Subject: Re: Users unable to delete files

From: [email-masked] (Damien.MATTEI)
Date: Sun, 10 Feb 2002 23:28:56 MET (MET)

You wrote:

> Return-Path: <[email-masked]>
> Received: from taloa.unice.fr (taloa.unice.fr [134.59.1.7])
>           by naxos.unice.fr (8.9.3/jtpda-5.3.3) with ESMTP id RAA396474
>           for <[email-masked]>; Sun, 10 Feb 2002 17:03:31 +0100 (MET)
> Received: from users.phg-online.de ([email-masked] [62.245.158.230])
>           by taloa.unice.fr (8.9.3/jtpda-5.3.3) with ESMTP id RAA14867
>           for <[email-masked]>; Sun, 10 Feb 2002 17:04:14 +0100 (CET)
> Received: from [195.30.238.157] (powerbook-tk.kaiser.link-m.de [195.30.238.157])
> 	by users.phg-online.de (8.9.3/8.9.3) with ESMTP id RAA31230;
> 	Sun, 10 Feb 2002 17:29:58 +0100
> User-Agent: Microsoft-Outlook-Express-Macintosh-Edition/5.02.2106
> Date: Sun, 10 Feb 2002 17:03:51 +0100
> Subject: Re: Users unable to delete files
> From: Thomas Kaiser <[email-masked]>
> To: Damien MATTEI <[email-masked]>,
>         "Davenport, Joe" <[email-masked]>
> CC: <[email-masked]>
> Message-ID: <[email-masked]>
> In-Reply-To: <[email-masked]>
> Mime-version: 1.0
> Content-type: text/plain; charset="US-ASCII"
> Content-transfer-encoding: 7bit
> X-AntiVirus: scanned for viruses by AMaViS 0.2.1 (http://amavis.org/)
> Status:  O
> 
> On Fri, 08 Feb 2002 18:22:02 +0100, Damien MATTEI wrote:
> 
> > all i know is that on my system if i'am deleting files of another user in a
> > shared directory the files can't go in trash and i am asked to delete them
> > immediately...
> 
> Then you have a problem with byte range locking and that affects the
> functionality of the Network Trash Folder:
> 
>     Network Trash Explanation
>     
>     You will have one network trash folder at the root of every
>     sharepoint. Within that folder will be a file called Trash Can Usage
>     Map which is used by the Finder on the client machine to claim a Trash
>     Can #x folder to use as the trash can for the server volume.
>     
>     When a client throws a file on a remote volume away the Finder tries
>     to get a lock on the first byte of the Trash Can Usage Map if that
>     byte is locked, it tries to get a lock on the second byte and so on.
>     When it gets the lock it "claims" the corresponding Trash Can folder.
>     It then moves the file to be thrown away into its Trash Can folder.
>     When the User selects Empty Trash, the Finder will empty its Trash Can
>     Folder.
>     
>     If the client machine breaks the connection via crashing or being
>     disconnected, the Trash Can folder will not be emptied. However when a
>     client Finder claims a Trash Can folder, it will delete anything that
>     was in the folder previously.
> |
>     (Courtesy Brad Suinn, Apple Computer)
> 
> As you are a user of a netatalk RPM, that was probably built with the mtab
> DID scheme (nowadays called hash-did), this non-functionality of the Network
> Trash is very important to prevent data loss in your situation:
> 
> <http://www.umich.edu/~rsug/netatalk/archive/admins/2000/3251.html> and
> <http://www.umich.edu/~rsug/netatalk/archive/admins/2000/3325.html>
> 
> Regards,
> 
> Thomas
> 
in fact the user of shared directory can't use the trash folder because group
 permission on trash folder are --S , so no read and write for the group and only the
 owner of trash folder have rwx on trash folder, it is set by default by netatalk
 ,is it a problem for file system integrity?

note: i'm now running netatalk-1.5.1.1

---

From: Thomas Kaiser <[email-masked]>
Date: Mon, 11 Feb 2002 00:27:10 +0100

On Sun, 10 Feb 2002 23:28:56 MET (MET), Damien.MATTEI wrote:

> permission on trash folder are --S , so no read and write for the group

The last time you said, the permissions are "drwx--Srwx" (what's correct),
so _anyone_ is able to write into the folder regardless of the group
permissions or not.

> and only the owner of trash folder have rwx on trash folder,

Give it a try: 

- stop afpd
- delete your Network Trash Folder on unix
- start afpd
- look for a Network Trash Folder in the share's root (there won't be any)
- mount as user A from a mac
- unmount the volume
- look for the permissions and ownerships of the freshly created Network
  Trash Folder
- mount as user B
- throw something into trash (this will work)
- mount from a second mac as user A
- try to trash something as user A (won't work)

If things go like this, than it has nothing to do with permissions but with
missing byte range locking.

> it is set by default by netatalk

No, the Finder does this, the first time a volume is mounted, if there is
not already a Network Trash Folder present...

