get_nt_acl_internal: blob hash does not match for file XXX - returning file system SD mapping (after new UID and GID range introduced).
parthasarathi.bl at gmail.com
Thu Sep 17 23:09:34 UTC 2015
We are facing an idmap migration issue in AD member server (SAMBA 4.1.17).
After I modified the idmap settings to support the Trusted Domain support,
I started hitting the this access_denied permission issue.
Before Trusted domain support I had the below idmap settings
idmap config *: backend = rid #RID based
idmap config *: range = 10000000-19999999
To support trusted Domains support I replaced it with below settings
allow trusted domains = yes
idmap config *: backend = autorid #AUTORRID based
idmap config *: range = 10000000-2020000000
idmap config *: rangesize = 100000000
Note: Also I had the following unix mask and mode settings for every share
before and after trusted domain support.
directory mask = 2777
force directory mode = 2777
create mask = 2777
force create mode = 2777
After the above idmap changes the AD users does not able to access their
existing files/folders and they get ACCESS_DENIED as the samba returning
UNIX BASED ACLs (S-1-22-2-10000513).
get_nt_acl_internal: blob hash does not match for file
Transaction2k/VIM_UMDB - returning file system SD mapping.
[2015/09/16 13:18:37.056160, 10, pid=27358, effective(110000500,
110000513), real(110000500, 0), class=vfs]
get_nt_acl_internal: acl for blob hash for Transaction2k/VIM_UMDB is:
[2015/09/16 13:18:37.056172, 1, pid=27358, effective(110000500,
110000513), real(110000500, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug)
pdesc_next: struct security_descriptor
revision : SECURITY_DESCRIPTOR_REVISION_1 (1)
type : 0x9004 (36868)
owner_sid : *
owner_sid : S-1-22-1-10000500
group_sid : *
group_sid : S-1-22-2-10000513
sacl : NULL
dacl : *
[2015/09/16 13:18:37.066720, 5, pid=27358, effective(110000500,
110000513), real(110000500, 0)]
check_parent_access: access check on directory Transaction2k/VIM_UMDB for
for mask 0x2 returned (0x2) NT_STATUS_ACCESS_DENIED
The above issue will go away when I keep back the previous UID and GID
Since the files and folders were created with 777 unix mask and mode, I
expected the new range of UID and GID should not cause any issue. If my
understanding is wrong could you please let me know whats the correct
procedure to support new UID and GID range for the existing files/folder
which are created with previous UID and GID range.
Thanks & Regards
More information about the samba-technical