be cleared up properly?

Cheers
---------------------------------------
Freenas 1 ( FN8 v8.02)
Intel Extreme i5 / 8GB RAM / 12 x 2TB SATA using 2 x Lian Li OB1 cards
600W PSU
In a wine barrel

Freenas 2 ( FN8 v8.02)
GB DH61 i3 / 8GB RAM / 12 x 1.5 TB SATA using 2 x Lian Li OB1 cards
550W PSU
Custom housing

Freenas 3 ( FN8 v8.02)
Old GB S775 C2D / 8GB RAM / 10 x 1.5 TB SATA using 2 x Lian Li OB1 cards
500W PSU
Custom housing
------------------------------------

 

[Janz]

PIO errors - confirmed and one temp fix.

Hi Thomas,

A bit late but here is perhaps some info that may help - and also to confirm it is a definite bug - not Robocopy or your side.
See my post at: http://forums.freenas.org/showthrea...he-permissions-on-***-are-incorrectly-ordered

Lets hope we get the fix soon.

Cheers

 

[rbrinson]

I am also having this exact same issue on FreeNAS 8.2 p1 x64. If there is no fix until version 8.3 which will have the new ZFS, then this really should be documented. The issue initially showed up with the Windows 7 Camera Import Wizard not able to save directly to the CIFS share, even though I could easily read, write, and delete to the share within Windows Explorer. I started a thread on the issue. Checking the Security on the Pictures folder on the share revealed this Permissions are incorrectly ordered issue. I'm going to have to plan how to work this so that I can recreate my NAS. Fortunately, I'm close enough to the beginning of things that it should hopefully not be too painful.

 

[cyberjock]

There are a ton if "little oolies" with FreeNAS. It would be very hard to document them all. There is hardware that should work on FreeNAS that doesn't along with lots of other issues. You can search through the tickets too at support.freenas.org.

Unfortunately, documenting them is difficult. Not to mention someone would be responsible for keeping that documentation up to date. The best advice I can give is that if you really want it fixed you need to do it yourself and provide the patch as a ticket so others can benefit. I'm not a programmer myself, but I've made a patch for some hardware driver fixes. There's no motivator better than someone that needs the feature to work for their setup. I'm working with one of the developers to add serial number and SMART support for 3ware controllers because it currently is broken.

 

[maglaubig]

Default ACLs do not allow editing of extended attributes for Everyone

I thought I replied to the thread, but it may have just been to rbrinson, hopefully this time I got it right. There are two issues and although they are both permissions issues, they're still separate.

Issue#1: Ordering of ACLs. If you don't want errors viewing the security tab from a Windows computer, the ACL must be in Windows order. The method to do this in 8.2 via the web GUI - open the storage view and click on Change Permissions:



Then select whatever you want for file access, just make sure to click the Windows radio button and check box to set recursively so it will apply to all existing files. If you have permissions already setup on the folder, you probably don't want to do this as it will overwrite them. Providing you have the necessary permissions to edit permissions on the file directly, changing it through Windows will work as well as the ACL will be recalculated properly when changing it.

However, it is unlikely you will be able to perform this action for the same reason that Robocopy with the /MIR switch fails, the permissions necessary to perform the actions are not there. You have the ability to create files, modify them and save over the top just fine, but cannot edit extended attributes such as a file time stamp. This the crux of the second issue.

Issue #2: The default permissions on ACLs. What appears to be granted when using the method I described above only grant the owner permissions to change time stamps, permissions, etc. If you're like I am and using anonymous access on the share, any new files are likely changed ownership to the 'root' user of the system. This is great if you've mapped access as the root user from Windows, but otherwise isn't all that great as anonymous from Windows maps over to Everyone on the ACL.

So let's change the ACL - from a SSH session:

Code:

[root@freenas] getfacl /mnt/fs01
# file: /mnt/fs01
# owner: root
# group: wheel
            group@:rwxp--a-R-c--s:fd----:allow
         everyone@:rwxp--a-R-c--s:fd----:allow
            owner@:rwxpDdaARWcCos:fd----:allow

The Everyone group doesn't have extended attributes in this pic:



To change the permissions by default, change them on the underlying location:

Code:

[root@freenas] setfacl -m group@:rwxpDdaARWcCos:fd----:allow /mnt/fs01
[root@freenas] setfacl -m everyone@:rwxpDdaARWcCos:fd----:allow /mnt/fs01

Then verify they're set correctly:

Code:

[root@freenas] getfacl /mnt/fs01
# file: /mnt/fs01
# owner: root
# group: wheel
            group@:rwxpDdaARWcCos:fd----:allow
         everyone@:rwxpDdaARWcCos:fd----:allow
            owner@:rwxpDdaARWcCos:fd----:allow

For one last verification method, look at the permissions from Windows now, Everyone should have full control:



Robocopy with the /MIR switch will work now as expected because the necessary permissions have been granted.