<p dir="ltr">9G4HTGTB kk38ģvv<br>
On 6 Jul 2016 15:46, "Christof Schmitt" <<a href="mailto:christof.schmitt@us.ibm.com">christof.schmitt@us.ibm.com</a>> wrote:<br>
><br>
> The message in the trace confirms that this is triggered by:<br>
> <a href="https://git.samba.org/?p=samba.git;a=commitdiff;h=4">https://git.samba.org/?p=samba.git;a=commitdiff;h=4</a><br>
><br>
> I 2asuspect that the Samba version used misses the patch<br>
> <a href="https://git.samba.org/?p=samba.git;a=commitdiff;h=fdbca5e13a0375d7f18639679a627e67c3df647a">https://git.samba.org/?p=samba.git;a=commitdiff;h=fdbca5e13a0375d7f18639679a627e67c3df647a</a><br>
><br>
> The CES build of Samba shippied in Spectrum Scale includes the mentioned<br>
> patch, and that should avoid the problem seen. Would it be possible to<br>
> build Samba again with the mentioned patch to test whether that fixes the<br>
> issue seen here?<br>
><br>
> Regards,<br>
><br>
> Christof Schmitt || IBM || Spectrum Scale Development || Tucson, AZ<br>
> <a href="mailto:christof.schmitt@us.ibm.com">christof.schmitt@us.ibm.com</a> || +1-520-799-2469 (T/L: 321-2469)<br>
><br>
><br>
><br>
> From: "Sobey, Richard A" <<a href="mailto:r.sobey@imperial.ac.uk">r.sobey@imperial.ac.uk</a>><br>
> To: gpfsug main discussion list <<a href="mailto:gpfsug-discuss@spectrumscale.org">gpfsug-discuss@spectrumscale.org</a>><br>
> Date: 07/06/2016 05:23 AM<br>
> Subject: Re: [gpfsug-discuss] Snapshots / Windows previous versions<br>
> Sent by: <a href="mailto:gpfsug-discuss-bounces@spectrumscale.org">gpfsug-discuss-bounces@spectrumscale.org</a><br>
><br>
><br>
><br>
> Thanks Daniel – sorry to be dense, but does this indicate working as<br>
> intended, or a bug? I assume the former. So, the question still remains<br>
> how has this suddenly broken, when:<br>
><br>
> [root@server ict]# mmgetacl -k nfs4 .snapshots/<br>
> .snapshots/: Operation not permitted<br>
><br>
> …appears to be the correct output and is consistent with someone else’s<br>
> GPFS cluster where it is working.<br>
><br>
> Cheers<br>
><br>
> Richard<br>
><br>
> From: <a href="mailto:gpfsug-discuss-bounces@spectrumscale.org">gpfsug-discuss-bounces@spectrumscale.org</a> [<br>
> mailto:<a href="mailto:gpfsug-discuss-bounces@spectrumscale.org">gpfsug-discuss-bounces@spectrumscale.org</a>] On Behalf Of Daniel<br>
> Kidger<br>
> Sent: 06 July 2016 12:51<br>
> To: <a href="mailto:gpfsug-discuss@spectrumscale.org">gpfsug-discuss@spectrumscale.org</a><br>
> Cc: <a href="mailto:gpfsug-discuss@spectrumscale.org">gpfsug-discuss@spectrumscale.org</a><br>
> Subject: Re: [gpfsug-discuss] Snapshots / Windows previous versions<br>
><br>
> Looking at recent patches to SAMBA I see from December 2015:<br>
> <a href="https://download.samba.org/pub/samba/patches/security/samba-4.1.21-security-2015-12-16.patch">https://download.samba.org/pub/samba/patches/security/samba-4.1.21-security-2015-12-16.patch</a><br>
> ,<br>
> (link found at <a href="https://bugzilla.samba.org/show_bug.cgi?id=11658">https://bugzilla.samba.org/show_bug.cgi?id=11658</a> which<br>
> includes the comment:<br>
> Failing that, smbd_check_access_rights should check Unix perms at that<br>
> point.<br>
> )<br>
><br>
> diff --git a/source3/modules/vfs_shadow_copy2.c<br>
> b/source3/modules/vfs_shadow_copy2.c<br>
> index fca05cf..07e2f8a 100644<br>
> --- a/source3/modules/vfs_shadow_copy2.c<br>
> +++ b/source3/modules/vfs_shadow_copy2.c<br>
> @@ -30,6 +30,7 @@<br>
> */<br>
><br>
> #include "includes.h"<br>
> +#include "smbd/smbd.h"<br>
