Dear community,
I’m having strange problems with the permissions within my Samba shares (samba1) whenever files are created or edited from the host system, i.e., outside the container.
I can then open the edited files via the Samba shares, but I can’t delete them from there. The permissions are set exactly the same as those of the other files in the share – both from the NETH8 host and the container.
Background:
I use scripts to evaluate or edit files. These scripts usually run from the Nethserver(7/8) host. This wasn’t a problem under Nethserver7; the editing process either had to run in the correct context, or the files or folders had to be subsequently corrected regarding their ownership or permissions. This worked for years.
With Nethserver8, things are a little different now. There are ownerships and permissions as seen by the NETH8 host and those seen by the respective container. And of course, most actions should be performed from the container.
My scripts, however, should run from the NETH8 host, if only because they require tools such as Tesseract, etc., which I don’t want in the container. However, files are processed in the Samba container (/home/samba1/volume/etc./pp.).
For example, a PDF file is thrown into the share via the share, which is then processed by the script or tools and moved through various folders during the process. At the end, the processed files are available as desired – except that they cannot be deleted from the share.
Variant 1:
Processing runs in the context of the user “samba1,” who also creates folders in the share and creates and moves files within this share during the process. The original PDF file is also moved during the process. In the end, all files and folders have the same (correct) ownership (samba1/$ID). Only the permissions of the newly created files differ; the script then corrects this for the subfolder created by the script and recursively for the files as well using
chmod -R u+x,g+w /home/samba1/path/to/volume/and/to/share/with/subfolder/
However, the created files cannot be deleted from the Samba client (MacOS). The original PDF, however, can be deleted. All files are displayed as follows:
ls -al /home/samba1/path/to/volume/and/to/share/with/subfolder/
-rwxrw-r-- 1 samba1 $ID
Ownership and permissions are also displayed as identical in the container:
runagent -m samba1 podman exec samba-dc ls -al /srv/shares/share/with/subfolder
-rwxrw-r-- 1 root users
A comparison of different subfolders using
runagent -m samba1 podman exec samba-dc getfacl /srv/shares/share/other/subfolder
also shows no differences:
file: srv/shares//share/other/subfolder
owner: root
group: users
flags: -s-
user::rwx
group::rwx
other::r-x
As part of the troubleshooting, I tested variant 2:
Processing continues to run in the context of the user “samba1,” but the creation of folders and moving within the share is performed using
runagent -m samba1" podman exec samba-dc SOMECOMMAND
Here, too, the ownership of the created files and folders is correct in the end – both from the host and the container. Only the permissions of the newly created files and folders are slightly different:
drwxr-sr-x
instead of
of drwxrwsr-x
(both, from the host and the container).
So, the script finally corrects this to “chmod -R g+w” for the subfolder created by the script and recursively for the files as well.
But none of this makes a difference. The files and folders created in the script run cannot be deleted from the share (only tried on MacOS without AD connection). The ownership and permissions look identical.
What am I missing here?
Of course, I can delete them via the shell, but the created elements should be usable from the share.
Is there a special command that can be used to correct the corresponding permissions for specific folders? Using the GUI obviously doesn’t make sense in the context of my script.
Regards, Yummiweb