samba does not support private dir option (qemu related)

[Nicolò Chieffo]

hello, I'm using qemu with the option -smb which is a way to enable a samba server in the network emulated in the qemu virtual machine.
-smb option generates on the fly a new smb.conf stored in /tmp with a new share called [qemu] (I can specify the directory "-smb dir").
this option enables ip 10.0.2.4 in the virtual machine to be a samba server, but which I try to browse it, there are some errors and the process smbd on the host machine, launched by qemu goes in [defunct]

if I launch qemu as root this problem doesn not occurr, but the new share is not enabled. I think it could be that smbd doesn't care about the new smb.conf and it uses the default one. could it be so?

[Jeff Layton (jtlayton)]

Ack just noticed that that patch segment I posted is actually to an old
samba version and doesn't look like it applies to 3.0.2a. Still though,
I can't seem to get the "private dir" option to work. My suspicion is
that it has something to do with --with-fhs. I'm running the same
version of samba on some solaris machines that I built myself and am not
having this problem there.

Any help would be greatly appreciated.
-- Jeff

[Steve Langasek (vorlon)]

On Wed, May 19, 2004 at 01:13:03PM -0400, Jeffrey Layton wrote:
> Ack just noticed that that patch segment I posted is actually to an old
> samba version and doesn't look like it applies to 3.0.2a. Still though,
> I can't seem to get the "private dir" option to work. My suspicion is
> that it has something to do with --with-fhs. I'm running the same
> version of samba on some solaris machines that I built myself and am not
> having this problem there.

> Any help would be greatly appreciated.

Is there a reason you wouldn't symlink or bind-mount /var/lib/samba to
point to your shared disk? This is the FHS-mandated location for such
data, and everything in this directory (not just the secrets.tdb) would
be relevant to an HA system. There is very little reason why it should
be necessary to support arbitrary directory paths for these files in a
Debian system.

--
Steve Langasek
postmodern programmer

[Andrew Bartlett (abartlet)]

On Thu, 2004-05-20 at 07:33, Steve Langasek wrote:
> On Wed, May 19, 2004 at 01:13:03PM -0400, Jeffrey Layton wrote:
> > Ack just noticed that that patch segment I posted is actually to an old
> > samba version and doesn't look like it applies to 3.0.2a. Still though,
> > I can't seem to get the "private dir" option to work. My suspicion is
> > that it has something to do with --with-fhs. I'm running the same
> > version of samba on some solaris machines that I built myself and am not
> > having this problem there.
>
> > Any help would be greatly appreciated.
>
> Is there a reason you wouldn't symlink or bind-mount /var/lib/samba to
> point to your shared disk? This is the FHS-mandated location for such
> data, and everything in this directory (not just the secrets.tdb) would
> be relevant to an HA system. There is very little reason why it should
> be necessary to support arbitrary directory paths for these files in a
> Debian system.

I would however warn that you *must not* share a TDB over NFS. This
will only break things.

Andrew Bartlett

--
Andrew Bartlett <email address hidden>
Manager, Authentication Subsystems, Samba Team <email address hidden>
Student Network Administrator, Hawker College <email address hidden>
http://samba.org http://build.samba.org http://hawkerc.net

[Jeff Layton (jtlayton)]

On Wed, 2004-05-19 at 17:33, Steve Langasek wrote:
> Is there a reason you wouldn't symlink or bind-mount /var/lib/samba to
> point to your shared disk? This is the FHS-mandated location for such
> data, and everything in this directory (not just the secrets.tdb) would
> be relevant to an HA system. There is very little reason why it should
> be necessary to support arbitrary directory paths for these files in a
> Debian system.

There's one major reason to do so. If you're running more than one samba
daemon (or program for that matter) on the box. A little about my setup:

I have 2 machines acting as a small cluster with heartbeat. They have an
IP address that fails over between them, depending on which one is
active. Samba fails over and is set up using 'bind interfaces only' to
listen on this address. I also have 'netbios name' set in smb.conf.

I'm also running winbind on this machine to handle authentication.
Winbind uses the hostname of the box as its netbios name. So, we have a
problem here. The machine account info is stored in secrets.tdb, but we
have 2 machine accounts that we have to deal with. One for the samba
daemon (working on the floating IP address), and one for winbind.