> #include "system/filesys.h"<br>
> #include "include/ntioctl.h"<br>
> #include <ccan/hash/hash.h><br>
> @@ -1138,6 +1139,42 @@ static char *have_snapdir(struct vfs_handle_struct<br>
> *handle,<br>
> return NULL;<br>
> }<br>
><br>
> +static bool check_access_snapdir(struct vfs_handle_struct *handle,<br>
> + const char *path)<br>
> +{<br>
> + struct smb_filename smb_fname;<br>
> + int ret;<br>
> + NTSTATUS status;<br>
> +<br>
> + ZERO_STRUCT(smb_fname);<br>
> + smb_fname.base_name = talloc_asprintf(talloc_tos(),<br>
> + "%s",<br>
> + path);<br>
> + if (smb_fname.base_name == NULL) {<br>
> + return false;<br>
> + }<br>
> +<br>
> + ret = SMB_VFS_NEXT_STAT(handle, &smb_fname);<br>
> + if (ret != 0 || !S_ISDIR(smb_fname.st.st_ex_mode)) {<br>
> + TALLOC_FREE(smb_fname.base_name);<br>
> + return false;<br>
> + }<br>
> +<br>
> + status = smbd_check_access_rights(handle->conn,<br>
> + &smb_fname,<br>
> + false,<br>
> + SEC_DIR_LIST);<br>
> + if (!NT_STATUS_IS_OK(status)) {<br>
> + DEBUG(0,("user does not have list permission "<br>
> + "on snapdir %s\n",<br>
> + smb_fname.base_name));<br>
> + TALLOC_FREE(smb_fname.base_name);<br>
> + return false;<br>
> + }<br>
> + TALLOC_FREE(smb_fname.base_name);<br>
> + return true;<br>
> +}<br>
> +<br>
><br>
> Daniel<br>
><br>
><br>
><br>
><br>
><br>
> Dr Daniel Kidger<br>
> IBM Technical Sales Specialist<br>
> Software Defined Solution Sales<br>
><br>
> +44-07818 522 266<br>
> <a href="mailto:daniel.kidger@uk.ibm.com">daniel.kidger@uk.ibm.com</a><br>
><br>
><br>
><br>
><br>
><br>
><br>
> ----- Original message -----<br>
> From: "Sobey, Richard A" <<a href="mailto:r.sobey@imperial.ac.uk">r.sobey@imperial.ac.uk</a>><br>
> Sent by: <a href="mailto:gpfsug-discuss-bounces@spectrumscale.org">gpfsug-discuss-bounces@spectrumscale.org</a><br>
> To: gpfsug main discussion list <<a href="mailto:gpfsug-discuss@spectrumscale.org">gpfsug-discuss@spectrumscale.org</a>><br>
> Cc:<br>
> Subject: Re: [gpfsug-discuss] Snapshots / Windows previous versions<br>
> Date: Wed, Jul 6, 2016 10:55 AM<br>
><br>
> Sure. It might be easier if I just post the entire smb.conf:<br>
><br>
> [global]<br>
> netbios name = store<br>
> workgroup = IC<br>
> security = ads<br>
> realm = <a href="http://IC.AC.UK">IC.AC.UK</a><br>
> kerberos method = secrets and keytab<br>
><br>
> vfs objects = shadow_copy2 syncops gpfs fileid<br>
> ea support = yes<br>
> store dos attributes = yes<br>
> map readonly = no<br>
> map archive = no<br>
> map system = no<br>
> map hidden = no<br>
> unix extensions = no<br>
> allocation roundup size = 1048576<br>
><br>
> disable netbios = yes<br>
> smb ports = 445<br>
> # server signing = mandatory<br>
><br>
> template shell = /bin/bash<br>
> interfaces = bond2 lo bond0<br>
> allow trusted domains = no<br>
><br>
> printing = bsd<br>
> printcap name = /dev/null<br>
> load printers = no<br>
> disable spoolss = yes<br>
><br>
> idmap config IC : default = yes<br>
> idmap config IC : cache time = 180<br>
> idmap config IC : backend = ad<br>
> idmap config IC : schema_mode = rfc2307<br>
> idmap config IC : range = 500 - 2000000<br>
> idmap config * : range = 3000000 - 3500000<br>
> idmap config * : backend = tdb2<br>
> winbind refresh tickets = yes<br>
> winbind nss info = rfc2307<br>
> winbind use default domain = true<br>
> winbind offline logon = true<br>
> winbind separator = /<br>
> winbind enum users = true<br>
> winbind enum groups = true<br>
> winbind nested groups = yes<br>
> winbind expand groups = 2<br>
><br>
> winbind max clients = 10000<br>
