KB-2139: Access denied when browsing symlinks outside the Samba share.

Home >

KB-2139: Access denied when browsing symlinks outside the Samba share.

Product:

Centrify DirectControl , Centrify DirectControl Plugins ,

Published:

12 April,16 at 11:02 AM

Rating:

Applies to:
Centrify-Enabled samba 3.5.5-cdc-4.5.0-450 or above on Redhat Linux

Problems:
After upgrading to Centrify-Enabled Samba, the user cannot browse any symlinks outside the share and the prompt returns "Access Denied".

The following can be found in the samba log:

===

    [2011/09/07 11:18:29.204622, 2] smbd/vfs.c:967(check_reduced_name)
    [2011/09/07 11:18:29.204627, 10] ../lib/util/util.c:278(_dump_data)
      smb_vwv[ 2]=    0 (0x0)
      smb_vwv[ 3]=    2 (0x2)
      check_reduced_name: Bad access attempt: log/desktop.ini is a symlink outside the share pat
    seems like the wide links parameter does not work
.
.
.
    [2011/09/07 11:18:54.722166, 0] param/loadparm.c:9924(widelinks_warning)
      Share 'public' has wide links and unix extensions enabled. These parameters are incompatible. Wide links will be disabled for this share.

===

Cause:
This is caused by a security release where the "wide links" parameter is conflicting with the "unix extensions" parameter.

Resolution:
In /etc/samba/smb.conf, set:

unix extensions = no

And set:

wide links = yes

under the share section.

Restart samba with:

/etc/init.d/centrifydc-samba restart

Reference:
https://bugzilla.samba.org/show_bug.cgi?id=7756