[Samba] FreeBSD samba server returns nt_status_acces_denied when DosStream xattr larger than 64KB

[Jeremy Allison]

On Mon, Aug 07, 2017 at 06:15:09AM -0500, Andrew Walker via samba wrote:
> >
> > If you feel like it, you could write a VFS module that adds better support
> > for
> > this on FreeBSD, but what is the use case?
> >
> 
> I've noticed in online forums that occasionally home NAS users will for
> various reasons have streams_xattr enabled and receive 'access denied'
> errors when trying to write files with large alternate datastreams. These
> are typically on media files (most commonly I've seen them on .avi files),
> but I haven't looked closely at them. I'd say the large ADS is either
> metadata or malware :-)

Almost certainly malware. The primary use case for streams is
malware or CIA-exfiltration of your company data (I'm not joking,
the Wikileaks documents have the details).