[Samba] Issues with print command group membership

[John W]

Oh, I should have specified: This is Samba 3.6.13, on FreeBSD 9.1-RELEASE.

-John

On 8/7/13, John W <jwdevel at gmail.com> wrote:
> Hi,
>
> I have a Samba print share set up, with a "print command" specified
> that just cats the file to /dev/ulpt0. This share is accessed by the
> guest Samba account, which I have set to be the 'smbguest' username.
>
> I can manually run the print command as root, and the file prints.
> I can manually run the print command as 'smbguest' (through sudo) and
> the file prints.
>
> However, when run the command through Samba itself (by printing over
> the network from another machine), I get:
>
>     cannot create /dev/ulpt0: Permission denied
>
> This is the same message I would get if I don't have write permissions
> to the device.
> The device itself has the following permissions:
>
>     $ ls -l /dev/ulpt*
>     crw-rw----  1 root  print    0, 142 Aug  5 22:31 /dev/ulpt0
>
> The 'smbguest' account is in the 'print' group, as evidenced below:
>
>     $ groups smbguest
>     smbguest smbguestgroup print
>
> so it should be able to write to ulpt0. In fact, it can, when the
> command is run through sudo -u smbguest ...
>
> However, when the Samba 'print command' itself is run, the group
> membership *only* includes the 'smbguest' group. I altered the print
> command to write a log message including the output of `groups`, and
> it writes merely 'smbguest', rather than the above three groups.
>
> Is there a general explanation for this, or is this just some weird
> Samba idiosyncrasy? I would expect, since Samba is running the command
> as the user 'smbguest', that it would have full group membership, but
> all my evidence points to that not being the case.
>
> Or maybe there is something more fundamental I'm missing?
>
> I have also tried using 'force group = print', but that does not seem
> to have any effect for me. I was following the advice from this post:
> http://askubuntu.com/questions/251536/samba-guest-account-not-in-group
>
> Is it a bug?
> Something I don't understand?
>
> Any help would be appreciated, thanks.
> -John
>