Samba -- permission denied writing to share

Can’t create file on mounted samba share

Steps to Reproduce

  1. Hook external ORICO usb3 hard drive enclosure to Olimex HSK Pioneer Freedombox
  2. decrypt harddrives
    blkid -o uuid /dev/sd{a3,b3}
    cryptsetup open /dev/sda3 uuid-a3
    crypsetup open /dev/sdb3 uuid-b3
  3. btrfs device scan /dev/mapper/uuid-a3 /dev/mapper/uuid-b3
    mount -L BTROOT /media/root/BTROOT
root@freedombox:~# btrfs fi show /media/root/BTROOT/
Label: 'BTROOT'  uuid: 5487d18b-bd2f-45c9-b2c7-893d269977c9
	Total devices 2 FS bytes used 164.72GiB
	devid    1 size 1.82TiB used 342.01GiB path /dev/mapper/90745598-1d10-42cd-9944-be3d6a763b21
	devid    2 size 1.82TiB used 342.01GiB path /dev/mapper/2111d050-9209-4956-a835-a803bcef6aa6
...
create btrfs mirror raid named "smb"
btrfs subvolume create /media/BTROOT/smb

3) On Freedombox SAMBA configuration page, choose "smb" as directory to share
Enable Group Share "smb_group" and Home Share "smb_home"

root@freedombox:~# cat /etc/samba/smb-freedombox.conf | grep -v “^[[:space:]]*#” | grep -v “^$”
[global]
workgroup = WORKGROUP
log file = /var/log/samba/log.%m
max log size = 1000
logging = file
panic action = /usr/share/samba/panic-action %d
server role = standalone server
map to guest = bad user
deadtime = 5
registry shares = yes


On client machine "Pop!_Os", run smb4k to mount cifs/samba share from FREEDOMBOX

...
Pop!_Os# mount | grep cifs
//freedombox/smb_home on /home/jeremy/smb4k/FREEDOMBOX/smb_home type cifs (rw,relatime,vers=3.1.1,cache=strict,username=jeremy,uid=1000,noforceuid,gid=1000,noforcegid,addr=192.168.2.228,file_mode=0755,dir_mode=0755,soft,nounix,setuids,serverino,mapposix,rsize=4194304,wsize=4194304,bsize=1048576,echo_interval=60,actimeo=1,closetimeo=5)
...
 
**Expected Results**
Expect to be able to read and write to cifs share from client

**Actual results**
(I get an error with the following message:)
> Get "permission denied" when trying to create a test file.
...
root@freedombox:~# tail /var/log/samba/log.pop-os 
[2023/01/31 00:38:17.570312,  0] ../../source3/param/loadparm.c:3428(process_usershare_file)
  process_usershare_file: stat of /var/lib/samba/usershares/shared failed. Permission denied
[2023/01/31 00:40:29.134693,  0] ../../source3/param/loadparm.c:3428(process_usershare_file)
  process_usershare_file: stat of /var/lib/samba/usershares/shared failed. Permission denied
...

There doesnt seem to be such a directory:
...
root@freedombox:~# ls /var/lib/samba/usershares/
root@freedombox:~#
...

**Information**
* *FreedomBox version*: You are running Debian GNU/Linux 11 (bullseye) and FreedomBox version 23.2. FreedomBox is up to date. 
* *Hardware*: Olimex Pioneer-FreedomBox-HSK
* *How did you install FreedomBox?*: Re-flashed memory card with latest version of Freedombox,
re-installed batter and rebooted.

