Linux and CIFS files permissions

Kill Active SSH Session
Force close active SSH connections after a defined time interval
March 21, 2018
Show all

Linux and CIFS files permissions

Since I spend almost every day working with the Azure Cloud, these days I’ve been playing around with the Azure File Share and Linux.

One of the 1st thing I found out while trying to document myself about this is that the most common questions people have related to SMB/CIFS are about permissions and permanence of the mount.

If you ever followed (I did) the guide in https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-use-files-linux#create-a-persistent-mount-point-for-the-azure-file-share-with-etcfstab, after hiding your credentials part,  you probably noticed the command used to add your mount to the /etc/fstab at stept 5:

Using the parameter “dir_mode=0777,file_mode=0777“, your are basically allowing everyone logged in to write files there.

And most likelly, like I did, you tried to change the ownership and permissions on the mount point:

Guess what … nothing happened.

No error whatsoever, but the permissions and ownership remained unchanged.

So I got back to the man pages, wiki and all available search engines.. and found:

  • The files permission on CIFS filesystems cannot be changed post mount. The command to change the permissions will execute, provide no error, but will do no actual change.
  • The permissions can be set only during the mount process. The permissions will not be saved to the files! (unmount the share and mount it back with different permissions, you will see the new permissions on the files too).

  • If you mount the same share on another server with different permissions, those permissions will be valid too, at least as long the share is mounted.

Therefore, if you want your files to be accessed only by specific user from a specific group, then the above mount command should look like:

To find out the uid and gid values, just type:

$ id username

e.g.

So, if I want a mount to that only azureuser can access and his primary group (in this case named azureuser also), your mount command to add the entry in /etc/ftsab should be like:

If you need other accounts to have access to the same share, it’s enough to add the new accounts to the “azureuser” group:

$ sudo usermod -a -G azureuser new_account_name_here

This is by design and is nothing we can do to change this.

The behavior is caused by the way the CIFS implementation is done in Linux. Please take into account that CIFS is basically a hybrid way to connect to Windows Shares from Linux machines. The permissions on files are handled differently on the 2 systems.

As far I’m aware, there’s no intention in changing this from the CIFS developers (which is an Open Source Community) into the CIFS implementation.

Links to official CIFS page and documentation:

https://wiki.samba.org/index.php/LinuxCIFS_utils

https://pserver.samba.org/samba/ftp/cifs-cvs/linux-cifs-client-guide.pdf

 

 

 

Marin Nedea
Marin Nedea
I'm passionate about open source software and technologies. In my spare time I build simple and functional websites from scratch, using PHP+HTML5+CSS3+MySQL and when I'm bored, I write simple PHP_CLI or bash scripts to play around on my Linux machine.

Leave a Reply

By continuing to use the site, you agree to the use of cookies. more information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.

Close