4

Is it possible to remap the UID (and GID) that is being reported to a samba client? It looks like it may be possible with the various idmap options, but it looks overly complicated for the simple remap I want to accomplish and I'm confused as to whether this is even the right approach.

Consider two machines A and B. Machine A has user smbuser with UID 701. Machine B only has a root user with UID 0.

smb.conf excerpt from machine A:

[share1]
  path = /tmp/share1
  valid users = smbuser

On machine B:

mount -t cifs -o username=smbuser,pass=**** //10.1.1.11/share1 /mnt
ls -l /mnt

I see:

drwx------  701  701       0 Jan  1 00:00  .
drwx------  root root      0 Jan  1 00:00  ..
-rw-------  701  701      42 Jan  1 00:00  testfile

I want:

drwx------  root root      0 Jan  1 00:00  .
drwx------  root root      0 Jan  1 00:00  ..
-rw-------  root root     42 Jan  1 00:00  testfile

TL;DR: I need samba to remap UID 701 -> 0 when feeding directory lists to clients.

1 Answer 1

4

You want the combination of the uid, forceuid, gid and forcegid mount options. That way, you can instruct a SMB client to always assign a certain UID and GID to own the files. As a plus, you don't need to change the SMB server config for this.

See the manpage for cifs.mount at https://linux.die.net/man/8/mount.cifs:

uid=arg sets the uid that will own all files or directories on the mounted filesystem when the server does not provide ownership information. It may be specified as either a username or a numeric uid. When not specified, the default is uid 0. The mount.cifs helper must be at version 1.10 or higher to support specifying the uid in non-numeric form. See the section on FILE AND DIRECTORY OWNERSHIP AND PERMISSIONS below for more information.

forceuid instructs the client to ignore any uid provided by the server for files and directories and to always assign the owner to be the value of the uid= option. See the section on FILE AND DIRECTORY OWNERSHIP AND PERMISSIONS below for more information.

gid=arg sets the gid that will own all files or directories on the mounted filesystem when the server does not provide ownership information. It may be specified as either a groupname or a numeric gid. When not specified, the default is gid 0. The mount.cifs helper must be at version 1.10 or higher to support specifying the gid in non-numeric form. See the section on FILE AND DIRECTORY OWNERSHIP AND PERMISSIONS below for more information.

forcegid instructs the client to ignore any gid provided by the server for files and directories and to always assign the owner to be the value of the gid= option. See the section on FILE AND DIRECTORY OWNERSHIP AND PERMISSIONS below for more information.

In your case, you can use (not specifying a UID/GID will use the default 0):

mount -t cifs -o username=smbuser,pass=****,uid,forceuid,gid,forcegid //10.1.1.11/share1 /mnt

Also take a look at the dynperm option which may be of use to you.

For reference, the "File And Directory Ownership And Permissions" sections learns:

File And Directory Ownership And Permissions

The core CIFS protocol does not provide unix ownership information or mode for files and directories. Because of this, files and directories will generally appear to be owned by whatever values the uid= or gid= options are set, and will have permissions set to the default file_mode and dir_mode for the mount. Attempting to change these values via chmod/chown will return success but have no effect.

When the client and server negotiate unix extensions, files and directories will be assigned the uid, gid, and mode provided by the server. Because CIFS mounts are generally single-user, and the same credentials are used no matter what user accesses the mount, newly created files and directories will generally be given ownership corresponding to whatever credentials were used to mount the share.

If the uid's and gid's being used do not match on the client and server, the forceuid and forcegid options may be helpful. Note however, that there is no corresponding option to override the mode. Permissions assigned to a file when forceuid or forcegid are in effect may not reflect the the real permissions.

When unix extensions are not negotiated, it's also possible to emulate them locally on the server using the "dynperm" mount option. When this mount option is in effect, newly created files and directories will receive what appear to be proper permissions. These permissions are not stored on the server however and can disappear at any time in the future (subject to the whims of the kernel flushing out the inode cache). In general, this mount option is discouraged.

It's also possible to override permission checking on the client altogether via the noperm option. Server-side permission checks cannot be overriden. The permission checks done by the server will always correspond to the credentials used to mount the share, and not necessarily to the user who is accessing the share.

1
  • Thank you for the detailed answer!
    – Duke Nukem
    Jul 14, 2019 at 6:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .