Does vfs_winmsa work in 13.0-U6.2?

TrueNAS General
,
1

I’m trying to get the behavior described for vfs_winmsa: when moving a file to a directory on the same share but with different ACLs than the original directory, I want the file to inherit heritable permissions from the target directory. I have added winmsa to the list of vfs objects for the share:

vfs objects = winmsa full_audit fruit streams_xattr shadow_copy_zfs ixnas zfs_core aio_fbsd

But I’m not noticing any effect from adding that. File ACLs prior to move:

# file: NetScans/Archaeology/YYY.pdf
# owner: ZZZ\XXXnetscan
# group: wheel
user:ZZZ\XXXnetscan:rwxpDdaARWc--s:------I:allow
group:ZZZ\XXX_dept_archaeology:rwxpDdaARWc--s:------I:allow
group:ZZZ\XXX_dept_it_admin-netids:rwxpDdaARWcCos:------I:allow
            owner@:------aARWcCos:------I:allow
            group@:------a-R-c--s:------I:allow

ACLs of directory I’m moving it into:

# file: XXXIT/
# owner: root
# group: wheel
group:ZZZ\XXX_dept_it_staff:rwxpDdaARWc--s:fd----I:allow
group:ZZZ\XXX_dept_it_admin-netids:rwxpDdaARWcCos:fd----I:allow
            owner@:------aARWcCos:fd----I:allow
            group@:------a-R-c--s:fd----I:allow

File ACLs after moving it with Windows file explorer:

# file: XXXIT/YYY.pdf
# owner: ZZZ\XXXnetscan
# group: wheel
user:ZZZ\XXXnetscan:rwxpDdaARWc--s:------I:allow
group:ZZZ\XXX_dept_archaeology:rwxpDdaARWc--s:------I:allow
group:ZZZ\XXX_dept_it_admin-netids:rwxpDdaARWcCos:------I:allow
            owner@:------aARWcCos:------I:allow
            group@:------a-R-c--s:------I:allow

I feel like there’s probably something obvious I’m not noticing, but can anyone confirm that 1) that’s what vfs_winmsa is supposed to do, and 2) it works on 13.0-U6.2?

2

vfs_winmsa works as intended for the customer that required its development. This is intentionally not a feature we expose to the community and do not provide community support for it.

That said, the user moving files around may not have permissions to change its ACL. Errors appear in /var/log/samba4/log.smbd (though some require boosting logging to DEBUG).

3

Ah, yup. It is indeed a permissions problem, the difference between “c” and “cC”. Thanks!