I'm using Samba to allow a Linux virtual machine to mount the file system of the host using CIFS, with the Unix extensions enabled.  However, I ran into a problem with symlinks.  The client sees symlinks on the server correctly, *except* if the target exists and is outside of the share.

Example:

(on the server)
$ mkdir dir
$ touch dir/foo
$ ln -s foo dir/bar
$ ln -s /var dir/bla
$ ln -s /missing dir/bla2
$ ls -l dir
lrwxrwxrwx 1 ... bar -> foo
lrwxrwxrwx 1 ... bla -> /var
lrwxrwxrwx 1 ... bla2 -> /missing
-rw-r--r-- 1 ... foo

(on the client)
$ ls -l /mnt/dir
ls: cannot read symbolic link /mnt/dir/bla: Permission denied
total 0
lrwxrwxrwx 1 30001 30000 3 Oct 21 17:47 bar -> foo
lrwxrwxrwx 1 30001 30000 4 Oct 21 17:47 bla
lrwxrwxrwx 1 30001 30000 8 Oct 21 17:47 bla2 -> /missing
-rw-r--r-- 1 30001 30000 0 Oct 21 17:47 foo

Expected results: the client should be able to do readlink() to get the target of the "bla" symlink, i.e., "/var".

The above is with "follow symlinks = yes".  I also tried "follow symlinks = no" and "wide links = yes".  This gives:

$ ls -l /mnt/dir
ls: cannot read symbolic link /mnt/dir/bar: Permission denied
ls: cannot read symbolic link /mnt/dir/bla: Permission denied
total 0
lrwxrwxrwx 1 30001 30000 3 Oct 21 17:50 bar
lrwxrwxrwx 1 30001 30000 4 Oct 21 17:50 bla
lrwxrwxrwx 1 30001 30000 8 Oct 21 17:50 bla2 -> /missing
-rw-r--r-- 1 30001 30000 0 Oct 21 17:50 foo

which is fairly weird (why can "bla2" be read but not "bar"?).

The server is Samba 3.6.1 on NixOS / Linux 2.6.35.14 (older versions have the same problem).  The client is running Linux 2.6.35.14.  The mount options on the client are:

//10.0.2.4/share /mnt cifs rw,relatime,unc=\\10.0.2.4\share,username=,uid=0,noforceuid,gid=0,noforcegid,addr=10.0.2.4,posixpaths,serverino,acl,rsize=130048,wsize=57344 0 0