I don't have a problem with FHS (actually it's a great standard). I just
need it to work when I override the default settings. I'm not certain
that the --with-fhs setting is the problem here either, but it seemed
like the only configure setting that dealt with changing the location of
private dir, and I didn't use it when I built samba for my Solaris
boxes.

Thanks,
Jeff

[Jeff Layton (jtlayton)]

Actually, I need to correct my correction...

fhs.patch _is_ applied to this version of samba. I got thrown off by the
versioned directory in the patch, but then noticed it got applied when I
started building a new package.

Out of curiosity, it looks like the stock samba sources have a
--with-fhs option. Is this config option not sufficient? I don't have a
problem with adding patches to make things go in more FHS compliant
locations, but they really shouldn't break smb.conf options.

-- Jeff

[Eugene V Budnikov (sandworm-chevy-niva)]

Package: samba
Version: 3.0.14a-6

qemu uses samba to share host fs in guest m$ os. it runs
smbd by unprivileged user (who runs qemu itself) with own
smb.conf like this:

[global]
private dir=/tmp/qemu-smb.11289
smb ports=0
socket address=127.0.0.1
pid directory=/tmp/qemu-smb.11289
lock directory=/tmp/qemu-smb.11289
log file=/tmp/qemu-smb.11289/log.smbd
smb passwd file=/tmp/qemu-smb.11289/smbpasswd
security = share
[qemu]
path=/home/user/SMB_QEMU
read only=no
guest ok=yes

but smbd with fhs.patch ignores private dir option, tries to
open /var/lib/samba/secrets.tdb instead of
/tmp/qemu-smb.11289/secrets.tdb and fails because this file
is closed for unprivileged user.

well, i've changed the permissions for all smbd-related
files in /var tree, but it also causes a conflict when i'm
running two qemus at the same time.

[Peter Eisentraut (petere)]

# Automatically generated email from bts, devscripts version 2.9.10
tags 247163 + confirmed
reassign 249873 samba
tags 249873 + confirmed

[Christian Perrier (bubulle)]

These bugs should be, in my personal opinion, one of the first targets
for us.

They virtually forbid running two concurrent instances of samba on the
same machine which is a feature often needed on some kind of
production machines.

As a consequence, the only choice of people who want to run such
production machines is by recompiling their own packages *without* the
fhs.patch applied....and thus no more benefit from the status of
"official" Debian packages.

Steve mentioned in the last comments that reworking the fhs.patch to
make it not break the "lock dir" and "private dir" options needs
someone with a good understanding of involved issues. It also requires
a good understanding of the code, by the way....

So, please please, if someone has some time to give to samba package
enhancement, work on these bugs, they deserve it.

And, no, as far as I've seen, I just can't. My coding skills are way
too low and I would proceed by analogy and rough guessing, which is
not a very good idea, here.

--

[Nicolò Chieffo (yelo3)]

hello, I'm using qemu with the option -smb which is a way to enable a samba server in the network emulated in the qemu virtual machine.
-smb option generates on the fly a new smb.conf stored in /tmp with a new share called [qemu] (I can specify the directory "-smb dir").
this option enables ip 10.0.2.4 in the virtual machine to be a samba server, but which I try to browse it, there are some errors and the process smbd on the host machine, launched by qemu goes in [defunct]

if I launch qemu as root this problem doesn not occurr, but the new share is not enabled. I think it could be that smbd doesn't care about the new smb.conf and it uses the default one. could it be so?

[Rodrigo Novo (rodarvus)]

I have just released an updated version of qemu on Ubuntu Edgy. Please check if possible, please check if this version fixes your problem.

Thank you in advance!

[Nicolò Chieffo (yelo3)]

using qemu 0.8.2-0ubuntu1 and samba 3.0.22-1ubuntu4.
No, smbd processes are still in <defunct> when querying the qemu smb host

[Peter Eisentraut (petere)]

# Automatically generated email from bts, devscripts version 2.9.21
forcemerge 247163 249873 268010
forwarded 247163 https://bugzilla.samba.org/show_bug.cgi?id=4105

[Nicolò Chieffo (yelo3)]

Do you need other information?

