From: "Aurélien Aptel" <aaptel@suse.com>
To: L Walsh <cifs@tlinx.org>, linux-cifs <linux-cifs@vger.kernel.org>
Subject: Re: multiuser access and group membership(s)
Date: Wed, 14 Apr 2021 11:19:30 +0200 [thread overview]
Message-ID: <87wnt51avx.fsf@suse.com> (raw)
In-Reply-To: <6075ED6A.6010603@tlinx.org>
Hi,
> Surprises:
>
> * Files owned by local accounts appeared to be owned
> by 'root:root'.
When cifs.ko fails to resolve sid<=>uid/gid mapping it defaults to
root:root.
> * Files in well-known-groups, seemed to
> resolve ok, but didn't recognize my domain login as
> being in one of those groups.
Make sure you have cifsacl along with multiuser. In my testing
(multiuser with kerberos) I can see domain accounts resolve fine. Not
sure about local accounts.
Keep in mind cifs.ko is delegating the work of resolving to winbind. So
I would suggest trying resolving the things that don't seem to work
directly with the wbinfo utility (see --sid-to-uid, --sid-to-fullname
etc). My guess is it won't work either but it could be easier to debug
from that end.
> * Files with group ownership of Administrators allowed access
> regardless of permission bits (though I am in Administrators group).
> -However, files owned (showing in UID) field AdministratorsGroup
> showed up as being owned by 'root' from the linux machine and
> didn't enable access (though some other rule might).
cifsacl mount option will also enable mapping mode bits to ACL but in a
best-effort manner as a 1:1 mapping is unfortunately impossible. It is
not very reliable and we also have no tests to check those mappings :(
I think Shyam worked on this recently, maybe he can comment.
Cheers,
--
Aurélien Aptel / SUSE Labs Samba Team
GPG: 1839 CB5F 9F5B FB9B AA97 8C99 03C8 A49B 521B D5D3
SUSE Software Solutions Germany GmbH, Maxfeldstr. 5, 90409 Nürnberg, DE
GF: Felix Imendörffer, Mary Higgins, Sri Rasiah HRB 247165 (AG München)
prev parent reply other threads:[~2021-04-14 9:21 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-13 19:13 multiuser access and group membership(s) L Walsh
2021-04-14 9:19 ` Aurélien Aptel [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87wnt51avx.fsf@suse.com \
--to=aaptel@suse.com \
--cc=cifs@tlinx.org \
--cc=linux-cifs@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).