><br>
> clustering = yes<br>
> ctdbd socket = /tmp/ctdb.socket<br>
> gpfs:sharemodes = yes<br>
> gpfs:winattr = yes<br>
> gpfs:leases = yes<br>
> gpfs:dfreequota = yes<br>
> # nfs4:mode = special<br>
> # nfs4:chown = no<br>
> nfs4:chown = yes<br>
> nfs4:mode = simple<br>
><br>
> nfs4:acedup = merge<br>
> fileid:algorithm = fsname<br>
> force unknown acl user = yes<br>
><br>
> shadow:snapdir = .snapshots<br>
> shadow:fixinodes = yes<br>
> shadow:snapdirseverywhere = yes<br>
> shadow:sort = desc<br>
><br>
> syncops:onclose = no<br>
> syncops:onmeta = no<br>
> kernel oplocks = yes<br>
> level2 oplocks = yes<br>
> oplocks = yes<br>
> notify:inotify = no<br>
> wide links = no<br>
> async smb echo handler = yes<br>
> smbd:backgroundqueue = False<br>
> use sendfile = no<br>
> dmapi support = yes<br>
><br>
> aio write size = 1<br>
> aio read size = 1<br>
><br>
> enable core files = no<br>
><br>
> #debug logging<br>
> log level = 2<br>
> log file = /var/log/samba.%m<br>
> max log size = 1024<br>
> debug timestamp = yes<br>
><br>
> [IC]<br>
> comment = Unified Group Space Area<br>
> path = /gpfs/prd/groupspace/ic<br>
> public = no<br>
> read only = no<br>
> valid users = "@domain users"<br>
><br>
> From: <a href="mailto:gpfsug-discuss-bounces@spectrumscale.org">gpfsug-discuss-bounces@spectrumscale.org</a> [<br>
> mailto:<a href="mailto:gpfsug-discuss-bounces@spectrumscale.org">gpfsug-discuss-bounces@spectrumscale.org</a>] On Behalf Of Barry Evans<br>
> Sent: 06 July 2016 10:47<br>
> To: <a href="mailto:gpfsug-discuss@spectrumscale.org">gpfsug-discuss@spectrumscale.org</a><br>
> Subject: Re: [gpfsug-discuss] Snapshots / Windows previous versions<br>
><br>
> Can you cut/paste your full VFS options for gpfs and shadow copy from<br>
> smb.conf?<br>
><br>
> On 06/07/2016 10:37, Sobey, Richard A wrote:<br>
> Quick followup on this. Doing some more samba debugging (i.e. increasing<br>
> log levels!) and come up with the following:<br>
><br>
> [2016/07/06 10:07:35.602080, 3]<br>
> ../source3/smbd/vfs.c:1322(check_reduced_name)<br>
> check_reduced_name:<br>
> admin/ict/serviceoperations/slough_project/Slough_Layout reduced to<br>
> /gpfs/prd/groupspace/ic/admin/ict/serviceoperations/slough_project/Slough_Layout<br>
> [2016/07/06 10:07:35.611881, 3] ../source3/smbd/dosmode.c:196(unix_mode)<br>
> unix_mode(admin/ict/serviceoperations/slough_project/Slough_Layout)<br>
> returning 0644<br>
> [2016/07/06 10:07:35.613374, 0]<br>
> ../source3/modules/vfs_shadow_copy2.c:1211(check_access_snapdir)<br>
> user does not have list permission on snapdir<br>
> /gpfs/prd/groupspace/ic/admin/ict/.snapshots<br>
> [2016/07/06 10:07:35.613416, 0]<br>
> ../source3/modules/vfs_shadow_copy2.c:1380(shadow_copy2_get_shadow_copy_data)<br>
> access denied on listing snapdir<br>
> /gpfs/prd/groupspace/ic/admin/ict/.snapshots<br>
> [2016/07/06 10:07:35.613434, 0]<br>
> ../source3/modules/vfs_default.c:1145(vfswrap_fsctl)<br>
> FSCTL_GET_SHADOW_COPY_DATA: connectpath /gpfs/prd/groupspace/ic, failed<br>
> - NT_STATUS_ACCESS_DENIED.<br>
> [2016/07/06 10:07:47.648557, 3]<br>
> ../source3/smbd/service.c:1138(close_cnum)<br>
> 155.198.55.14 (ipv4:<a href="http://155.198.55.14:51298">155.198.55.14:51298</a>) closed connection to service<br>
> IPC$<br>
><br>
> Any takers? I cannot run mmgetacl on the .snapshots folder at all, as<br>
> root. A snapshot I just created to make sure I had full control on the<br>
> folder: (39367 is me, I didn’t run this command on a CTDB node so the UID<br>
> mapping isn’t working).<br>