[Alejandro R. Mosteo (mosteo)]

I can confirm this problem, also running Edgy fully updates as of 02/Nov/07. However, in my case, running as root causes a busy loop in qemu leaving it unresponsive. Also CPU goes to 100% in kernel mode, which may imply that the problem is in the kqemu accelerator.

[Raul Sanchez Siles (rasasi78)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

  Hello:

  I'm quite interested in this issue. I need to run qemu with the -smb with
creates a private samba shared dir which is expected to be managed by a
different smbd process.

  I've also taken a look at #247163 and #268010. Last comment on those are 1+
year old!.

  I've taken the comment in the qemu faq to rebuild the package without
the -with-fhs option, but this isn't trivial. Maybe the fhs.patch has
something which prevents compilation. I've also tried not including fhs.patch
but I also failed.

  Just in case I did a debuild from the sources as is, and it succeeded.

  Also I transcribe a conversation held at #samba-technical on
irc.freenode.org:

<LinuxCart> well, in general, any comment to this:
https://bugzilla.samba.org/show_bug.cgi?id=4105
<coffeedude> LinuxCart: #1 I could swallow, but #2 & #3 are not really good
solutions IMO.
<LinuxCart> and what now, I mean would it be possible to have some feedback to
this bug: what is the proposed solution?
<LinuxCart> is this bug specific to debian?
<coffeedude> LinuxCart: I don't think debian specific. But more packaging
specific. Like i said, the *.dat files I could se. But splitting the tdb
files just gives me a headache. If someone submitting a decent patch I would
consider it, but I'm not going to spend the time writing it right now.
<LinuxCart> ok, would you mind I inform debian about that?
<LinuxCart> well, I'm far from knowing details about samba but I don't think
#1 is a problem at all, as you say it's more packaging specific
<coffeedude> LinuxCart: sure. If it's a real problem, tell the debian folks
to ping me.

  As you can see LinuxCart is the ignorant AKA me, and coffeedude is one of
the samba gurus :D

  Hope this helps anyway.

  Regards,

- --
     Raúl Sánchez Siles
- ----->Proud Debian user<-----
Linux registered user #416098
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFFz6SISbRPhLCoLYYRAraWAJ9+IwFAXNJG9WWiXDuU16Xrt8Z9GwCfYNMV
CYi2VjC5SGFcHO9bCxNQu8k=
=Hxqd
-----END PGP SIGNATURE-----

[gmlion (gm-l)]

Have you tried Fesity beta?

[Christian Perrier (bubulle)]

forcemerge 247163 297925
thanks

--

[Alexandre Maciel (amaciel81)]

Hi,

I tried QEMU with Feisty and I have a similar problem, but I can't run smbd even if I run qemu as root. Using strace, I can see that qemu creates a dir called /tmp/qemu-pidnumber and create a smb.conf file inside it, but doesn't run smbd.

When I try run smbd manually (as non-root user) I got this following message:

amaciel@bahamut:/tmp/qemu-smb.5314$ smbd -i -s smb.conf
smbd version 3.0.24 started.
Copyright Andrew Tridgell and the Samba Team 1992-2006
file_init: Information only: requested 10000 open files, 1004 are available.
Failed to open /var/lib/samba/secrets.tdb
===============================================================
INTERNAL ERROR: Signal 11 in pid 5439 (3.0.24)
Please read the Trouble-Shooting section of the Samba3-HOWTO

From: http://www.samba.org/samba/docs/Samba3-HOWTO.pdf
===============================================================
PANIC (pid 5439): internal error
BACKTRACE: 10 stack frames:
 #0 smbd(log_stack_trace+0x22) [0x823e0b2]
 #1 smbd(smb_panic+0x43) [0x823e193]
 #2 smbd [0x822c2ca]
 #3 [0xffffe420]
 #4 /lib/tls/i686/cmov/libc.so.6(vsnprintf+0xb4) [0xb7bd8b54]
 #5 /lib/tls/i686/cmov/libc.so.6(snprintf+0x35) [0xb7bbf695]
 #6 smbd(pidfile_create+0x22d) [0x822df4d]
 #7 smbd(main+0x943) [0x82da143]
 #8 /lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xdc) [0xb7b8febc]
 #9 smbd [0x808c7e1]
unable to change to /var/log/samba/cores/smbdrefusing to dump core

It may be a error, because I guess that smbd don't needs to access this file (/var/lib/samba/secrets.tdb), because the smb.conf specifies that all files must be created and used by /tmp/qemu-pidnumber/ dir.

