- Joined
- Mar 6, 2014
- Messages
- 9,553
The simple fact of the matter is that Windows permissions are more complex than Unix permissions. Windows servers have multiple layers of permissions representing different legacy and current ways of manipulating access controls to shares. These layers include DOS attributes, share permissions (from the days of Windows NT), and NTFS access control lists (ACLs).
DOS attributes consist of 'Read-only, Hidden, System, and Archive', and are visible in Windows if you right-click on a file or folder and hit 'properties'. As is implied in their name, these attributes are from the good old days of DOS. Samba has two different ways of dealing with them. By default and when not configured as an AD domain controller (when an AD DC samba will automatically store DOS attributes as filesystem extended attributes) samba uses the "map" parameters mentioned in the smb.conf manpage. The "map*" parameters work by manipulating the unix file permissions in the following ways:
Alternatively, samba can store this information in EAs and SECDESCs. This is the way I believe that samba development is headed. Comments in the samba source regarding the "map *" parameters say things like:
Unfortunately, extended attributes are sometimes treated like second class citizens. Extended attribute operations appear to be quite slow on FreeBSD 9.x, and every time that you open a directory samba will retrieve the user.DOSATTRIB extended attribute of every file and folder in that directory. This results in very slow uncached browsing via Windows explorer.
One solution to this problem is to prevent samba from storing DOS modes. The way to do this is to add the following "auxiliary parameters" to "Services" -> "CIFS"
Unfortunately, your work is not done, as the O'Reilly book on samba notes,
Once you have enabled this parameters, you should use Explorer on a windows client to remove the "special permission" Write attributes by right-clicking on your share, then clicking on "properties" --> "security" --> "advanced" --> "edit" and unchecking the aforementioned permission. This will prevent network scanners and programs that want to write DOS attributes from randomly puking on themselves and your file server (corrupting files during writes and otherwise failing in inexplicable ways).
DOS attributes consist of 'Read-only, Hidden, System, and Archive', and are visible in Windows if you right-click on a file or folder and hit 'properties'. As is implied in their name, these attributes are from the good old days of DOS. Samba has two different ways of dealing with them. By default and when not configured as an AD domain controller (when an AD DC samba will automatically store DOS attributes as filesystem extended attributes) samba uses the "map" parameters mentioned in the smb.conf manpage. The "map*" parameters work by manipulating the unix file permissions in the following ways:
The above operations are carried out through chmod. Unfortunately, this has a tendency to mess up ZFS access control lists (ACLs), where the execute bit serves a different purpose (specifically, it maps to the NTFS permission "traverse folder / execute file"). Additionally, since FreeBSD 9.2.1.6 the zfs aclmode is set to "restricted" on CIFS shares with ACL type set to "windows". The "restricted" aclmode prevents people from nuking their ACEs through a drive-by chmod. It also prevents the "map *" parameters from working. Simply put, the "map *" parameters are a no-go if you're using windows ACLs.
Alternatively, samba can store this information in EAs and SECDESCs. This is the way I believe that samba development is headed. Comments in the samba source regarding the "map *" parameters say things like:
Which makes sense because extended attributes (sometimes abbreveated "EA" or "XATTR") are able to store much more information than just these DOS modes. For instance, samba also stores create time in the DOSATTRIB EA. Extended attributes are necessary for the vfs_streams_xattr module, which provides compatibility with NTFS alternate datastreams (user.DosStream). Filesystem xattrs are important because they allow storing more information than would normally be possible with nfsv4 ACLs.
Unfortunately, extended attributes are sometimes treated like second class citizens. Extended attribute operations appear to be quite slow on FreeBSD 9.x, and every time that you open a directory samba will retrieve the user.DOSATTRIB extended attribute of every file and folder in that directory. This results in very slow uncached browsing via Windows explorer.
One solution to this problem is to prevent samba from storing DOS modes. The way to do this is to add the following "auxiliary parameters" to "Services" -> "CIFS"
Code:
store dos attributes = no ea support = no map archive = no map hidden = no map system = no map readonly = no
Unfortunately, your work is not done, as the O'Reilly book on samba notes,
My experience is that this warning still applies, but there is a way to notify programs that DOS attributes cannot be set.
Once you have enabled this parameters, you should use Explorer on a windows client to remove the "special permission" Write attributes by right-clicking on your share, then clicking on "properties" --> "security" --> "advanced" --> "edit" and unchecking the aforementioned permission. This will prevent network scanners and programs that want to write DOS attributes from randomly puking on themselves and your file server (corrupting files during writes and otherwise failing in inexplicable ways).
Last edited:
