The Samba-Bugzilla – Bug 10689
Unable to modify GPFS ACLs through Windows client
Last modified: 2015-03-06 23:30:33 UTC
Created attachment 10069 [details]
I currently have two CIFS-enabled GPFS clusters, both running GPFS 3.0.12, with one using Red Hat 6.3+samba-3.5.10 on the samba servers, the other with Red Hat 6.5+samba-3.6.9. Both installations have ctdb and both use a vfs_gpfs compiled from source (with the samba packages coming from Red Hat and ctdb from CentOS). Both filesystems support nfs4 ACLs only. Both samba clusters are bound to the same AD domain using winbind.
Everything is working as expected in the cluster with samba-3.5.10, but I am having issues with the cluster using samba-3.6.9.
When attempting to use Windows Explorer to set permissions, I receive an error stating that "An error occurred while applying security information to: /path/ The parameter is incorrect." With debugging (level 10) turned on in samba, I receive the following:
[2014/07/02 10:57:12.470444, 8] modules/vfs_gpfs.c:466(gpfsacl_process_smbacl)
gpfs_putacl failed with Invalid argument
I will attach the full log.
Can you try with Samba 4.1?
(In reply to comment #1)
> Can you try with Samba 4.1?
I've thought about it, but I'd prefer to stick with the version of samba that ships with RHEL 6.5
(In reply to comment #2)
> I've thought about it, but I'd prefer to stick with the version of samba that
> ships with RHEL 6.5
Can you contact RedHat and/or IBM the for support? Alternatively, there's paid support available via http://www.samba.org/samba/support/globalsupport.html
Created attachment 10798 [details]
fix calculation of acl_len in struct gpfs_acl
I ran into the same problem with samba 3.6.25 and GPFS 220.127.116.11. It
turned out to be related to the way samba (3.6) calculates the acl_len
field in struct gpfs_acl which is passed to gpfs_putacl(). It seems
that a recent version of GPFS introduced a change to struct gpfs_acl
(as defined in gpfs.h) which results in a wrong value for acl_len.
Samba 4.1.17, which doesn't show this problem, uses a different method
to calculate acl_len. Using that method in 3.6.25 solves the issue
(see attached patch).
Christof, you've been knee deep in the gpfs modules lately :-)
Can we confirm the GPFS version from the original report? GPFS 3.0.12
seems very old, and i am not sure what was supported on that level.
I also did not see any suspicious changes in the vfs_gpfs module
between 3.5.10 and 3.6.9 that would explain this problem.
In case the problem relates to GPFS 3.5: There was a change in a
struct and a change in the vfs_gpfs code is required. The issue has
been fixed with this commit, that is already part of 4.0, 4.1, 4.2 and
Author: Ralph Wuerthner <email@example.comIn casem.com>
Date: Tue Jul 3 11:39:24 2012 +0200
s3:vfs_gpfs: fix ACL length calculation
GPFS 3.5 introduces ACL enhancements which are breaking our ACL length
Signed-off-by: Ralph Wuerthner <firstname.lastname@example.org>
Autobuild-User(master): Christian Ambach <email@example.com>
Autobuild-Date(master): Wed Jul 11 21:28:23 CEST 2012 on sn-devel-104
The proposed patch is just the change from this commit. The patch has
never been backported to 3.6, and 3.6 only receives security patches
at this point. Since this is not a security problem, this patch won't
get included in the 3.6 branch. The 3.6 branch will also be
discontinued when 4.2 is released (see
AFAIK, RHEL does not ship the vfs_gpfs module, and customers build it
on their own. Given that, and that the fix is in all newer branches, i
would suggest to apply the suggested patch when recompiling the
With the release of Samba 4.2, only branches 4.0, 4.1 and 4.2 are
supported. Since all of these branches have the mentioned fix for
the ACL struct change in GPFS 3.5, i am closing this defect.
If there is a different problem, feel free to reopen the defect
and provide more details.