To make things more complicated, when I run smbd manually with root user, smbd starts without any problem. Maybe we have a couple of problems, I don't know.

Well, if you need anything, please, contact me. I will be glad helping to solve this problem (sorry for my terrible English).

Best regards,
Alexandre

P.S.: don't you think that is a good idea makes qemu package recommends the samba package?

[TJ (tj)]

This issue still affects Feisty running stock installations of samba. The issue is in samba but affects QEMU.

It appears the issue is that the samba packages for Debian/Ubuntu are compiled with the fhs.patch applied, which prevents samba from using a private secrets directory.

There has been ongoing commentary for several years on the debian bug tracker:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=249873

Quote:

but smbd with fhs.patch ignores private dir option, tries to
open /var/lib/samba/secrets.tdb instead of
/tmp/qemu-smb.11289/secrets.tdb and fails because this file
is closed for unprivileged user.

[TJ (tj)]

This is a known issue upstream with debian samba package patches

[Joe Soroka (launchpad-joesoroka)]

Another thing to watch out for is that qemu only listens on 10.0.2.4 port 139. I just tried smbclient on feisty and it seems to try port 445 first, by default, and that ends up going straight to the host smbd rather than the qemu-controlled phony one. Try "smbclient -p 139 //10.0.2.4/qemu" and see if that helps.

[Marcus Better (mbetter)]

# Automatically generated email from bts, devscripts version 2.10.9
package qemu
block 419515 with 249873
found 419515 0.9.0+20070816-1

[Matthew Nuzum (newz)]

I'm testing with hardy and am experiencing this same problem.

Through the development period the problem has changed slightly. At the moment, just after alpha6, the problem is that the guest and the host can't talk to each other.

Thanks Joe, your tip helped. Without the -p 139 then smbclient -L returns the output of wrong share.

Here's how I'm launching the guest:

    kvm -m 128 -boot c -hda testserver1.img -smb /home/matt/

My gest is Hardy JeOS. I install smbclient in the guest and run this command:

    smbclient -L 10.0.2.4 -p 139

And I get:

Receiving SMB: Server stopped responding
session request to 10.0.2.4 failed (Call returned zero bytes (EOF))
Receiving SMB: Server stopped responding
session request to 10 failed (Call returned zero bytes (EOF))
Receiving SMB: Server stopped responding
session request to *SMBSERVER failed (Call returned zero bytes (EOF))

Qemu/KVM apparently creates a temporary smb.conf file in /tmp. In my case it is at /tmp/qemu-smb.26658/smb.conf and the contents of the file are:

-- begin smb.conf --
[global]
private dir=/tmp/qemu-smb.26658
smb ports=0
socket address=127.0.0.1
pid directory=/tmp/qemu-smb.26658
lock directory=/tmp/qemu-smb.26658
log file=/tmp/qemu-smb.26658/log.smbd
smb passwd file=/tmp/qemu-smb.26658/smbpasswd
security = share
[qemu]
path=/home/matt/
read only=no
guest ok=yes

-- end smb.conf --

The only other file in that folder is the log file. The log file looks like this:

-- begin log.smbd --
[2008/03/10 15:33:38, 1] smbd/files.c:file_init(193)
  file_init: Information only: requested 10000 open files, 1004 are available.
[2008/03/10 15:33:38, 0] passdb/secrets.c:secrets_init(66)
  Failed to open /var/lib/samba/secrets.tdb
[2008/03/10 15:33:38, 0] lib/messages.c:message_init(132)
  ERROR: Failed to initialise messages database
[2008/03/10 15:33:38, 1] smbd/files.c:file_init(193)
  file_init: Information only: requested 10000 open files, 1004 are available.
[2008/03/10 15:33:38, 0] passdb/secrets.c:secrets_init(66)
  Failed to open /var/lib/samba/secrets.tdb
[2008/03/10 15:33:38, 0] lib/messages.c:message_init(132)
  ERROR: Failed to initialise messages database

-- end log.smbd --

When I try to use smbclient to browse the share using:
    $ smbclient -I 10.0.2.4 //smbserver/qemu

I get this output:
    Password: [I hit enter for blank password]
    Anonymous login successful
    Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.0.28]
    tree connect failed: NT_STATUS_BAD_NETWORK_NAME

There is another entry in the host's /tmp/qemu-smb.26658/log.smbd file matching the ones listed above.