><br>
> [root@icgpfs01 .snapshots]# mmgetacl -k nfs4 @GMT-2016.07.06-08.00.06<br>
> #NFSv4 ACL<br>
> #owner:root<br>
> #group:root<br>
> group:74036:r-x-:allow:FileInherit:DirInherit:Inherited<br>
> (X)READ/LIST (-)WRITE/CREATE (-)MKDIR (X)SYNCHRONIZE (X)READ_ACL<br>
> (X)READ_ATTR (X)READ_NAMED<br>
> (-)DELETE (-)DELETE_CHILD (-)CHOWN (X)EXEC/SEARCH (-)WRITE_ACL<br>
> (-)WRITE_ATTR (-)WRITE_NAMED<br>
><br>
> user:39367:rwxc:allow:FileInherit:DirInherit:Inherited<br>
> (X)READ/LIST (X)WRITE/CREATE (X)MKDIR (X)SYNCHRONIZE (X)READ_ACL<br>
> (X)READ_ATTR (X)READ_NAMED<br>
> (X)DELETE (X)DELETE_CHILD (X)CHOWN (X)EXEC/SEARCH (X)WRITE_ACL<br>
> (X)WRITE_ATTR (X)WRITE_NAMED<br>
><br>
> From: <a href="mailto:gpfsug-discuss-bounces@spectrumscale.org">gpfsug-discuss-bounces@spectrumscale.org</a> [<br>
> mailto:<a href="mailto:gpfsug-discuss-bounces@spectrumscale.org">gpfsug-discuss-bounces@spectrumscale.org</a>] On Behalf Of Sobey,<br>
> Richard A<br>
> Sent: 20 June 2016 16:03<br>
> To: gpfsug main discussion list <<a href="mailto:gpfsug-discuss@spectrumscale.org">gpfsug-discuss@spectrumscale.org</a>><br>
> Subject: Re: [gpfsug-discuss] Snapshots / Windows previous versions<br>
><br>
> Thanks Kevin. We are upgrading to GPFS 4.2 and CES in a few weeks but our<br>
> customers have come to like previous versions and indeed it is sort of a<br>
> selling point for us.<br>
><br>
> Samba is the only thing we’ve changed recently after the badlock debacle<br>
> so I’m tempted to blame that, but who knows.<br>
><br>
> If (when) I find out I’ll let everyone know.<br>
><br>
> Richard<br>
><br>
> From: <a href="mailto:gpfsug-discuss-bounces@spectrumscale.org">gpfsug-discuss-bounces@spectrumscale.org</a> [<br>
> mailto:<a href="mailto:gpfsug-discuss-bounces@spectrumscale.org">gpfsug-discuss-bounces@spectrumscale.org</a>] On Behalf Of Buterbaugh,<br>
> Kevin L<br>
> Sent: 20 June 2016 15:56<br>
> To: gpfsug main discussion list <<a href="mailto:gpfsug-discuss@spectrumscale.org">gpfsug-discuss@spectrumscale.org</a>><br>
> Subject: Re: [gpfsug-discuss] Snapshots / Windows previous versions<br>
><br>
> Hi Richard,<br>
><br>
> I can’t answer your question but I can tell you that we have experienced<br>
> either the exact same thing you are or something very similar. It<br>
> occurred for us after upgrading from GPFS 3.5 to 4.1.0.8 and it persists<br>
> even after upgraded to GPFS 4.2.0.3 and the very latest sernet-samba.<br>
><br>
> And to be clear, when we upgraded from GPFS 3.5 to 4.1 we did *not*<br>
> upgrade SAMBA versions at that time. Therefore, I believe that something<br>
> changed in GPFS. That doesn’t mean it’s GPFS’ fault, of course. SAMBA<br>
> may have been relying on a bug<ctrl-h><ctrl-h><ctrl-h>undocumented feature<br>
> in GPFS that IBM fixed for all I know, and I’m obviously speculating here.<br>
><br>
> The problem we see is that the .snapshots directory in each folder can be<br>
> cd’d to but is empty. The snapshots are all there, however, if you:<br>
><br>
> cd /<mount point of fs>/.snapshots/<data and time snapshot was<br>
> taken>/rest/of/path/to/folder/in/question<br>
><br>
> This obviously prevents users from being able to do their own recovery of<br>
> files unless you do something like what you describe, which we are<br>
> unwilling to do for security reasons. We have a ticket open with DDN…<br>
><br>
> Kevin<br>
><br>
> On Jun 20, 2016, at 8:45 AM, Sobey, Richard A <<a href="mailto:r.sobey@imperial.ac.uk">r.sobey@imperial.ac.uk</a>><br>
> wrote:<br>
><br>
