I'm using full_audit with the below conf - full_audit:prefix = %U|%M|%m|%S With the above conf , %U is supposed to show the "initial user" at time of connection to the share. However in shares where i have set force user = bit full_audit logs %U as bit , for example - Apr 19 13:33:21 backend smbd[24603]: bit|192.168.1.14|turn|cache|open|ok|r|drivers/wlan/Realtek RTL8191SE sp47860.exe No matter what user connects to the share , %U always expands to the force user setting. In vfs_full_audit.c , audit_prefix calls -> talloc_sub_advanced which seems to return the wrong value for %U . I have checked in non-talloc versions of samba going back to 3.0.2x and there i couldn't find this bug. In these old versions , %U expands correctly to the connecting user.
The problem occurs in the newer make_serverinfo_from_username() function - this uses the new unix username for both the SMB users as for the unix user. I have a fix for this. Jeremy.
Created attachment 7471 [details] Patch for 3.5.x. Can you try this patch to see if it fixes your issue in 3.5.x ? If so I'll upload git-am fixes for 3.5.x and 3.6.x and get them reviewed for the next releases. Jeremy.
Created attachment 7476 [details] git-am fix for 3.5.x. Based on what went into master.
Created attachment 7477 [details] git-am fix for 3.6.x.
Sorry for the delay in a reply , been away on business quite a bit since i posted this bug. I will test this patch against samba 3.5.4 on a maverick server which has the bug. Also, most of my primary servers are on lucid 10.04 which has samba 3.4.7 , can you make a patch for 3.4.7 which i can test too ? Cause even 3.4.7 has the same bug , but 3.4.3 on an older server seems to work fine.
Comment on attachment 7477 [details] git-am fix for 3.6.x. Looks ok
Comment on attachment 7476 [details] git-am fix for 3.5.x. Looks ok
Karolin, please pick for the releases
Pushed to v3-5-test and v3-6-test. Closing out bug report. Thanks!
(In reply to comment #7) > Comment on attachment 7476 [details] > git-am fix for 3.5.x. > > Looks ok Writing "Looks OK" seems to have taken precedence over giving review flag "-" ... ;-)
Comment on attachment 7476 [details] git-am fix for 3.5.x. Fix review flag
(In reply to comment #10) > (In reply to comment #7) > > Comment on attachment 7476 [details] [details] > > git-am fix for 3.5.x. > > > > Looks ok > > Writing "Looks OK" seems to have taken precedence over giving review flag "-" > ... ;-) plus Metze's "Karolin, please pick for the releases" it's pretty clear that the "-" was an accident.