3

The problem is that I can't get files on the CIFS share to show correct permissions on the Linux client without forcing vers=1.0 in the mount options.

The server is a FreeNAS system running Samba 4.7.0. It is basically running in standalone/workgroup mode; there is no AD/domain controller, and I don't want one if I can avoid it.

The client is a Debian Sid (unstable) system with Samba v4.7.4 components, and cifs-utils version 6.8-1.

The current mount incantation looks something like this:

sudo mount.cifs -o 'vers=1.0,username=me,uid=me,gid=me,credentials=[[filename]]' //freenas/me $HOME/mnt

(The above is actually normally performed by autofs, but that turns out to be not relevant.)

Once done, the following entry appears in the mtab:

//freenas/me on /home/me/mnt type cifs (rw,relatime,vers=1.0,cache=strict,username=me,domain=,uid=1000,forceuid,gid=1000,forcegid,addr=X.X.X.X,soft,unix,posixpaths,serverino,mapposix,acl,rsize=1048576,wsize=65536,echo_interval=60,actimeo=1)

...And our test directory shows up with the following modes/permissions:

me@linuxclient:~$ ls -al mnt/testdir/
total 3
drwxr-xr-x+ 2 me me 0 Apr 21 00:10 .
drwxr-xr-x+ 5 me me 0 Apr 21 00:07 ..
-r--r--r--+ 1 me me 0 Apr 21 00:09 R--R--R--
-rw-r--r--+ 1 me me 0 Apr 21 00:10 RW-R--R--
-rwx------+ 1 me me 0 Apr 21 00:08 RWX------
-rwxr-xr-x+ 1 me me 0 Apr 21 00:08 RWXR-XR-X
-r-xr-xr-x+ 1 me me 0 Apr 21 00:09 R-XR-XR-X

This is exactly what I expect and want. However, the mount is forcing SMB version 1.0, which is old and busted. However, if I do not explicitly specify vers=1.0, then this happens:

//freenas/me on /home/me/mnt type cifs (rw,relatime,vers=default,cache=strict,username=me,domain=,uid=1000,forceuid,gid=1000,forcegid,addr=X.X.X.X,file_mode=0755,dir_mode=0755,soft,nounix,serverino,mapposix,rsize=1048576,wsize=1048576,echo_interval=60,actimeo=1)


me@linuxclient:~$ ls -al mnt/testdir/
total 5120
drwxr-xr-x 2 me me 0 Apr 21 00:10 .
drwxr-xr-x 2 me me 0 Apr 21 00:07 ..
-rwxr-xr-x 1 me me 0 Apr 21 00:09 R--R--R--
-rwxr-xr-x 1 me me 0 Apr 21 00:10 RW-R--R--
-rwxr-xr-x 1 me me 0 Apr 21 00:08 RWX------
-rwxr-xr-x 1 me me 0 Apr 21 00:08 RWXR-XR-X
-rwxr-xr-x 1 me me 0 Apr 21 00:09 R-XR-XR-X

Something has injected file_mode=0755,dir_mode=0755 into the mount options, and the resulting permissions are 0x755 on all files, regardless of their actual permissions, which is obviously wrong. I have not yet figured out where these unwanted options are coming from.

Since my ultimate goal is to have several concurrent users all connecting to their own home directories with their own credentials, I started experimenting with this mount incantation, specifically the multiuser option:

sudo mount.cifs -o "user=me,noperm,multiuser" //freenas/me $HOME/mnt


me@linuxclient:~$ ls -al mnt/testdir/
total 5120
drwxr-xr-x 2 me me 0 Apr 21 00:10 .
drwxr-xr-x 2 me me 0 Apr 21 00:07 ..
-rwxr-xr-x 1 me me 0 Apr 21 00:09 R--R--R--
-rwxr-xr-x 1 me me 0 Apr 21 00:10 RW-R--R--
-rwxr-xr-x 1 me me 0 Apr 21 00:08 RWX------
-rwxr-xr-x 1 me me 0 Apr 21 00:08 RWXR-XR-X
-rwxr-xr-x 1 me me 0 Apr 21 00:09 R-XR-XR-X

Still wrong. However, when I add the mount option cifsacl:

sudo mount.cifs -o "user=me,noperm,multiuser,cifsacl" //freenas/me $HOME/mnt

And enter my credentials for the server via the cifscreds command, I get these results:

//freenas/me on /home/me/mnt type cifs (rw,relatime,vers=default,cache=strict,multiuser,domain=,uid=0,noforceuid,gid=0,noforcegid,addr=X.X.X.X,file_mode=0755,dir_mode=0755,soft,nounix,serverino,mapposix,cifsacl,noperm,rsize=1048576,wsize=1048576,echo_interval=60,actimeo=1)


me@linuxclient:~$ ls -al mnt/testdir/
total 5120
drwxr-xr-x 2 root root 0 Apr 21 00:10 .
drwxr-xr-x 2 root root 0 Apr 21 00:07 ..
-r--r--r-- 1 root root 0 Apr 21 00:09 R--R--R--
-rw-r--r-- 1 root root 0 Apr 21 00:10 RW-R--R--
-rwx------ 1 root root 0 Apr 21 00:08 RWX------
-rwxr-xr-x 1 root root 0 Apr 21 00:08 RWXR-XR-X
-r-xr-xr-x 1 root root 0 Apr 21 00:09 R-XR-XR-X

Despite the options file_mode=0755,dir_mode=0755 still being injected, the permissions are now appearing correctly. But now the UIDs are wrong, and everything looks like it's owned by root. I can actually create, modify, and delete files in the share, but they appear as root-owned. I know there's supposed to be a mapping performed by cifs.idmap and winbindd, but I haven't figured out exactly how that's done or how to set it up.

I would rather not keep using the vers=1.0 kluge; I would prefer to do this correctly. Any hints as to what I'm missing?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.