[Samba] Questions around deleting a file accessed by others

[Stefan G. Weichinger]

Yesterday I received a call from a customer ... in panic.

Some users couldn't access an important binary on the samba file server
while it was visible in Windows explorer and on the linux server.

It's a debian domain member server with Samba version 4.5.12-Debian.

The users get connected to a share via GPO, additionally I put an icon
on their desktops, linking to \\server\something\wfibn.exe

I can't reconstruct what happened in detail, they always pretend to not
having done *anything* ;-)

Seems as if someone deleted the icon or the exe itself while other users
had the file open as well (we talk of around 15-20 people accessing the
same program normally).

AFAI understand deleting a desktop icon must not delete the file the
link points to ...

-

I figured out that the exe was somehow marked as "to be deleted as soon
as no smbd process accesses it anymore":

[2017/09/06 11:57:55.006868,  2] ../source3/smbd/open.c:1342(open_file)
  BUERO\userX opened file prog/wfibn.exe read=No write=No (numopen=8)
[2017/09/06 11:57:55.007039,  3]
../source3/smbd/smb2_server.c:3097(smbd_smb2_request_error_ex)
  smbd_smb2_request_error_ex: smbd_smb2_request_error_ex: idx[1]
status[NT_STATUS_DELETE_PENDING] || at ../source3/smbd/smb2_create.c:293

As long as there were open sessions the file was there (with correct
permissions etc) but new connections were refused ("hey, it's gonna be
deleted in a few minutes anyway").

I suggested they should close all sessions at once ... then the file
actually was deleted and gone. cp-ied it back from a backup, after that
all (even the new) sessions were successful.

Now I tested if the binary works if set to readonly: yes, it does ...
and the users can't delete it now. Should work.

-

Is all this expected and normal behavior?