Stackable VFS objects recycle, full_audit interoperability error

Bug #1780463 reported by Mark Thomas on 2018-07-06
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
samba
Unknown
Unknown
samba (Ubuntu)
Low
Unassigned

Bug Description

Specifying "vfs objects = recycle full_audit" Results in the audit behavior working but the recycle behavior not working:

Jul 5 20:46:05 sambatest smbd_audit: mark|192.168.12.120|myclient|test|unlink|ok|test-b.txt

However, specifying "vfs objects = full_audit recycle" results in both the recycle bin behavior and the audit behavior working as expected:

Jul 5 20:47:45 sambatest smbd_audit: mark|192.168.12.120|myclient|test|rename|ok|test-c.txt|.recycle///test-c.txt

It doesn't seem like these modules should overlap in functionality, so the order doesn't seem like it should matter.

Package: samba 2:4.3.11+dfsg-0ubuntu0.16.04.13
Description: Ubuntu 16.04.4 LTS
Release: 16.04

Andreas Hasenack (ahasenack) wrote :

I can confirm this with xenial's samba:

# works:
[storage]
 path = /storage
 vfs objects = full_audit recycle
 read only = no
 guest ok = no
 full_audit:prefix = %u|%I
 full_audit:success = unlink
 full_audit:failure = none

Jul 11 19:12:55 xenial-samba-vfs-stack smbd_audit: ubuntu|127.0.0.1|unlink|ok|head
Jul 11 19:12:58 xenial-samba-vfs-stack smbd_audit: ubuntu|127.0.0.1|unlink|ok|tty
Jul 11 19:13:00 xenial-samba-vfs-stack smbd_audit: ubuntu|127.0.0.1|unlink|ok|[

I get logging (full_audit) and .recycle gets the files I removed.

Changing the order like this:

 vfs objects = recycle full_audit

I lose the logging, but recycling works.

I'll try on newer versions to see if this was fixed.

Andreas Hasenack (ahasenack) wrote :

Also happens in bionic's 2:4.7.6+dfsg~ubuntu-0ubuntu2, and an upcoming 4.8.2. Looks like this is worth an upstream bug, since the release notes for 4.8.3 don't mention vfs.

Changed in samba (Ubuntu):
status: New → Triaged
importance: Undecided → Low
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.