**** NOTE ****
If I don't use the -p 139 option mentioned by Joe above then I also get a message on the host's /var/log/samba/log.{hostname} indicating that there is no share called qemu

    $ smbclient -I 10.0.2.4 //smbserver/qemu

-- begin /var/log/samba/log.webserver --
[2008/03/10 15:39:57, 0] param/loadparm.c:process_usershare_file(4582)
  process_usershare_file: stat of /var/lib/samba/usershares/qemu failed. No such file or directory
[2008/03/10 15:39:57, 0] smbd/service.c:make_connection(1191)
  webserver (127.0.0.1) couldn't find service qemu

-- end log.webserver --

[Jan Evert van Grootheest (j-e-van-grootheest)]

Me too.

As a really ugly workaround I thought about this...
(1) disable samba to run as daemon (add 'exit' in /etc/default/samba)
(2) sudo chmod a+rw /var/run/samba/*.tdb /var/lib/samba/*.tdb

This totally ruins the samba security, I expect. That's why I disabled samba to start as a daemon.

[Jan Evert van Grootheest (j-e-van-grootheest)]

After the workaround I did, samba started and was usable from a w2k in qemu.
(I did start chmodding only one file and manually starting smbd and then it complained about another one and then another one...)

I don't know what's incomplete about this bug and I can confirm that it still exists with hardy packages: qemu 0.9.1-1ubuntu1, samba 3.0.28a-1ubuntu4.

[Dustin Kirkland  (kirkland)]

Can anyone confirm this bug on Intrepid?

Thanks!
:-Dustin

[Christian Perrier (bubulle)]

tags 247163 - patch
thanks

With the changes we made to patches and FHS stuff, the patch provided
in this BR is no longer relevant.

--

[Rich (rincebrain)]

Confirming bug on Intrepid. :/

[Rich (rincebrain)]

Can we please get this fixed, or edit the qemu man page on Ubuntu to document this functionality as broken? It really upset me when I tried to deploy this, and I ended up recompiling a custom samba package with those two patches disabled.

[Dustin Kirkland  (kirkland)]

I spoke with upstream about this, and they indicated that this option is not used very often and if it's broken, it should be removed from the upstream sources.

I have subscribed Anthony Liguori to this bug, who is the upstream qemu maintainer and happens to also be a samba developer.

Anthony-

Can you test this functionality and determine if it's still supported by upstream qemu/kvm?

:-Dustin

[tuxslack (aliguori)]

My name is Agustin Liguori and not Anthony

please check your email

sincerely
Agustin Liguori

On Mon, Mar 9, 2009 at 4:36 PM, Dustin Kirkland
<email address hidden>wrote:

> I spoke with upstream about this, and they indicated that this option is
> not used very often and if it's broken, it should be removed from the
> upstream sources.
>
> I have subscribed Anthony Liguori to this bug, who is the upstream qemu
> maintainer and happens to also be a samba developer.
>
> Anthony-
>
> Can you test this functionality and determine if it's still supported by
> upstream qemu/kvm?
>
> :-Dustin
>
> --
> samba can't be launched by a normal user (qemu related)
> https://bugs.launchpad.net/bugs/50385
> You received this bug notification because you are a direct subscriber
> of the bug.
>
> Status in “kvm” source package in Ubuntu: Incomplete
> Status in “qemu” source package in Ubuntu: Confirmed
> Status in “samba” source package in Ubuntu: Confirmed
> Status in “qemu” source package in Debian: Confirmed
>
> Bug description:
> hello, I'm using qemu with the option -smb which is a way to enable a samba
> server in the network emulated in the qemu virtual machine.
> -smb option generates on the fly a new smb.conf stored in /tmp with a new
> share called [qemu] (I can specify the directory "-smb dir").
> this option enables ip 10.0.2.4 in the virtual machine to be a samba
> server, but which I try to browse it, there are some errors and the process
> smbd on the host machine, launched by qemu goes in [defunct]
>
> if I launch qemu as root this problem doesn not occurr, but the new share
> is not enabled. I think it could be that smbd doesn't care about the new
> smb.conf and it uses the default one. could it be so?
>

