[Samba] uid mismatch

[Rowland penny]

On 15/01/2020 13:46, Meike Stone via samba wrote:
> Hello dear list,
>
> I use samba and it is working fine.
>
> But I have two questions:
>
> 1) my logging configuration is:
>
>            vfs objects = extd_audit
>            debug uid = yes
>            debug pid = yes
>            debug class = yes
>            log level = 0 vfs:2
>            syslog = 0
>            max log size = 1024
>            log file = /var/log/samba/users/%U.log
>
>
> If I look in one users logfile, I see different UIDs in it, example:
>
> [2020/01/10 09:59:11.498881,  0, pid=37872, effective(50465, 100),
> real(50465, 0), class=extd_audit]
> ../source3/modules/vfs_extd_audit.c:268(audit_unlink)
>    vfs_extd_audit: unlink HOME/SWE/KA/B377F354.tmp
> [2020/01/10 09:59:15.086266,  0, pid=37872, effective(50465, 100),
> real(50465, 0), class=extd_audit]
> ../source3/modules/vfs_extd_audit.c:268(audit_unlink)
>    vfs_extd_audit: unlink HOME/SWE/KA/~$20200106_excel-1.xlsx
> [2020/01/10 10:25:54.226794,  0, pid=37872, effective(50251, 100),
> real(50251, 0), class=extd_audit]
> ../source3/modules/vfs_extd_audit.c:268(audit_unlink)
>    vfs_extd_audit: unlink KLW/CN/2019_11/~$excel-2.xlsx
> [2020/01/10 10:26:21.292172,  0, pid=37872, effective(29321, 100),
> real(29321, 0), class=extd_audit]
> ../source3/modules/vfs_extd_audit.c:268(audit_unlink)
>    vfs_extd_audit: unlink HOME/privat/doc-1.docx
> [2020/01/10 10:26:21.991164,  0, pid=37872, effective(29321, 100),
> real(29321, 0), class=extd_audit]
> ../source3/modules/vfs_extd_audit.c:268(audit_unlink)
>    vfs_extd_audit: unlink HOME/privat/677F2835.tmp
>
>
> Only the UID "50465" belongs to the real user.
> Shouldn't the other lines not be included in the user log files the
> belongs to the uid that are shown (above in the example?)
>
> 2) One share configuration looks like:
>
> [KLW]
>          path = /data/users_linkroot/%U
>          writeable = yes
>          browseable = no
>          nt acl support = no
>          inherit permissions = yes
>          store dos attributes = yes
>          csc policy = disable
>
> In this configuration (links inside of /data/users_linkroot/%U, and
> file rights managed outiside from samba), the user who maps the share
> KWL, is accessing the path /data/users_linkroot/<username>
>
> But if I look with smbstatus for one "Sharepath", so is seems, more
> than one uid accessing there.
>
> smbstatus -L | awk '{print $1"\t"$2"\t"$7}' | egrep '(awisil|Pid)'
>       Pid      Uid        SharePath
>       45413   51520   /data/users_linkroot/awisil
>       45413   51520   /data/users_linkroot/awisil
>       39644   51365   /data/users_linkroot/awisil
>       39644   51365   /data/users_linkroot/awisil
>       45413   51520   /data/users_linkroot/awisil
>
> How can this be?
>
> In operation, until now we had no complaints from users. It seems,
> everything is working fine.
>
> Can anybody help?
>
> Thanks Meike
>
Can you post your entire smb.conf.

Rowland