samba 4.5.0 on hpux ia64:- permission denied error for the share.

[Arjit Gupta]

Hello Uri,

On debugging further i observer the below difference when run with and
without acl

*with-acl:*

 sd: struct security_descriptor

  dacl                     : *

              dacl: struct security_acl

                ..

                  aces: struct security_ace

                     ..

                      *access_mask              : 0x00000000 (0)*



*without-acl:*

sd: struct security_descriptor

  dacl                     : *

              dacl: struct security_acl

                ..

                  aces: struct security_ace

                      ..

                      *access_mask              : 0x001f01ff (2032127)*


Rest other fields are same in both scenarios.
Please suggest how could i debug further in the same direction.

Arjit Kumar

On Thu, Nov 24, 2016 at 1:11 AM, Uri Simchoni <uri at samba.org> wrote:

> On 11/23/2016 01:15 PM, Arjit Gupta wrote:
> > Hello Uri,
> >
> > After using --without-acl-support in configure we are able to access
> share
> > with normal user.
> > Please help us understand the impact of disabling acl feature in samba.
> >
> > Arjit Kumar
> >
>
> For a file server, you need ACL support if either of the following is true:
> - You use POSIX acls on your system - users define ACLs on individual
> files and folders to control access to them and allow sharing (e.g.
> using getfacl/setfacl tool). The files are also being accessed by other
> means than Samba, and Samba needs to play along.
> - Your users use the security tab to manage file/folder permissions -
> POXIS ACLs are one way to support this partially (but in a way that let
> the kernel enforce the ACLs and hence affect any use of the files, not
> just via SMB)
>
> I really don't know what went wrong with the ACL support. While the
> configure process doesn't include tests for HPUX ACLs, I would imagine
> that the build would fail if headers or libraries were missing. With no
> access to an HP-UX system and documentation I can't see how I can be of
> help.
>
> Uri.
>