> Hi all<br>
><br>
> Can someone clarify if the ability for Windows to view snapshots as<br>
> Previous Versions is exposed by SAMBA or GPFS? Basically, if suddenly my<br>
> users cannot restore files from snapshots over a CIFS share, where should<br>
> I be looking?<br>
><br>
> I don’t know when this problem occurred, but within the last few weeks<br>
> certainly our users with full control over their data now see no previous<br>
> versions available, but if we export their fileset and set “force user =<br>
> root” all the snapshots are available.<br>
><br>
> I think the answer is SAMBA, right? We’re running GPFS 3.5 and<br>
> sernet-samba 4.2.9.<br>
><br>
> Many thanks<br>
><br>
> Richard<br>
> _______________________________________________<br>
> gpfsug-discuss mailing list<br>
> gpfsug-discuss at <a href="http://spectrumscale.org">spectrumscale.org</a><br>
> <a href="http://gpfsug.org/mailman/listinfo/gpfsug-discuss">http://gpfsug.org/mailman/listinfo/gpfsug-discuss</a><br>
><br>
> —<br>
> Kevin Buterbaugh - Senior System Administrator<br>
> Vanderbilt University - Advanced Computing Center for Research and<br>
> Education<br>
> <a href="mailto:Kevin.Buterbaugh@vanderbilt.edu">Kevin.Buterbaugh@vanderbilt.edu</a> - (615)875-9633<br>
><br>
><br>
><br>
><br>
><br>
> _______________________________________________<br>
> gpfsug-discuss mailing list<br>
> gpfsug-discuss at <a href="http://spectrumscale.org">spectrumscale.org</a><br>
> <a href="http://gpfsug.org/mailman/listinfo/gpfsug-discuss">http://gpfsug.org/mailman/listinfo/gpfsug-discuss</a><br>
><br>
> --<br>
> Barry Evans<br>
> Technical Director & Co-Founder<br>
> Pixit Media<br>
> Mobile: +44 (0)7950 666 248<br>
> <a href="http://www.pixitmedia.com">http://www.pixitmedia.com</a><br>
><br>
> This email is confidential in that it is intended for the exclusive<br>
> attention of the addressee(s) indicated. If you are not the intended<br>
> recipient, this email should not be read or disclosed to any other person.<br>
> Please notify the sender immediately and delete this email from your<br>
> computer system. Any opinions expressed are not necessarily those of the<br>
> company from which this email was sent and, whilst to the best of our<br>
> knowledge no viruses or defects exist, no responsibility can be accepted<br>
> for any loss or damage arising from its receipt or subsequent use of this<br>
> email.<br>
> _______________________________________________<br>
> gpfsug-discuss mailing list<br>
> gpfsug-discuss at <a href="http://spectrumscale.org">spectrumscale.org</a><br>
> <a href="http://gpfsug.org/mailman/listinfo/gpfsug-discuss">http://gpfsug.org/mailman/listinfo/gpfsug-discuss</a><br>
><br>
> Unless stated otherwise above:<br>
> IBM United Kingdom Limited - Registered in England and Wales with number<br>
> 741598.<br>
> Registered office: PO Box 41, North Harbour, Portsmouth, Hampshire PO6 3AU<br>
> _______________________________________________<br>
> gpfsug-discuss mailing list<br>
> gpfsug-discuss at <a href="http://spectrumscale.org">spectrumscale.org</a><br>
> <a href="http://gpfsug.org/mailman/listinfo/gpfsug-discuss">http://gpfsug.org/mailman/listinfo/gpfsug-discuss</a><br>
><br>
><br>
><br>
><br>
> _______________________________________________<br>
> gpfsug-discuss mailing list<br>
> gpfsug-discuss at <a href="http://spectrumscale.org">spectrumscale.org</a><br>
> <a href="http://gpfsug.org/mailman/listinfo/gpfsug-discuss">http://gpfsug.org/mailman/listinfo/gpfsug-discuss</a><br>
</p>