Store share ACL information persistently

Description

Several of our customers use share ACLs as part of the security model for their TrueNAS samba server. This ACL is stored in /var/db/samba4/share_info.tdb and does not appear to be synced between the active and passive nodes of a TrueNAS server.
Since the default ACL for shares is "everyone: Full Control", on a failover event this will immediately grant increased permissions on the TrueNAS samba server if an ACL was set via "Computer Management" on the other node.

Problem/Justification

None

Impact

None

relates to

SmartDraw Connector

Katalon Manual Tests (BETA)

Activity

Eric Turgeon 
September 26, 2019 at 8:07 PM

While working on I have also tested this ticket

Andrew Walker 
June 18, 2019 at 11:59 AM

Change in PR is to add a field to the cifs_share table in freenas-v1.db store the share ACL in it. There are middleware API calls to view, edit, and synchronize the stored share ACL with share_info.tdb. Once per hour the mtime of share_info.tdb is compared with the results of the last check. If it is different, then the stored ACL is synchronized with the changes. If middleware is used to set a share ACL, it is written to both share_info.tdb and to cifs_share entry->cifs_share_acl.

There is no GUI component to it at this point.

Bug Clerk 
June 17, 2019 at 7:27 PM

Andrew Walker 
April 25, 2019 at 4:11 PM

This should be stored in the config file. Mitigation step is move system dataset off of boot device.

Andrew Walker 
February 11, 2018 at 11:49 AM

Samba has the global parameter <pre>state directory =</pre> In FreeBSD port it defaults to "/var/db/samba4"

The state directory contains the following:
<pre>group_mapping.tdb
share_info.tdb
account_policy.tdb
winbindd_cache.tdb
winbindd_idmap.tdb
registry.tdb</pre>

Regardless of where the system dataset is stored, the state directory should reside on the data pool so that we maintain consistent state on failover.

So relevant checks before setting <pre>state directory = pool/.smb_statedirectory</pre>
1) Is this HA system and active node?
2) Is system dataset on boot device? (if it's already on pool, then we're preserving state on failover).
3) Is pool decrypted?
4) Does state directory exist?
(a)If not, create and copy state info from /var/db/samba4 on boot device to it.
(b)If it does exist, copy contents of state dir to /var/db/samba4

If (1)-(4) true, then add smb4.conf param.

This does the following for us:

  • Keep state information on failover

  • Maintains three copies of state information (data pool and both boot pools).

Complete

Details

Assignee

Reporter

Components

Priority

More fields

Katalon Platform

Created October 28, 2017 at 5:14 AM
Updated July 1, 2022 at 4:27 PM
Resolved September 27, 2019 at 1:06 PM