[Samba] samba-tool ntacl sysvolreset - NT_STATUS_BUFFER_TOO_SMALL

[Jonathan Hunter]

OK, I've traced this a little further on now.

I think I have followed the trail via the following items that call or
refer to each other in turn:
- python samba-tool ntacl sysvolreset
- source3/smbd/pysmbd.c: SMB_VFS_FSET_NT_ACL( fsp, security_info_sent, sd);
- source3/include/vfs_macros.h:#define SMB_VFS_FSET_NT_ACL
smb_vfs_call_fset_nt_acl
- source3/smbd/vfs.c:NTSTATUS smb_vfs_call_fset_nt_acl [which calls
fset_nt_acl_fn]
- source3/modules/vfs_acl_xattr.c: .fset_nt_acl_fn = fset_nt_acl_common
- source3/modules/vfs_acl_common.c:static NTSTATUS fset_nt_acl_common
- source3/modules/vfs_acl_common.c: parse_acl_blob() [which seems to
be where the error occurs]

However it appears that I'm now trying to debug the VFS modules in
Samba, which isn't quite where I thought I would end up when I started
looking into this error :)

I've found a couple of Python debugger tools, which got me out of the
python samba-tool code and into the Samba source3/modules/vfs* code..
but just as I had never debugged python before, I've also never
debugged any Samba C code before. Does anyone have any tips or
guidance as to how I can further find out which part of
parse_acl_blob() is failing and why it is returning
NT_STATUS_BUFFER_TOO_SMALL? I have a feeling it is something to do
with the ndr_pull_error shown in the level 10 trace above.. but I'm
quite far down the rabbit hole here and at this stage don't know what
NDR pull errors would be, or what I'd need to do to find them.

How do I confirm which of the many VFS modules I am using in my
installation - I expect it is probably vfs_acl_xattr but can I confirm
somehow? I am running ext4 and have nothing set in smb.conf, I've
never consciously set any VFS settings.

And are there any tips on how to debug this part of the code? It's on
a running DC so I don't want to do anything too major.. but can
perhaps I recompile vfs_acl_xattr to add some printf() statements in
key places and have this patched version called by the python
samba-tool code somehow?

Any pointers appreciated, I do want to get my samba-tool ntacl
sysvolreset working again as it's causing issues :(

Jonathan

On 11 September 2016 at 22:55, Jonathan Hunter <jmhunter1 at gmail.com> wrote:
> user at dc2:~ $ sudo /usr/local/samba/bin/samba-tool ntacl sysvolreset
> set_nt_acl_no_snum: fset_nt_acl returned NT_STATUS_BUFFER_TOO_SMALL.
> ERROR(runtime): uncaught exception - (-1073741789, 'Buffer too small')
> [...]
>   File "/usr/local/samba/lib/python2.7/site-packages/samba/ntacls.py", line
> 162, in setntacl
>     smbd.set_nt_acl(file, security.SECINFO_OWNER | security.SECINFO_GROUP |
> security.SECINFO_DACL | security.SECINFO_SACL, sd, service=service)
>
> I'm not really sure what might be causing this.. I have a '-d10' trace, and
> the last section before the exception is as follows:
>
> et_nt_acl_internal:
> name=/usr/local/samba/var/locks/sysvol/mydomain.org.uk/Policies/{11111111-2222-3333-4444-555555555555}/Machine
> ndr_pull_error(11): Pull bytes 2 (../librpc/ndr/ndr_basic.c:107)
> parse_acl_blob: ndr_pull_xattr_NTACL failed: Buffer Size Error
> validate_nt_acl_blob: parse_acl_blob returned NT_STATUS_BUFFER_TOO_SMALL
> get_nt_acl_internal: ACL validation for
> [/usr/local/samba/var/locks/sysvol/mydomain.org.uk/Policies/{11111111-2222-3333-4444-555555555555}/Machine]
> failed
> set_nt_acl_no_snum: fset_nt_acl returned NT_STATUS_BUFFER_TOO_SMALL.
> delete_lock_ref_count for file
> /usr/local/samba/var/locks/sysvol/mydomain.org.uk/Policies/{11111111-2222-3333-4444-555555555555}/Machine
>

-- 
"If we knew what it was we were doing, it would not be called
research, would it?"
      - Albert Einstein