[Samba] permission denied with windows acls

[Peter Carlson]

On 1/26/24 02:35, Rowland Penny via samba wrote:
> On Thu, 25 Jan 2024 18:45:52 -0800
> Peter Carlson via samba<samba at lists.samba.org>  wrote:
>
>> I am getting a permission denied when trying to ls as a domain user a
>> samba mount with windows ACLs (sigh I thought I had this figured
>> out). I tried to include self descriptive server names and include
>> them in the info below (fs1: file server, nc: addc, u2gui: ubuntu
>> desktop)
>>
>>      CARLSON\peter at u2gui:~$ ls -l /mnt
>>      ls: cannot access '/mnt/test': Permission denied
>>      total 0
>>      d????????? ? ? ? ?            ? test
>>
>> I followed the wiki
>> here:https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs  
>> ... well at least I think I did.
>>
>>
>> CARLSON\peter at fs1:/data$ getfacl test
>>
>>      # file: test
>>      # owner: root
>>      # group: CARLSON\\videousers
> Where on the wiki page does it say to use 'videousers' as the group ?

So the wiki is not clear.  It uses the terms: "for instance"

Select a user or group from the list, Domain Users **for instance**.
Select permissions to grant, Full control **for instance**.

This leaves the impression that it can be something else.  If it needs 
to be Domain Users / Admins that should be stated as such. It would also 
be helpful in the wiki to show the full permissions that are suggested 
for the share, perhaps using the advanced view: 
https://pasteboard.co/m6j9vYkRkt3q.png

In any case I redid the share and set it as shown in the paste. I tested 
access both through windows and gio mount.

>> The share mounts and I am a member of the correct groups
>>
>>      CARLSON\peter at u2gui:~$ cat /etc/fstab
>>      //fs.carlson.lab/test /mnt/test cifs
>>      credentials=/root/smbcreds,multiuser,sec=ntlmssp,_netdev 0 0
> I think that could be part of your problem, even though you are using
> 'multiuser', you are mounting as root. try reading 'man mount.cifs' and
> pay particular attention to 'sec=krb5' and 'multiuser', that way you
> will not require a password.
>
> Rowland
>
I thought that the multiuser mount could be made with ntlmssp as well 
using a creds file, however I will go and set it up using krb and then 
report back