Re: SMB3 Unix Extensions - creating special files

Matthew Richardson via samba <[email protected]> Mon, 9 Mar 2026 11:09:31 +0000
Newsgroups	gmane.network.samba.general
Message-ID	<[email protected]>

On 03/03/2026 01:13, Jeremy Allison wrote:
> On 3/2/26 4:41 PM, Nikkos Svoboda via samba wrote:
>>
>>    Jumping in here briefly, I believe the "default" symlink style 
>> requested by the client mount options is now "symlink=native", which 
>> creates the 0-sized files with extended attributes on the server.
>>
>>    I'd also like to know:  Is it intended to allow creation of 
>> "actual" symlinks on a supported server filesystem via unix 3.1.1 
>> Extensions? The mount option "symlink=unix" (which creates "actual" 
>> symlinks on the server), when used with SMB 3.1.1 unix extensions, 
>> causes symlink creation to fail on the client with "Operation not 
>> supported" (client kernel 6.17, ubuntu 24.04). That mount option 
>> appears to be referred to as "SMB1 unix create symlink command" which 
>> I presume means it is limited to the SMB1 unix extensions.
>>
>>    The archived e-mail conversation chain here (though it includes 
>> some outdated information) helped me to understand some of what the 
>> symlink= and reparse= mount options were intended for:
>> https://lwn.net/ml/all/20241007183650.aw3skuztljpgk2bs@pali/
> 
> The goal (at least when I was involved with this effort) was to
> explicitly *ban* SMB3 UNIX extensions ever from creating server-side
> symlinks.
> 
> Such activities are inherently unsafe and a source of many, many
> CVE's.
> 

Apologies I have distracted everyone by using symlinks in my example 
issue - however the same situation also occurs with other special files, 
not just symlinks.

For clarity I should also highlight that this is really an ongoing 
thread from this previous one back from last July when I first 
identified issues with special files and posix options:

https://lists.samba.org/archive/samba/2025-July/251886.html

An example with FIFOs:

On the samba client mount, a 'real' FIFO created directly on the fs 
appears correctly:

/mnt/smb > stat local_fifo

   File: local_fifo
   Size: 1024            Blocks: 0          IO Block: 16384  fifo
Device: 0,114   Inode: 1099511628603  Links: 1

However FIFOs created from samba aren't 'real' FIFOs:

/mnt/smb > mkfifo smb_fifo
 > stat smb_fifo
   File: smb_fifo
   Size: 1024            Blocks: 0          IO Block: 16384  fifo
Device: 0,114   Inode: 1099511630035  Links: 1

However again on the real FS the FIFO is actually an empty file with 
attr metadata:

/mnt/real > stat smb_fifo
stat smb_fifo
   File: smb_fifo
   Size: 0               Blocks: 0          IO Block: 4194304 regular 
empty file
Device: 30h/48d Inode: 1099511630035  Links: 1

/mnt/real > getfattr smb_fifo
# file: smb_fifo
user.DOSATTRIB
user.NTACL
user.SmbReparse


Any advice on debugging this further appreciated - happy to provide 
packet captures etc if that's useful!


Thanks,

Matthew

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba
OpenPGP_signature.asc (application/pgp-signature, 203 B)