[Samba] Questions around deleting a file accessed by others
Stefan G. Weichinger
lists at xunil.at
Thu Sep 7 08:37:15 UTC 2017
Yesterday I received a call from a customer ... in panic.
Some users couldn't access an important binary on the samba file server
while it was visible in Windows explorer and on the linux server.
It's a debian domain member server with Samba version 4.5.12-Debian.
The users get connected to a share via GPO, additionally I put an icon
on their desktops, linking to \\server\something\wfibn.exe
I can't reconstruct what happened in detail, they always pretend to not
having done *anything* ;-)
Seems as if someone deleted the icon or the exe itself while other users
had the file open as well (we talk of around 15-20 people accessing the
same program normally).
AFAI understand deleting a desktop icon must not delete the file the
link points to ...
I figured out that the exe was somehow marked as "to be deleted as soon
as no smbd process accesses it anymore":
[2017/09/06 11:57:55.006868, 2] ../source3/smbd/open.c:1342(open_file)
BUERO\userX opened file prog/wfibn.exe read=No write=No (numopen=8)
[2017/09/06 11:57:55.007039, 3]
smbd_smb2_request_error_ex: smbd_smb2_request_error_ex: idx
status[NT_STATUS_DELETE_PENDING] || at ../source3/smbd/smb2_create.c:293
As long as there were open sessions the file was there (with correct
permissions etc) but new connections were refused ("hey, it's gonna be
deleted in a few minutes anyway").
I suggested they should close all sessions at once ... then the file
actually was deleted and gone. cp-ied it back from a backup, after that
all (even the new) sessions were successful.
Now I tested if the binary works if set to readonly: yes, it does ...
and the users can't delete it now. Should work.
Is all this expected and normal behavior?
More information about the samba