TL;DR: What else (besides file ownership / read only = no in smb.conf) could prevent samba from permitting write access to a share? How does the share name affect the permissions?

So I've got Ubuntu Server 16.04 LTS (samba version is 4.3.9+dfsg-0ubuntu0.16.04.2) with an USB device mounted on /mnt/storage. The mount output is

/dev/sdb1 on /mnt/storage type ext4 (rw,relatime,errors=remount-ro,data=ordered)

All files in the directory /mnt/storage are owned and writable by the user htpc:

htpc@htpc:~$ ls -l /mnt/

insgesamt 16
drwxrwxr-x 13 htpc htpc 4096 Sep  8 23:26 storage

htpc@htpc:~$ ls -l /mnt/storage/

insgesamt 108
drwxr-xr-x 21 htpc htpc  4096 Mär 16 20:55 somedirectory
-rw-r--r--  1 htpc htpc  3870 Sep 11 09:02 somefile.txt
drwxr-xr-x 24 htpc htpc  4096 Apr 10 00:25 ...

Here's my smb.conf share (all other settings are kept to their default):

path = /mnt/storage
comment = HTPC Media server
valid users = htpc
read only = no
browseable = yes

I created a samba user with sudo smbpasswd -a htpc.

The share can be accessed with Windows 10 but I don't have write permission (creating, deleting and modifying of files are not permitted). The strange thing is that I don't have that issue when I share any other directory (e.g. create a plain directory /opt/testshare and share that directory the same way like above).


This is so strange. The problem was not the usb device, it was the share name "Media".

For whatever reason, the share is read only when I name it "Media". I found this thread and this thread which have similar problems but they come to the conclusion, that the share and the directory cannot have the same name. I first thought it was a client problem (windows remembers the old uids from the previous installation) but I have the same problems with my phone (ES File Explorer) which I never used to connect to my server before. Even when I use smbclient to connect and try to make a directory I get the following error:

smb: \> mkdir test
NT_STATUS_MEDIA_WRITE_PROTECTED making remote directory \test

I increased the log level to 10 and found this:

[2016/09/17 09:15:35.902089, 10, pid=24086, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_get_set.c:495(pdb_set_user_sid)
  pdb_set_user_sid: setting user sid S-1-5-21-30211493-2420603996-3020390900-1003
[2016/09/17 09:15:35.902143, 10, pid=24086, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_compat.c:73(pdb_set_user_sid_from_rid)
    setting user sid S-1-5-21-30211493-2420603996-3020390900-1003 from rid 1003
[2016/09/17 09:15:35.902216, 10, pid=24086, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_get_set.c:557(pdb_set_group_sid)
  pdb_set_group_sid: setting group sid S-1-5-21-30211493-2420603996-3020390900-513
[2016/09/17 09:15:35.902291,  4, pid=24086, effective(0, 0), real(0, 0)] ../source3/smbd/sec_ctx.c:439(pop_sec_ctx)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2016/09/17 09:15:35.902351, 10, pid=24086, effective(0, 0), real(0, 0)] ../source3/smbd/share_access.c:237(user_ok_token)
  user_ok_token: share Media is ok for unix user htpc
[2016/09/17 09:15:35.902405, 10, pid=24086, effective(0, 0), real(0, 0)] ../source3/smbd/share_access.c:284(is_share_read_only_for_token)
  is_share_read_only_for_user: share Media is read-write for unix user htpc
[2016/09/17 09:15:35.902508, 10, pid=24086, effective(0, 0), real(0, 0)] ../libcli/security/access_check.c:337(se_file_access_check)
  se_file_access_check: MAX desired = 0x2000000 mapped to 0x80120089
[2016/09/17 09:15:35.902558,  5, pid=24086, effective(0, 0), real(0, 0)] ../source3/smbd/uid.c:163(check_user_share_access)
  falling back to read-only access-evaluation due to security descriptor
  • How are you connecting to the share from windows? Do you mount it as htpc? – terdon Sep 11 '16 at 12:06
  • Yes, there is no access via guest account and windows asks for username / password. When I create a file on the /opt/testshare the owner of the created files is htpc. So there must be an issue with accessing mounted external devices? – Benjamin Sep 11 '16 at 12:12
  • Increase the log level and see what SAMBA tells you – roaima Sep 11 '16 at 12:54
  • Done. The only messages in the log are the quote warnings above. – Benjamin Sep 11 '16 at 18:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.