[Samba] after 4.9 to 4.13 Pro Tools can't write to share

[Casey Stone]

Hello:

I have been successfully using stand-alone Samba as a file server for my
Mac (currently OS 'Big Sur') running Pro Tools (audio workstation) software
for several years now. I can mount the share on the mac and run Pro Tools
sessions from the share. The Samba host machine has been Proxomox 6.x
(Debian 10 with different kernel and some specialist hypervisor software)
running some version of Samba 4.9 (4.9.5 probably). I upgraded the host to
Proxmox 7.x (Debian 11 based) which bumps Samba to 4.13.13. Underlying
shared disks are BTRFS formatted.

I have also tested using vanilla Debian 10 and Debian 11 (not Proxmox) as
the Samba server host OS with the same result. This was a virtual machine,
virtual disk. Again, 4.9.5 worked fine. 4.13.13 didn't.

On Samba 4.13.13 (Debian 11) Pro Tools has trouble writing files, it can't
create new session files or even do a 'save-as' of an existing session file
I open. It complains of permissions issues, doesn't have write permissions.
I can verify this -- it tries to write a file and it appears (both in Mac
terminal and on the server side) with permissions "--------x". Note, other
applications and the Finder have no problems with this set up (Deb 11/Samba
4.13.13). I can create, modify, and save files on the share with normal
results, no weird permissions. Pro Tools is doing something that
annoys Samba, but it works fine on Debian 10 Samba 4.9.5.

I have reviewed the major version changelog of Samba and nothing really
stood out to me as a likely change in defaults or some other change which
would have caused this, but maybe an expert here can help!

I note in Samba 4.10 there is a change in 'prefork children' default from 1
to 4, but I'm not sure that affects me. I don't use AD or LDAP, just the
single unix user account. I note in Samba 4.11 there is a change in
"Default samba process model" from standard to prefork. Not sure about that
one either.

Here is the output (slightly redacted) of testparm for each version. 4.9.5
works great. 4.13.13 does not.

4.9.5

# testparm
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Registered MSG_REQ_POOL_USAGE
Registered MSG_REQ_DMALLOC_MARK and LOG_CHANGED
Load smb config files from /etc/samba/smb.conf
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Processing section "[smb49shr1]"
Loaded services file OK.
Server role: ROLE_STANDALONE

Press enter to see a dump of your service definitions

# Global parameters
[global]
dns proxy = No
log file = /var/log/samba/log.%m
logging = file
map to guest = Bad User
max log size = 1000
obey pam restrictions = Yes
panic action = /usr/share/samba/panic-action %d
server role = standalone server
idmap config * : backend = tdb

[smb49shr1]
comment = smb on Deb10VM
force group = sambashare
hide files = /.DS_Store/Network Trash
Folder/TheFindByContentFolder/TheVolumeSettingsFolder/Temporary
Items/.TemporaryItems/.VolumeIcon.icns/Icon?/.FBCIndex/.FBCLockFolder/
locking = No
map acl inherit = Yes
path = /home/user1/smb49shr1
read only = No
valid users = user1
vfs objects = catia fruit streams_xattr
fruit:locking = netatalk

4.13.13

# testparm
Load smb config files from /etc/samba/smb.conf
Loaded services file OK.
Weak crypto is allowed
Server role: ROLE_STANDALONE

Press enter to see a dump of your service definitions

# Global parameters
[global]
dns proxy = No
log file = /var/log/samba/log.%m
logging = file
map to guest = Bad User
max log size = 1000
obey pam restrictions = Yes
pam password change = Yes
panic action = /usr/share/samba/panic-action %d
server role = standalone server
idmap config * : backend = tdb

[smb413shr1]
comment = smb on Deb11VM
force group = sambashare
hide files = /.DS_Store/Network Trash
Folder/TheFindByContentFolder/TheVolumeSettingsFolder/Temporary
Items/.TemporaryItems/.VolumeIcon.icns/Icon?/.FBCIndex/.FBCLockFolder/
locking = No
map acl inherit = Yes
path = /home/user1/smb413shr1
read only = No
valid users = user1
vfs objects = catia fruit streams_xattr
fruit:locking = netatalk
fruit:encoding = native
streams_xattr:prefix = user.
streams_xattr:store_stream_type = no

Thank you in advance for any suggestions.