Question on streams dir structure creation.

[Hemanth Thummala]

I have actually found the root cause for server creating the lost-xxxx folders on stream file deletion.
In streams_depot_unlink(), after deleting the base file we are trying to get the stream directory(16-byte-string) to delete the same. But in stream_dir(), if the stat for streams directory path(.streams/XX/YY/(16-byte-string) exists, we are checking if the file is valid(by validating the SAMBA_STREAMS EA). This will obviously fail as the file itself is deleted. As a result, samba thinks that this is the case of where file is recreated using same inode and tried to restore the streams directory by renaming it to lost-xxxx folder which starts appearing on the share root.

In streams_depot_unlink():
    …

  ret = SMB_VFS_NEXT_UNLINK(handle, smb_fname);

  if (ret == 0) {

      Char *dirname = stream_dir(handle, smb_fname_base,

                                 &smb_fname_base->st, false);

   …

  }

In stream_dir():
   if (SMB_VFS_NEXT_STAT(handle, smb_fname_hash) == 0) {
  …
   if (!check_valid ||
       file_is_valid(handle, smb_fname->base_name)) { ==> This check fails after base file deletion.
  …
  *Delete lost handling*

Issue is pretty straight forward to reproduce. Create a an alternate data stream file and delete it.

I have made changes to mark the STAT status as invalid and check for valid stat status before doing file_is_valid().
Another solution I have thought about is handling getxattr error code in file_is_valid(). We should always treat “NO SUCH ATTRIBUTE” as false condition. But being skeptical about the consistency of the error code from different FS.

I am sure that there can be multiple ways to address this issue. Please suggest if there is a better way to fix.

Thanks,
Hemanth.

From: Hemanth Thummala <hemanth.thummala at nutanix.com<mailto:hemanth.thummala at nutanix.com>>
Date: Tuesday, October 18, 2016 at 5:22 PM
To: "samba-technical at lists.samba.org<mailto:samba-technical at lists.samba.org>" <samba-technical at lists.samba.org<mailto:samba-technical at lists.samba.org>>
Subject: Re: Question on streams dir structure creation.

In vfs_mkdir(), I see that mode will be overwritten with (0777 & lp_directory_mask(SNUM(handle->conn)) when the inherit acls set to true and the parent dirname has DACL. In our case,  “.streams”  never inherit NTACLs on creation. And the default or dummy security descriptor doesn’t have DACL. Not sure if this check is expected to passed for the stream directories.

Another issue that I have observed is that when a file with alternate data stream gets deleted, the corresponding stream file in (.streams/XX/XX/(16-byte-hash-fid)/:stream-X) is getting deleted(only the last component) without  deleting the 16 byte hash fid directory. This is causing issue in the delete work flow. When the create with DELETE access is requested, we walk through the streams to see if there are any open streams. While walking through the streams, in stream_dir() we construct the stream dir path components (.streams/XX/XX/(16-byte-hash-fid)) and stat the path. Since the last component is not deleted, we assume the case that it is the case file getting recreated with the same inode and take an action to restore this folder by renaming to lost-xxxxx folder.

But clearly its not the case of file creation using same inode. Shouldn’t we have this stat check only if argument “create_it” is set?
Ideally all_streams should take care of deleting the 16-byte-id stream component after successful unlink of all alternate streams. Is there any specific reason for not deleting it ?

Thanks,
Hemanth.
From: Hemanth Thummala <hemanth.thummala at nutanix.com<mailto:hemanth.thummala at nutanix.com>>
Date: Tuesday, October 18, 2016 at 11:46 AM
To: "samba-technical at lists.samba.org<mailto:samba-technical at lists.samba.org>" <samba-technical at lists.samba.org<mailto:samba-technical at lists.samba.org>>
Subject: Question on streams dir structure creation.

Hello All,

I see that in stream_dir(),  mode “0755” is explicitly used to create the streams two level directory structure(ex: .streams/AB/CF/<16-byte-fileid>.


"SMB_VFS_NEXT_MKDIR(handle, tmp_fname, 0755)"


This works fine when the first use coming in creating a stream file. Internal stream directory structure is getting created by this user id. And he becomes the owner of the entire stream dir path.

But we are seeing the permissions issue when second user is trying to create the final streams directory(16-byte string). Mkdir is failing with permission denied error. This is due the fact that second user falls into group or others unix group for which there is no write access. I would like to know if using this 755 mode is intentional for streams directory structure for some reason.

Please let me know.

Thanks,
Hemanth.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Prevent-checking-stream-status-when-the-base-file-is.patch
Type: application/octet-stream
Size: 1749 bytes
Desc: 0001-Prevent-checking-stream-status-when-the-base-file-is.patch
URL: <http://lists.samba.org/pipermail/samba-technical/attachments/20161019/5149fc29/0001-Prevent-checking-stream-status-when-the-base-file-is.obj>