TL;DR: What else (besides file ownership /
read only = no in smb.conf) could prevent samba from permitting write access to a share? How does the share name affect the permissions?
So I've got Ubuntu Server 16.04 LTS (samba version is 4.3.9+dfsg-0ubuntu0.16.04.2) with an USB device mounted on /mnt/storage. The
mount output is
/dev/sdb1 on /mnt/storage type ext4 (rw,relatime,errors=remount-ro,data=ordered)
All files in the directory
/mnt/storage are owned and writable by the user
htpc@htpc:~$ ls -l /mnt/ insgesamt 16 drwxrwxr-x 13 htpc htpc 4096 Sep 8 23:26 storage htpc@htpc:~$ ls -l /mnt/storage/ insgesamt 108 drwxr-xr-x 21 htpc htpc 4096 Mär 16 20:55 somedirectory -rw-r--r-- 1 htpc htpc 3870 Sep 11 09:02 somefile.txt drwxr-xr-x 24 htpc htpc 4096 Apr 10 00:25 ...
Here's my smb.conf share (all other settings are kept to their default):
[Media] path = /mnt/storage comment = HTPC Media server valid users = htpc read only = no browseable = yes
I created a samba user with
sudo smbpasswd -a htpc.
The share can be accessed with Windows 10 but I don't have write permission (creating, deleting and modifying of files are not permitted). The strange thing is that I don't have that issue when I share any other directory (e.g. create a plain directory
/opt/testshare and share that directory the same way like above).
This is so strange. The problem was not the usb device, it was the share name "Media".
For whatever reason, the share is read only when I name it "Media".
I found this thread and this thread which have similar problems but they come to the conclusion, that the share and the directory cannot have the same name. I first thought it was a client problem (windows remembers the old uids from the previous installation) but I have the same problems with my phone (ES File Explorer) which I never used to connect to my server before. Even when I use
smbclient to connect and try to make a directory I get the following error:
smb: \> mkdir test NT_STATUS_MEDIA_WRITE_PROTECTED making remote directory \test
I increased the log level to 10 and found this:
[2016/09/17 09:15:35.902089, 10, pid=24086, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_get_set.c:495(pdb_set_user_sid) pdb_set_user_sid: setting user sid S-1-5-21-30211493-2420603996-3020390900-1003 [2016/09/17 09:15:35.902143, 10, pid=24086, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_compat.c:73(pdb_set_user_sid_from_rid) pdb_set_user_sid_from_rid: setting user sid S-1-5-21-30211493-2420603996-3020390900-1003 from rid 1003 [2016/09/17 09:15:35.902216, 10, pid=24086, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_get_set.c:557(pdb_set_group_sid) pdb_set_group_sid: setting group sid S-1-5-21-30211493-2420603996-3020390900-513 [2016/09/17 09:15:35.902291, 4, pid=24086, effective(0, 0), real(0, 0)] ../source3/smbd/sec_ctx.c:439(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2016/09/17 09:15:35.902351, 10, pid=24086, effective(0, 0), real(0, 0)] ../source3/smbd/share_access.c:237(user_ok_token) user_ok_token: share Media is ok for unix user htpc [2016/09/17 09:15:35.902405, 10, pid=24086, effective(0, 0), real(0, 0)] ../source3/smbd/share_access.c:284(is_share_read_only_for_token) is_share_read_only_for_user: share Media is read-write for unix user htpc [2016/09/17 09:15:35.902508, 10, pid=24086, effective(0, 0), real(0, 0)] ../libcli/security/access_check.c:337(se_file_access_check) se_file_access_check: MAX desired = 0x2000000 mapped to 0x80120089 [2016/09/17 09:15:35.902558, 5, pid=24086, effective(0, 0), real(0, 0)] ../source3/smbd/uid.c:163(check_user_share_access) falling back to read-only access-evaluation due to security descriptor