Re: With smb1 unix extensions gone, any way to export existing symlinks to Linux clients as symlinks?

Am Mon, 27 Apr 2026 11:46:09 +0200
schrieb Ralph Boehme <[email protected]>:

> On 4/27/26 10:34 AM, Dr. Thomas Orgis via samba wrote:
> > Or is there some sane way to get read-only 'real' symlinks exported to
> > clients with current samba?  
> 
> this should just work. Existing symlinks on the server should be seen as 
> symlinks by the client (via reparse points on the wire).

Oh? That would be cool. This means I'm doing something wrong.

I did not have an option pertaining to that in smb.conf, as the
documentation / info I could find did not suggest that this kind of
read-only symlinks works. Specifically

follow symlinks (S)

    This parameter allows the Samba administrator to stop smbd(8) from
    following symbolic links in a particular share. Setting this
    parameter to no prevents any file or directory that is a symbolic
    link from being followed (the user will get an error). This option
    is very useful to stop users from adding a symbolic link to
    /etc/passwd in their home directory for instance. However it will
    slow filename lookups down slightly. 


The 'user will get an error'? Not the link?  I now added follow
symlinks = no to my smb.conf:

[global]
security = user
map to guest = Bad Password
server role = standalone server
smb ports = 1445
log file = /srv/cernvmfs/smb.log
log level = 0
follow symlinks = no

[cvmfs]
path = /srv/cernvmfs/mount
guest ok = yes
read only = yes

But with that, the link just gets hidden:

server:~# stat /srv/cernvmfs/mount/hello.txt 
  File: /srv/cernvmfs/mount/hello.txt
  Size: 6               Blocks: 8          IO Block: 4096   regular file
Device: 253,7   Inode: 17563651    Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2026-03-15 15:26:39.849351781 +0100
Modify: 2026-03-15 15:26:17.237719073 +0100
Change: 2026-03-15 15:26:17.237719073 +0100
 Birth: 2026-03-15 15:26:17.237719073 +0100
server:~# stat /srv/cernvmfs/mount/hello.link 
  File: /srv/cernvmfs/mount/hello.link -> hello.txt
  Size: 9               Blocks: 0          IO Block: 4096   symbolic link
Device: 253,7   Inode: 17563652    Links: 1
Access: (0777/lrwxrwxrwx)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2026-04-27 13:57:37.585419703 +0200
Modify: 2026-04-27 13:57:36.557433804 +0200
Change: 2026-04-27 13:57:36.557433804 +0200
 Birth: 2026-04-27 13:57:36.557433804 +0200

client:~# stat  /cvmfs/hello.txt
  File: /cvmfs/hello.txt
  Size: 6               Blocks: 8          IO Block: 1048576 regular file
Device: 0,80    Inode: 17563651    Links: 1
Access: (0755/-rwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2026-03-15 15:26:39.849351700 +0100
Modify: 2026-03-15 15:26:17.237719000 +0100
Change: 2026-03-15 15:26:17.237719000 +0100
 Birth: 2026-03-15 15:26:17.237719000 +0100

client:~# stat /cvmfs/hello.link
stat: cannot statx '/cvmfs/hello.link': No such file or directory

client:~# time ls -l /cvmfs
total 4
drwxr-xr-x 2 root root 0 Aug 29  2014 cms.cern.ch
-rwxr-xr-x 1 root root 6 Mar 15 15:26 hello.txt

real    0m0.740s
user    0m0.000s
sys     0m0.002s

(The 'root' on the server is actually an unprivileged user in a
namespace.)

This is without the respective FUSE filesystem (CernVM-FS) being
involved yet, that is in the subdirectory.

The smb.conf is this:

[global]
security = user
map to guest = Bad Password
server role = standalone server
smb ports = 1445
log file = /srv/cernvmfs/smb.log
log level = 0

[cvmfs]
path = /srv/cernvmfs/mount
guest ok = yes
read only = yes

The cvmfs one is mounted on /cvmfs/ on the clients.

Is there something else I need to add to make the symlinks show up? Hm,
maybe on the client side.

client:~# grep cvmfs /proc/mounts 
//server/cvmfs /cvmfs smb3 rw,relatime,vers=3.1.1,cache=strict,username=guest,uid=0,noforceuid,gid=0,noforcegid,addr=172.25.21.182,file_mode=0755,dir_mode=0755,soft,nounix,serverino,mapposix,reparse=nfs,rsize=4194304,wsize=4194304,bsize=1048576,retrans=1,echo_interval=60,actimeo=1,closetimeo=1 0 0

I do not remember to ask for nounix. I did the mount via

	mount -t smb3 -o user=guest,password=foo,port=1445 //server/cvmfs cvmfs/

But I do see that my smbd/smb.conf doesn't offer posix SMB3.11. But
mfsymlinks gives no error … but also no results.