Is /media/BTROOT/smb readable by non-root users?

jeremy@freedombox:~$ mount|grep media
/dev/sdd on /media/root/f7cbc7f2-fe57-44e6-b813-8ef26839e776 type btrfs (rw,nosuid,nodev,relatime,space_cache,subvolid=5,subvol=/,uhelper=udisks2)
/dev/mapper/90745598-1d10-42cd-9944-be3d6a763b21 on /media/root/fbx type btrfs (rw,noatime,compress=lzo,space_cache,autodefrag,subvolid=876,subvol=/fbx)
/dev/mapper/90745598-1d10-42cd-9944-be3d6a763b21 on /media/root/BTROOT type btrfs (rw,noatime,compress=lzo,space_cache,autodefrag,subvolid=5,subvol=/)
/dev/mapper/90745598-1d10-42cd-9944-be3d6a763b21 on /media/root/smb type btrfs (rw,noatime,compress=lzo,space_cache,autodefrag,subvolid=877,subvol=/smb)

The share is owned by root.root and only writeable by root but readable by everyone:

jeremy@freedombox:~$ ls -ldn /media/root/smb/FreedomBox/shares/homes/jeremy/
drwxr-xr-x 1 0 0 0 Jan 30 13:23 /media/root/smb/FreedomBox/shares/homes/jeremy/

I only created the btrfs subvolume "smb" mounted at /media/root/BTROOT/smb and /media/root/smb
Freedombox created the rest "FreedomBox/shares/home/jeremy"

I think I had to mount the subvolume "smb" at /media/root/smb so that FreedomBox's Samba configuration could discover the storage and manage it. 
The permissions on the share were created by FreedomBox and I am using the /etc/samba/smb-freedombox.conf file created by FreedomBox and not overriding it.

jeremy@freedombox:~$ ls -l /var/lib/samba/
total 1344
-rw------- 1 root root 421888 Jan 29 16:23 account_policy.tdb
drwxr-xr-x 1 root root 36 Jan 30 03:02 DriverStore
-rw------- 1 root root 696 Jan 29 16:23 group_mapping.tdb
drwxr-xr-x 1 root root 98 Jan 30 03:02 printers
drwxr-xr-x 1 root root 58 Jan 30 03:02 private
-rw------- 1 root root 528384 Jan 30 06:00 registry.tdb
-rw------- 1 root root 421888 Jan 30 03:02 share_info.tdb
drwxrwx–T 1 root sambashare 0 Jan 30 03:01 usershares


jeremy@freedombox:~$ groups
users freedombox-share admin calibre syncthing-access freedombox-ssh

On my client devices this is freedombox.local, so like this:

//freedombox.local/smb_home

I’m not sure if that is relevant or not, it is just something I noticed while I was reading through your notes.

Your mount options have a username listed, but if you want rw you will need both username and password, either in the mount options or in a credential file. I followed these directions to set up a credential file: Samba - ArchWiki

Storing share passwords

Storing passwords in a world readable file is not recommended. A safer method is to use a credentials file instead, e.g. inside /etc/samba/credentials:

/etc/samba/credentials/share

username=*myuser*
password=*mypass*

For the mount command replace username=myuser,password=mypass with credentials=/etc/samba/credentials/share.

The credential file should explicitly readable/writeable to root:

# chown root:root /etc/samba/credentials # chmod 700 /etc/samba/credentials # chmod 600 /etc/samba/credentials/share

This directory is owned by root, not sure why. After a client connection, Samba should have created this directory with correct permissions. Try to delete this directory and re-connect again, maybe it helps.

1 Like

Thanks for the suggestion, vexch & BluishHumility.
I tried vexch’s suggestion of deleting the folder “/media/root/smb/FreedomBox/shares/homes/jeremy”
then reconnecting, which re-created the folder “jeremy” with the correct ownership:

root@freedombox:~# ls -l /media/root/smb/FreedomBox/shares/homes        
total 0
drwxr-xr-x 1 jeremy users 8 Feb  2 04:16 jeremy
root@freedombox:~# ls -ldn /media/root/smb/FreedomBox/shares/homes/jeremy/
drwxr-xr-x 1 10000 100 8 Feb  2 04:16 /media/root/smb/FreedomBox/shares/homes/jeremy/

And now I am able to read and write to the folder.
Thanks for the help.

[SOLVED]

1 Like