Oracle ZFS Storage Appliance: Unable to open/write files in a directory under a CIFS share despite ACL configured for 'full access'

Asset ID:	1-72-2172685.1
Update Date:	2017-10-05
Keywords:

Solution Type Problem Resolution Sure

Solution 2172685.1 : Oracle ZFS Storage Appliance: Unable to open/write files in a directory under a CIFS share despite ACL configured for 'full access'

Related Items


Sun ZFS Storage 7420
 Oracle ZFS Storage ZS3-2
 Sun Storage 7110 Unified Storage System
 Oracle ZFS Storage ZS4-4
 Sun Storage 7210 Unified Storage System
 Sun Storage 7410 Unified Storage System
 Oracle ZFS Storage ZS3-4
 Sun ZFS Storage 7120
 Sun Storage 7310 Unified Storage System
 Oracle ZFS Storage Appliance Racked System ZS4-4
 Sun ZFS Storage 7320
 Oracle ZFS Storage ZS3-BA

Related Categories


PLA-Support>Sun Systems>DISK>ZFS Storage>SN-DK: ZS

In this Document

Symptoms

Cause

Solution

References

Created from <SR 3-12782569281>

Applies to:

Oracle ZFS Storage ZS4-4 - Version All Versions and later
Oracle ZFS Storage Appliance Racked System ZS4-4 - Version All Versions and later
Oracle ZFS Storage ZS3-2 - Version All Versions and later
Oracle ZFS Storage ZS3-4 - Version All Versions and later
Oracle ZFS Storage ZS3-BA - Version All Versions and later
7000 Appliance OS (Fishworks)

Symptoms

CIFS users are unable to open or write files in a directory where the ACL grants them full access.

Cause

Having the "Traverse (x)" permission throughout the parent directory hierarchy is necessary to effectively benefit from the granted full access in a subdirectory.

Solution

Add an inheritable "Traverse" permission for "Everyone" on the root directory of the share.

This can be done in the appliance management interface (BUI).

Select the share for editing:

Under the Access tab, edit the Root Directory ACL for Everyone

Set the following permissions:

x Execute File / Traverse Directory
d Inheritance - Apply to directories

To allow users to list the contents of the directories they traverse, also set:

r Read Data / List Directory

The reason that CIFS shares from Windows servers don't need this additional setting is that Microsoft created a special user right , "Bypass Traverse Checking", granted by default to Everyone.

Having this right causes the "Traverse Folders" permission to be ignored. Solaris does not support bypassing Traverse Checking, therefore explicit "Traverse" permission must be granted on the higher level directories.

References

<BUG:15746673> - SMB CANNOT ACCESS SHARE\SUB1\SUB2 WITHOUT SEARCH ACCESS TO SUB1
<NOTE:1439412.1> - Sun Storage 7000 Unified Storage System: Tips for Configuring Shares for Windows clients

Attachments

This solution has no attachment