I now realize that I do need support for smb3 unix extensions and that
I run smbd 4.17 on Debian 12, wich is simply too old for this, as it
seems. In this scenario … I in fact can still do this:

server:~# grep protoc  /srv/home/cernvmfs/smb.conf 
server min protocol = NT1
server max protocol = NT1

client:~# mount -t cifs -o user=guest,password=foo,port=1445,vers=1.0 //server/cvmfs /cvmfs/
client:~# grep cvmfs /proc/mounts 
//server/cvmfs /cvmfs cifs rw,relatime,vers=1.0,cache=strict,username=guest,uid=0,noforceuid,gid=0,noforcegid,addr=172.25.21.182,soft,unix,posixpaths,serverino,mapposix,acl,reparse=nfs,rsize=1048576,wsize=65536,bsize=1048576,retrans=1,echo_interval=60,actimeo=1,closetimeo=1 0 0

client:~# stat /cvmfs/hello.link 
  File: /cvmfs/hello.link -> hello.txt
  Size: 9               Blocks: 1          IO Block: 16384  symbolic link
Device: 0,99    Inode: 17563652    Links: 1
Access: (0777/lrwxrwxrwx)  Uid: (187001001/cernvmfs)   Gid: (65534/ nogroup)
Access: 2026-04-27 13:57:37.585419700 +0200
Modify: 2026-04-27 13:57:36.557433800 +0200
Change: 2026-04-27 13:57:36.557433800 +0200
 Birth: -

So goold old CIFS with smb1 unix extensions is what I can do here
without building fresher samba myself … but given that I upgrade smbd,
I could get the same behaviour with posix extensions? Even without
mfsymlinks option (read-only server symlinks)?

I observe one weirdness:

client:~# ls -l  /cvmfs/
ls: /cvmfs/: Permission denied
ls: /cvmfs/hello.txt: Permission denied
ls: /cvmfs/cms.cern.ch: Permission denied
total 5
drwxr-xr-x 120 cernvmfs nogroup 0 Aug 29  2014 cms.cern.ch
lrwxrwxrwx   1 cernvmfs nogroup 9 Apr 27 13:57 hello.link -> hello.txt
-rw-r--r--   1 cernvmfs nogroup 6 Mar 15 15:26 hello.txt

Ah, that's 

getxattr("/cvmfs/hello.txt", "system.posix_acl_access", NULL, 0) = -1 EACCES (Permission denied)

	mount -t cifs -o user=guest,password=foo,port=1445,vers=1.0,noacl

fixes that. I hope client support in mount.cifs for vers=1.0 stays for
a while … it still has (fringe) use cases, apparently.


Alrighty then,

Thomas


PS: I also would like to figure out why

client:~# time ls -l /cvmfs
total 4
drwxr-xr-x 2 root root 0 Aug 29  2014 cms.cern.ch
-rwxr-xr-x 1 root root 6 Mar 15 15:26 hello.txt

real    0m0.740s
user    0m0.000s
sys     0m0.002s

takes rather long to respond. I guess this is CernVM-FS checking its
servers for the plain listing of the cms.cern.ch entry point, while
actual data is cached for quick access — basically the whole point of
FUSE for this. The SMB response for the local file is quick.

client:~# time ls -l /cvmfs/hello.txt
-rwxr-xr-x 1 root root 6 Mar 15 15:26 /cvmfs/hello.txt

real    0m0.002s
user    0m0.000s
sys     0m0.001s

Checking stat of the FUSE mount on the client and server does show a
huge difference though:

server:~# time stat /srv/cernvmfs/mount/cms.cern.ch/
  File: /srv/cernvmfs/mount/cms.cern.ch/
  Size: 4096            Blocks: 9          IO Block: 4096   directory
Device: 0,47    Inode: 256219089   Links: 120
Access: (0755/drwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2014-08-29 10:09:49.000000000 +0200
Modify: 2014-08-29 10:09:49.000000000 +0200
Change: 2014-08-29 10:09:49.000000000 +0200
 Birth: -

real    0m0.001s
user    0m0.000s
sys     0m0.001s

client:~# time stat /cvmfs/cms.cern.ch/
  File: /cvmfs/cms.cern.ch/
  Size: 0               Blocks: 0          IO Block: 1048576 directory
Device: 0,80    Inode: 202119682001  Links: 2
Access: (0755/drwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2014-08-29 10:09:49.000000000 +0200
Modify: 2014-08-29 10:09:49.000000000 +0200
Change: 2014-08-29 10:09:49.000000000 +0200
 Birth: 2014-08-29 10:09:49.000000000 +0200

real    0m0.862s
user    0m0.000s
sys     0m0.001s

Somehow access via smbd results the best part of a second delay. This
might be a performance issue between smbd and cvmfs that could kill
this approach independently of symlinks. The normal way is to re-export
via NFS, but I do want to try to constrain the web-accessing FUSE stuff
in a namespace for a normal user … out of reach of the normal knfsd.

But, wait! If I use smb1 as worked out above, the delay vanishes.

client:~# time stat /cvmfs/cms.cern.ch/
  File: /cvmfs/cms.cern.ch/
  Size: 0               Blocks: 0          IO Block: 1048576 directory
Device: 0,99    Inode: 256219089   Links: 120
Access: (0755/drwxr-xr-x)  Uid: (187001001/cernvmfs)   Gid: (65534/ nogroup)
Access: 2014-08-29 10:09:49.000000000 +0200
Modify: 2014-08-29 10:09:49.000000000 +0200
Change: 2014-08-29 10:09:49.000000000 +0200
 Birth: -

real    0m0.002s
user    0m0.000s
sys     0m0.001s

Even a full listing of the directory is done in 6 ms. Somehow, with
SMB3, the huge delay is introduced.

-- 
Dr. Thomas Orgis
HPC @ Universität Hamburg

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba