[Samba] zfs acls and MS office applications

[Gaiseric Vandal]

I ran into the following two related problems with samba 3.0.xx and 
Solaris 10 and ZFS

1.  With Word, Excel or PowerPoint 2003 you could save the document 
maybe 4 times but on the 5th time you wouldn't be able to save the file 
-  or worse it would disappear.

The issue seemed to be that for the first 4 saves, the MS App would 
merely modify the document.  But with the 5th save it writes the 
document out in full to a new file and deletes the old.    Also, rather 
than allowing the new file to just inherit file permissions, the app 
will explicitly set the ACE's.   Visual Studio does this as well.


ZFS inheritance is ignored if Windows inheritance is used.



2.  On unix level, you might "chmod 770 somefile" to allow anyone in the 
group to access the file.     "Other" is not explicitly permitted but 
not explictly denied.   So the in effect "everyone else" does not have 
access.

But in Windows, this "other is not explicitly" permitted can be 
interpreted as "everyone is explicitly denied."    Something similar can 
happen with group perms.   Although supposedly the correct ACE ordering 
shd have avoided this.

Nt.

I used the samba packages bundled with Solaris.   They have the zfs 
module backported from newer samba versions.  If I compiled Samba 3.0.x 
from scratch I did not get zfs support and the winbind functionality was 
broken.

However, Sun doesn't do a great job of documenting any of this.




On 10/20/09 22:01, Tom Lieuallen wrote:
>
> I'm trying to use zfs acls in solaris 10.  I've looked at past posts 
> regarding this and some online help, but am stuck.  I'm currently 
> using samba 3.3.9; I've had the same problem with 3.3.7.  samba is 
> compiled and running as an Active Directory member server (compiled 
> with ldap and kerberos).  The zfs disk is local.  I'm not using 
> winbind.  I compiled with zfsacl module.
>
> Permissions appear just fine in solaris.  Plus I can read/write with 
> notepad and use other applications such as acrobat.  However, 
> Microsoft Office 2007 won't open or save files.  I haven't tried other 
> versions of Office; they're not handy.
>
> The following is the configuration for the share:
>
> [testzfs]
>     comment  = test
>     path     = /moe2
>     browseable = true
>     public   = false
>     writable = true
>     inherit permissions = yes
>     acl check permissions = False
>     vfs objects = zfsacl
>     inherit acls = yes
>     nfs4: mode = simple
>     nfs4: acedup = merge
>     zfsacl: acesort = dontcare
>     map archive = no
>     map hidden = no
>     map read only = no
>     map system = no
>
> The zfs permissions I'm testing look like this.  This is for the 
> parent directory; files within have the same permissions (sans the 
> inheritance).
>
>
> moe-lh /moe2/office/student_workers 546# ls -vd .
> drwxrws---+  2 toml     cefac          5 Oct 20 18:36 ./
>      0:group:cefac:list_directory/read_data/add_file/write_data
>          
> /add_subdirectory/append_data/write_xattr/execute/write_attributes
>          
> /write_acl/write_owner:file_inherit/dir_inherit/inherit_only:allow
>      1:group:cefac:list_directory/read_data/add_file/write_data
>          
> /add_subdirectory/append_data/write_xattr/execute/write_attributes
>          /write_acl/write_owner:allow
>      2:group:ceoffstu:list_directory/read_data/add_file/write_data
>          
> /add_subdirectory/append_data/write_xattr/execute/write_attributes
>          
> /write_acl/write_owner:file_inherit/dir_inherit/inherit_only:allow
>      3:group:ceoffstu:list_directory/read_data/add_file/write_data
>          
> /add_subdirectory/append_data/write_xattr/execute/write_attributes
>          /write_acl/write_owner:allow
>      4:group:ceoffstu:list_directory/read_data/add_file/write_data
>          
> /add_subdirectory/append_data/write_xattr/execute/write_attributes
>          /write_acl/write_owner:allow
>      5:owner@::deny
>      
> 6:owner@:list_directory/read_data/add_file/write_data/add_subdirectory
>          /append_data/write_xattr/execute/write_attributes/write_acl
>          /write_owner:allow
>      7:group@::deny
>      
> 8:group@:list_directory/read_data/add_file/write_data/add_subdirectory
>          /append_data/execute:allow
>      9:everyone@:list_directory/read_data/add_file/write_data
>          
> /add_subdirectory/append_data/write_xattr/execute/write_attributes
>          /write_acl/write_owner:deny
>      10:everyone@:read_xattr/read_attributes/read_acl/synchronize:allow
>
>
> thank you
>
> Tom Lieuallen
> Oregon State University