--
   Agustín Liguori

[Jamin W. Collins (jcollins)]

I can confirm that this is still a problem with jaunty.

[Dustin Kirkland  (kirkland)]

Talked to Anthony Liguori again...

He's going to post a note to the qemu-devel list. This code (samba in qemu) has rotted and is more or less unmaintainable, as it's designed horrible (uses a config in /tmp, requires privileges).

Most likely the "fix" for this is going to come in karmic, merging a new QEMU release that removes this option altogether.

:-Dustin

[Dustin Kirkland  (kirkland)]

Okay, I confirmed this on qemu-kvm in karmic. I'm not real sure if what I'm doing is correct, but I couldn't get it working.

Upstream confirms that this should probably work. In any case, I won't be fixing this in qemu or kvm in =< Jaunty.

:-Dustin

[Mark Warriner (warriner)]

This is a Debian/Ubuntu specific samba bug, as explained in comment #7 above. It is not a qemu or kvm bug. The QEMU -smb option works fine in many other distributions, where it can be run as a normal user without special permissions, and with multiple instances on the same machine. This is a fantastic feature, and I hope the samba patch can be fixed so we can support it in Debian/Ubuntu.

Note: I believe the -smb option was recently moved as a sub-option of -net, but it is still supported by QEMU.

[Thierry Carrez (ttx)]

samba uses two directories:
 * private-dir (/etc/samba/private by default) to hold various "secret" tdbs
 * state-dir (/var/lib/samba by default)
fhs-filespaths.patch ensures that for passdb.tdb, secrets.tdb and schannel_store.tdb, we use state-dir instead of private-dir.

qemu overrides private-dir, but not state-dir.

One fix for this bug would be to set private-dir=/var/lib/samba and drop the patch, that would allow qemu to happily override it. The potential regression is about all the other files that use private-dir directly. The only one I could find in code is idmap2.tdb (code in winbindd/idmap_tdb2.c). That one could probably live in /var/lib/samba as well, though it could cause upgrade headaches.

[Jaap Versteegh (j-r-versteegh)]

Issue still exists in lucid. I find this a useful feature, so fix would be welcome.

[Andrew (7andrew)]

Observed this in samba on Maverick. Specifically I'm observing schannel_store.tdb in /etc/samba.
There is a Debian bug #454770 describes this problem but that bug is marked archived because 'Fixed in version samba/2:3.2.0-3'. I'm not sure how that corresponds with version 2:3.5.4~dfsg-1ubuntu8.3 which is the maverick version.

[hamish (hamish-b)]

Hi,

work-around for user accounts you trust as administrators, if you don't want to run everything as root, but are not so insane as to use `chmod a+rw`:

essentially just give the user permission to the files in the /var/lib/samba dir as noted by others earlier.

(as root)
# disable samba startup at boot: (so only qemu's one will be running)
update-rc.d -f samba remove
adduser $YOU adm
chgrp adm /var/lib/samba/*.tdb
chmod g+rw /var/lib/samba/*.tdb

I also applied that to /var/lib/samba/perfmon and the parent dir but I don't know if that is really necessary.

note that
cd /tmp/qemu-smb.1234-0
/usr/sbin/smbd -i -s smb.conf
ends with:
"""
...
Failed to open group mapping ldb '/var/lib/samba/group_mapping.ldb' - '(null)'
...
Abnormal server exit: open_sockets_smbd() failed
BACKTRACE: ...
...
"""

but
C:\> net use e: \\10.0.2.4\qemu

in the WinXP guest works. shrug.

tested in Debian/squeeze + samba 2:3.5.6~dfsg-3squeeze2

:-/

Hamish