Bug 15871 - "An invalid HANDLE was specified" error when trying to set an ACL with samba-tool gpo
Summary: "An invalid HANDLE was specified" error when trying to set an ACL with samba-...
Status: NEW
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: Other (show other bugs)
Version: 4.22.2
Hardware: s390 All
: P5 normal (vote)
Target Milestone: ---
Assignee: Samba QA Contact
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-06-18 13:33 UTC by Andreas Hasenack
Modified: 2025-06-18 20:56 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Hasenack 2025-06-18 13:33:39 UTC
I have a test that at some point runs this command:

samba-tool gpo manage motd set "${GPO}" "${motd_text1}" -U "Administrator%${adminpass}"

When it is run on s390x hardware, it crashes:

ERROR(runtime): uncaught exception - (3221225480, 'An invalid HANDLE was specified.')
  File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 356, in _run 
    return self.run(*args, **kwargs)
           ~~~~~~~~^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/samba/netcmd/gpo.py", line 3854, in run
    reg.increment_gpt_ini(machine_changed=True)
    ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/samba/policies.py", line 198, in increment_gpt_ini
    self.__save_file(self.pol_dir % '', GPT_INI,
    ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                     out_data.read().encode('utf-8'))
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/samba/policies.py", line 99, in __save_file
    self.conn.set_acl(file_name, self.fs_sd)
    ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/samba/samba3/libsmb_samba_internal.py", line 128, in set_acl
    self.set_sd(fnum, sd, sinfo)
    ~~~~~~~~~~~^^^^^^^^^^^^^^^^^

I bumped the logs to 10, but didn't spot anything obvious (to me). The motd text is set correctly in the manifest:

# cat /var/lib/samba/sysvol/example/Policies/\{31B2F340-016D-11D2-945F-00C04FB984F9\}/MACHINE/VGP/VTLA/Unix/MOTD/manifest.xml
;echo
<?xml version='1.0' encoding='UTF-8'?>
<vgppolicy><policysetting><version>1</version><name>Text
File</name><description>Represents a Generic Text
File</description><apply_mode>replace</apply_mode><data><filename>motd</filename><text>hello-there</text></data></policysetting></vgppolicy>


The manifest.xml file does get posix acls, if that matters:

# getfacl /var/lib/samba/sysvol/example/Policies/\{31B2F340-016D-11D2-945F-00C04FB984F9\}/MACHINE/VGP/VTLA/Unix/MOTD/manifest.xml
getfacl: Removing leading '/' from absolute path names
# file: var/lib/samba/sysvol/example/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/VGP/VTLA/Unix/MOTD/manifest.xml
# owner: BUILTIN\\administrators
# group: users
user::rwx
user:root:rwx                   #effective:r--
user:BUILTIN\\administrators:rwx        #effective:r--
user:BUILTIN\\server\040operators:r-x   #effective:r--
user:NT\040Authority\\system:rwx        #effective:r--
user:NT\040Authority\\authenticated\040users:r-x        #effective:r--
group::---
group:BUILTIN\\administrators:rwx       #effective:r--
group:BUILTIN\\server\040operators:r-x  #effective:r--
group:NT\040Authority\\system:rwx       #effective:r--
group:NT\040Authority\\authenticated\040users:r-x       #effective:r--
mask::r--
other::---


There are two GPT.INI files:

root@ad:~# getfacl
"/var/lib/samba/sysvol/example/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/GPT.INI"
getfacl: Removing leading '/' from absolute path names
# file: var/lib/samba/sysvol/example/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/GPT.INI
# owner: EXAMPLE.FAKE\\domain\040admins
# group: EXAMPLE.FAKE\\domain\040admins
user::rwx
user:root:rwx
user:BUILTIN\\administrators:rwx
user:BUILTIN\\server\040operators:r-x
user:NT\040Authority\\system:rwx
user:NT\040Authority\\authenticated\040users:r-x
group::rwx
group:BUILTIN\\administrators:rwx
group:BUILTIN\\server\040operators:r-x
group:NT\040Authority\\system:rwx
group:NT\040Authority\\authenticated\040users:r-x
mask::rwx
other::---


root@ad:~# getfacl
"/var/lib/samba/sysvol/example/Policies/{6AC1786C-016F-11D2-945F-00C04FB984F9}/GPT.INI"
getfacl: Removing leading '/' from absolute path names
# file: var/lib/samba/sysvol/example/Policies/{6AC1786C-016F-11D2-945F-00C04FB984F9}/GPT.INI
# owner: EXAMPLE.FAKE\\domain\040admins
# group: EXAMPLE.FAKE\\domain\040admins
user::rwx
user:root:rwx
user:BUILTIN\\administrators:rwx
user:BUILTIN\\server\040operators:r-x
user:NT\040Authority\\system:rwx
user:NT\040Authority\\authenticated\040users:r-x
group::rwx
group:BUILTIN\\administrators:rwx
group:BUILTIN\\server\040operators:r-x
group:NT\040Authority\\system:rwx
group:NT\040Authority\\authenticated\040users:r-x
mask::rwx
other::---

They have slightly different content:

root@ad:~# cat "/var/lib/samba/sysvol/example/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/GPT.INI"
[General]
Version = 1

root@ad:~# cat "/var/lib/samba/sysvol/example/Policies/{6AC1786C-016F-11D2-945F-00C04FB984F9}/GPT.INI"
[General]
Version=0

(there was no \n at the end of the one above, after the zero, if that matters).
Comment 1 Douglas Bagnall 2025-06-18 20:56:11 UTC
This might be an endian thing if it is s390 specific.