-
Notifications
You must be signed in to change notification settings - Fork 22
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Setting 'system.nt_sec_desc.*+' manually causes reorder of ACL's and Security Descriptor CONTROL flag #74
Comments
Please check if the behaviour is the same when running the command line utility smbclient: |
chmod doesn't work in my case because: Checked od Debian 10.1 (smbcacls 4.9.5) Ubuntu 20.04 (smbcacls 4.11.6) from those systems I've been setting ACL for remote share od Win2012r2, I've even tried to change ACL on Win10 share, and got exact same results so I think it's not a Win2012r2 or libsmbclient-php issue but some samba related problem. |
Is that share the user's profile one? Or just some generic share? |
My main test case Was changing ACLs for AD user home dir, but it also occures on generic shares, as I've mentioned before even smbcacls causes this behaviour, so I think it is a deeper problem, not your lib ;) |
Hi, greets |
@kratzersmz , just to make it clear, since this issue is already observed on libsmbclient itself, we won't take any action, unless one of you / @szaqal83 have a way to clearly reproduce it (e.g. provide me all the commands), then I could try to help. |
Creating dir on Win2k8R2 like this:
smbclient_mkdir($state, $share, 0700);
without setting system.nt_sec_desc.*+ results smbcacls output:
REVISION:1 CONTROL:SR|DI|DP OWNER:BUILTIN\Administrators GROUP:PUW\Domain Users ACL:BUILTIN\Administrators:ALLOWED/I/FULL ACL:CREATOR OWNER:ALLOWED/OI|CI|IO|I/FULL ACL:PUW\Gr_Administratorzy_Merkury:ALLOWED/OI|CI|I/FULL ACL:NT AUTHORITY\SYSTEM:ALLOWED/OI|CI|I/FULL ACL:BUILTIN\Administrators:ALLOWED/OI|CI|IO|I/FULL
but when I'm setting system.nt_sec_desc.*+ manually:
`$acls = array(
'ACL:BUILTIN\Administrators:ALLOWED/16/FULL',
'ACL:CREATOR OWNER:ALLOWED/27/FULL',
'ACL:PUW\Gr_Administratorzy_Merkury:ALLOWED/19/FULL',
'ACL:NT AUTHORITY\SYSTEM:ALLOWED/19/FULL',
'ACL:BUILTIN\Administrators:ALLOWED/27/FULL'
);
smbclient_mkdir($state, $share, 0700);
smbclient_setxattr($state, $share, 'system.nt_sec_desc.*+', implode(',', $acls));`
smbcacls outputs:
REVISION:1 CONTROL:SR|DP OWNER:BUILTIN\Administrators GROUP:PUW\Domain Users ACL:CREATOR OWNER:ALLOWED/OI|CI|IO|I/FULL ACL:NT AUTHORITY\SYSTEM:ALLOWED/OI|CI|I/FULL ACL:BUILTIN\Administrators:ALLOWED/I/FULL ACL:BUILTIN\Administrators:ALLOWED/OI|CI|IO|I/FULL ACL:PUW\Gr_Administratorzy_Merkury:ALLOWED/OI|CI|I/FULL
CONTROL flag lost DI, and ALC's are in different order, changeing order of ACL's in array doesn't take any effect. First and second share permissions look the same in Windows 10. Creating subdir in second share causes Windows alert about permissions order.
The text was updated successfully, but these errors were encountered: