{"id":1408,"date":"2017-03-31T14:03:11","date_gmt":"2017-03-31T13:03:11","guid":{"rendered":"http:\/\/www.michaelm.info\/blog\/?p=1408"},"modified":"2017-03-31T14:05:44","modified_gmt":"2017-03-31T13:05:44","slug":"samba-vfs_shadow_copy2-annoyance","status":"publish","type":"post","link":"http:\/\/www.michaelm.info\/blog\/?p=1408","title":{"rendered":"Samba vfs_shadow_copy2 annoyance"},"content":{"rendered":"

The Samba module\u00a0vfs_shadow_copy2 is useful for shares hosted on snapshot capable filesystems\/storage. This module allows previous “snapshot” versions of a share to be made visible to users. \u00a0This allows for self-service restore of files by end users. On a given share, in smb.conf, you configure something like<\/p>\n

[data]\r\n vfs objects = acl_xattr btrfs shadow_copy2\r\n path = \/btrfs\/samba\/data\r\n shadow:basedir = \/btrfs\/samba\/data\r\n shadow:snapdir = ..\/data_SNAPS<\/pre>\n
Depending on your version of Samba, to use the above which includes the “..\/” link, you might need to add some\/all of the below options:<\/p>\n
unix extensions = no\r\nwide links = yes\r\nallow insecure wide links = yes<\/pre>\n
In the 4.3.x and 4.4.x releases there have been a few changes to the vfs_shadow_copy2 module meaning the above three options may or may not have been needed. The jump from 4.4.9 to 4.4.10 addressed Samba BUG 12531<\/a>. This again involved changes to the vfs_shadow_copy2 module, again breaking the above config (with or without the three options listed). I’ve changed the above config on the share to be<\/p>\n
[data]\r\n vfs objects = acl_xattr btrfs shadow_copy2\r\n path = \/btrfs\/samba\/data\r\n shadow:basedir = \/btrfs\/samba\/data\r\n shadow:snapdir = \/btrfs\/samba\/data_SNAPS<\/pre>\n
which works without the three options above. Samba 4.4.13, 4.5.8, 4.6.2 also work with the above. Its frustrating since relative (which I assume includes “..\/”) directories are supposed to be supported with “shadow:snapdir”. Hopefully this configuration now works for all releases going forward.<\/p>\n
I find it frustrating that minor releases can break working configs. It makes it difficult to quickly deploy security fixes as the required level of testing is much higher than one would expect for minor releases. This subtle change to the config option is not documented or mentioned in the release notes. \u00a0Anyway, more of a rant post than usual… apologies for that!<\/p>\n","protected":false},"excerpt":{"rendered":"
The Samba module\u00a0vfs_shadow_copy2 is useful for shares hosted on snapshot capable filesystems\/storage. This module allows previous “snapshot” versions of a share to be made visible to users. \u00a0This allows for self-service restore of files by end users. On a given share, in smb.conf, you configure something like [data] vfs objects = acl_xattr btrfs shadow_copy2 path […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[129,133,230],"class_list":["post-1408","post","type-post","status-publish","format-standard","hentry","category-technical","tag-bugs","tag-config","tag-samba"],"_links":{"self":[{"href":"http:\/\/www.michaelm.info\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1408","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.michaelm.info\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.michaelm.info\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.michaelm.info\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.michaelm.info\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1408"}],"version-history":[{"count":3,"href":"http:\/\/www.michaelm.info\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1408\/revisions"}],"predecessor-version":[{"id":1411,"href":"http:\/\/www.michaelm.info\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1408\/revisions\/1411"}],"wp:attachment":[{"href":"http:\/\/www.michaelm.info\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1408"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.michaelm.info\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1408"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.michaelm.info\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1408"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}