Bug 10689 - Unable to modify GPFS ACLs through Windows client
Summary: Unable to modify GPFS ACLs through Windows client
Alias: None
Product: Samba 3.6
Classification: Unclassified
Component: VFS Modules (show other bugs)
Version: 3.6.9
Hardware: x64 Linux
: P5 regression
Target Milestone: ---
Assignee: Christof Schmitt
QA Contact: Samba QA Contact
Depends on:
Reported: 2014-07-02 16:31 UTC by jfosburg
Modified: 2015-03-06 23:30 UTC (History)
0 users

See Also:

Debug log (53.59 KB, application/octet-stream)
2014-07-02 16:31 UTC, jfosburg
no flags Details
fix calculation of acl_len in struct gpfs_acl (1.07 KB, patch)
2015-02-26 19:20 UTC, Rolf Anders
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description jfosburg 2014-07-02 16:31:05 UTC
Created attachment 10069 [details]
Debug log

I currently have two CIFS-enabled GPFS clusters, both running GPFS 3.0.12, with one using Red Hat 6.3+samba-3.5.10 on the samba servers, the other with Red Hat 6.5+samba-3.6.9.  Both installations have ctdb and both use a vfs_gpfs compiled from source (with the samba packages coming from Red Hat and ctdb from CentOS).  Both filesystems support nfs4 ACLs only.  Both samba clusters are bound to the same AD domain using winbind.

Everything is working as expected in the cluster with samba-3.5.10, but I am having issues with the cluster using samba-3.6.9. 

When attempting to use Windows Explorer to set permissions, I receive an error stating that "An error occurred while applying security information to: /path/ The parameter is incorrect."  With debugging (level 10) turned on in samba, I receive the following:

[2014/07/02 10:57:12.470444,  8] modules/vfs_gpfs.c:466(gpfsacl_process_smbacl)
  gpfs_putacl failed with Invalid argument

I will attach the full log.
Comment 1 Volker Lendecke 2014-07-02 20:43:08 UTC
Can you try with Samba 4.1?


Comment 2 jfosburg 2014-07-02 20:49:48 UTC
(In reply to comment #1)
> Can you try with Samba 4.1?
> Thanks,
> Volker

I've thought about it, but I'd prefer to stick with the version of samba that ships with RHEL 6.5
Comment 3 Volker Lendecke 2014-07-02 20:59:13 UTC
(In reply to comment #2)
> I've thought about it, but I'd prefer to stick with the version of samba that
> ships with RHEL 6.5

Can you contact RedHat and/or IBM the for support? Alternatively, there's paid support available via http://www.samba.org/samba/support/globalsupport.html

Comment 4 Rolf Anders 2015-02-26 19:20:05 UTC
Created attachment 10798 [details]
fix calculation of acl_len in struct gpfs_acl
Comment 5 Rolf Anders 2015-02-26 19:23:19 UTC
I ran into the same problem with samba 3.6.25 and GPFS It
turned out to be related to the way samba (3.6) calculates the acl_len
field in struct gpfs_acl which is passed to gpfs_putacl(). It seems
that a recent version of GPFS introduced a change to struct gpfs_acl
(as defined in gpfs.h) which results in a wrong value for acl_len.

Samba 4.1.17, which doesn't show this problem, uses a different method
to calculate acl_len.  Using that method in 3.6.25 solves the issue
(see attached patch).
Comment 6 Volker Lendecke 2015-03-03 09:58:00 UTC
Christof, you've been knee deep in the gpfs modules lately :-)
Comment 7 Christof Schmitt 2015-03-03 20:25:46 UTC
Can we confirm the GPFS version from the original report? GPFS 3.0.12
seems very old, and i am not sure what was supported on that level.

I also did not see any suspicious changes in the vfs_gpfs module
between 3.5.10 and 3.6.9 that would explain this problem.

In case the problem relates to GPFS 3.5: There was a change in a
struct and a change in the vfs_gpfs code is required. The issue has
been fixed with this commit, that is already part of 4.0, 4.1, 4.2 and

commit 73ede3241e3d8c26f50fbc7bd0762c742dfb3348
Author: Ralph Wuerthner <ralph.wuerthner@de.ibIn casem.com>
Date:   Tue Jul 3 11:39:24 2012 +0200

    s3:vfs_gpfs: fix ACL length calculation
    GPFS 3.5 introduces ACL enhancements which are breaking our ACL length
    Signed-off-by: Ralph Wuerthner <ralph.wuerthner@de.ibm.com>
    Autobuild-User(master): Christian Ambach <ambi@samba.org>
    Autobuild-Date(master): Wed Jul 11 21:28:23 CEST 2012 on sn-devel-104

The proposed patch is just the change from this commit. The patch has
never been backported to 3.6, and 3.6 only receives security patches
at this point.  Since this is not a security problem, this patch won't
get included in the 3.6 branch. The 3.6 branch will also be
discontinued when 4.2 is released (see

AFAIK, RHEL does not ship the vfs_gpfs module, and customers build it
on their own. Given that, and that the fix is in all newer branches, i
would suggest to apply the suggested patch when recompiling the
vfs_gpfs module.
Comment 8 Christof Schmitt 2015-03-06 23:30:33 UTC
With the release of Samba 4.2, only branches 4.0, 4.1 and 4.2 are
supported. Since all of these branches have the mentioned fix for
the ACL struct change in GPFS 3.5, i am closing this defect.

If there is a different problem, feel free to reopen the defect
and provide more details.