(Some vendors create the Network Trash Folder theirselves, eg. M$ let their
SFM do so to prevent confused clients if someone is deleting the Network
Trash Folder from a windows client. So there is no need for a mac client's
finder to create this folder it always exists)

Regards,

Thomas

---

From: Damien MATTEI <[email-masked]>
Date: Mon, 11 Feb 2002 13:23:52 +0100

> finder to create this folder it always exists)
thank you 

i suppose i did that , you have reason about the right ,others can
access so evrybody!

i have a new problem perheaps in relation to my server config.
one user put files in trash, *not* a network trash folder, and was
unable to delete them, finally i delete them with file buddy...

i hope that this new problem is different.

About the permission of the Trash Folder on the folder they
are:rwx--Srwx
so i think that every people is able to use trah folder, why netatalk
doesn't set rw permission on group i don't know , should i set them
manually?

if the problem is with missing byte range locking and that it is the
finder that do the work, so what can i do?
-- 
MATTEI Damien					Phone: +33 (0)4 93 37 76 66
C.N.R.S / U.N.S.A				Fax:   +33 (0)4 93 53 30 71
UMR 6549 Instabilite & Alterations des Genomes	E-mail: [email-masked]
Faculte de Medecine - Avenue de Valombrose - 06107 NICE Cedex 2 - France

---

From: "Chris Garrigues" <[email-masked]>
Date: Mon, 11 Feb 2002 08:12:29 -0600

> Date:  Mon, 11 Feb 2002 00:27:10 +0100
>

*unless* they're in the group!

Chris

-- 
Chris Garrigues                 http://www.DeepEddy.Com/~cwg/
virCIO                          http://www.virCIO.Com
716 Congress, Suite 200
Austin, TX  78701		+1 512 374 0500

  My email address is an experiment in SPAM elimination.  For an
  explanation of what we're doing, see http://www.DeepEddy.Com/tms.html 

    The Greatest tragedy in mankind's entire history may be the
      hijacking of morality by religion.  However valuable -- even
      necessary -- that may have been in enforcing good behavior on
      primitive peoples, their association is now counterproductive.
      Yet at the very moment when they should be decoupled,
      sanctimonious nitwits are calling for a return to morals based
      on superstition.
				--- Arthur C. Clarke

---

From: Thomas Kaiser <[email-masked]>
Date: Mon, 11 Feb 2002 16:40:52 +0100

> *unless* they're in the group!

Okay, you're right, as we are speaking of netatalk. I've been confused
yesterday night, as I've been testing with an EtherShare installation too.

EtherShare translates between AFP permissions and UNIX permissions, Netatalk
doesn't.

In AFP terms, we have 'owner', 'group' and 'all', in UNIX terms we have
'owner', 'group' and 'others' (the last neither owner nor member of the
group)

In my opinion, problems arise, if the AFP server can't deal with the special
meaning of 'all' vs. 'others'. As a client's Finder creates the Network
Trash Folder read/write for owner and *all*, and Netatalk interprets this as
read/write for owner and *others*, this leads to wrong permissions on the
Network Trash Folder per default.

So one should change the access rights to rwxrwxrwx manually...

Thanks for the correction,

Thomas

---

From: Damien MATTEI <[email-masked]>
Date: Mon, 11 Feb 2002 17:17:37 +0100

> Thanks for the correction,
me too i have been confused:
[dmattei@irisiag blast]$ ls -la index.html
-rw----r--    1 nobody   nobody      1282 jan  10 18:17 index.html
[dmattei@irisiag blast]$ grep nobody /etc/group
nobody:*:60001:dmattei
[dmattei@irisiag blast]$ more index.html
index.html: Permission denied
[dmattei@irisiag blast]$ uname -a
IRIX irisiag 6.5 05190003 IP22

this show that if you're in the group that have no right you can access
even if others can on IRIX and i think it's the same thing on linux
where my netatalk run.
But why netatalk set the permission by default to --S on the group ?
is it safe to change this setting?

my policy for creting a shared directory is that:

chmod g+rwx shared_directory/  

chmod -R g+rwX shared_directory/ except for trash folder that i reset to
default settings.

i find sometimes useful too to have rws on a group for shared
directories...

---

From: "Chris Garrigues" <[email-masked]>
Date: Mon, 11 Feb 2002 10:49:40 -0600

> From:  Damien MATTEI <[email-masked]>
> Date:  Mon, 11 Feb 2002 17:17:37 +0100
>
                                                                  ^not
> even if others can on IRIX and i think it's the same thing on linux

I assume you meant "can not access", not "can access" since that's what you 
demonstrated, and this is correct.  If it doesn't behave like this, then it isn't 
Unix.

> is it safe to change this setting?

That's an excellent question.

Chris

---

From: Damien MATTEI <[email-masked]>
Date: Mon, 11 Feb 2002 18:16:09 +0100

Chris Garrigues wrote:
>   ------------------------------------------------------------------------
>    Part 1.2Type: application/pgp-signature

yes i was thinking "can't" access, sorry.

I don't think it's a big problem to do not have usable trash folder on
shared
directories. Users works for a month like that and they do not complain
of it...
as the trash folder works well in their home directories.

Anyway it should be fixed.