[OpenIndiana-discuss] Office apps unable to write to ZFS over CIFS

[Gordon Ross]

On Thu, Jun 28, 2012 at 9:17 PM, Martin Frost <me at cs.stanford.edu> wrote:
>  > Date: Thu, 28 Jun 2012 18:14:53 -0400
>  > From: Gordon Ross <gordon.w.ross at gmail.com>
>  >
>  > On Thu, Jun 28, 2012 at 5:08 PM, Martin Frost <me at cs.stanford.edu> wrote:
>  > > I'm running oi_148 as a fileserver, exporting via NFS and the
>  > > kernel CIFS service for ZFS.
>  > >
>  > > But Windows users (XP and probably all Windows versions) are unable to
>  > > write files from any MS Office applications into the shares from ZFS.
>  > > They always get: "Access denied.  Contact your administrator."  Same
>  > > result whether they're trying to overwrite a file or write a new file.
>  > >
>  > > Any ideas what's causing that?  This is driving me crazy.  I've
>  > > seen the same problem under Linux with Samba, where disabling
>  > > locking seemed to help.
>  > >
>  > > After that error, the users save the file to the local disk and copy
>  > > it over the CIFS connection into the ZFS system successfully.  So they
>  > > clearly have write access into ZFS from Windows, and the filesystem
>  > > has lots of free space, but Office can't write any files to ZFS.  I
>  > > assume this is some sort of locking problem.  I have nbmand=on, which
>  > > is what I've read it should be set to for CIFS sharing.
>  > >
>  > > The directories and files they're trying to edit are owned by the
>  > > actual user (defined by matching passwd and smbpasswd entries on the
>  > > OI machine) and have 700 permissions and full_set ACLS:
>  > >
>  > >               owner@:rwxpdDaARWcCos:fd-----:allow
>  > >            everyone@:rwxpdDaARWcCos:fd-----:deny
>  >
>  > You are always a member of the "everyone" group, so that deny ACE is
>  > killing your access.
>
> Sorry, that's wrong.  The first ACL wins, allowing the owner in.

Not according to:
http://msdn.microsoft.com/en-us/library/cc246052(v=prot.13).aspx
Quoting:  "An explicit deny will always override all other permissions."

> Otherwise, the owner wouldn't have been able to copy the file to ZFS
> over CIFS after Word failed to write it there directly.

During the copy, you might have different permissions (i.e. as creator).

-- 
Gordon Ross <gwr at nexenta.com>
Nexenta Systems, Inc.  www.nexenta.com
Enterprise class storage for everyone