(SOLVED) Can't execute files from TrueNAS 12.0-U4 SMB share

Nefastor · June 18, 2021, 3:01pm

EDIT : this problem has been solved, the solution was provided by @zlynx in this post. I’m adding one last reply at the end of this thread with the details.

I used to be able to run software from my NAS share. That includes exe files and also complete programs installed on the NAS share. Yesterday I reinstalled Windows 10 on my PC (which was long overdue) and now I cannot. Here’s what Windows tells me :

The share itself predates this new install of Windows and is beyond reproach. My first reflex was to look at the file properties, and here’s what Windows tells me :

If I copy the file to a local drive, it gains all permissions :

Can anyone tell me what is this fckery and how to unfck it ? I get the all-too-familiar feeling that Microsht pulled another Darth Vader on me and changed the terms of our deal yet again.

Of course, I have followed the advice of every flat-earther that ever flat-earthed and “done my own research”. Which led me down an interesting rabbit hole, the bottom of which is this knowledge base article detailing what the screw-up is without calling it a screw-up :

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee844140(v=ws.10)?redirectedfrom=MSDN

The proposed solution (adding an entry to the registry) has no effect.

It is possible to change the file permissions to allow execution. However, I do not wish to go through my entire NAS share and change each executable file’s permission. I also fear there may be unforeseeable consequences in doing so.

I also tried mounting the share from the command line using an elevated command prompt, hoping that it would convey my admin status to the connection. No joy : the share misbehaves exactly the same.

I’m having a Princess Leia moment over here, and I’m looking for an Obiwan Kenobi. In a pinch, an experienced Windows user will do .

anon7678104 · June 18, 2021, 4:42pm

if you have the this pc icon on your screen.
right click on it and click manage.
click map network drive. select your drive and it should show up as accessible.

same again right click on the icon, click manage then shares…

any errors?.

have you checked to see if there are any group policy’s that affect sharing for your account.
run gpedit.msc and have a look through the user account settings.

vhns · June 18, 2021, 4:45pm

Nefastor,

Could you please do the following:

Open a terminal in your TrueNAS box
Go into the directory the executable is in
Run the command ls -al DaVinci_Resolve_Studio_17.2.1_Windows.exe
Post the output here

I’d be interested in your smb.conf as well.

Best regards,

vhns

Nefastor · June 18, 2021, 4:58pm

I do not see that option. Here’s what I get :

No “map network drive” button anywhere. But the drive “is” already mapped :

I know almost nothing about the group policies editor. I’m not sure where to start looking. Under Administrative Templates alone there’s 1,800 settings. What do you have in mind to help me narrow it down ?

zlynx · June 18, 2021, 5:08pm

I had this problem a while ago and I fixed it by adding this line to my Samba server’s smb.conf:

acl allow execute always = yes

I don’t know if you have access to that on your server. Maybe there’s a GUI option.

Nefastor · June 18, 2021, 5:12pm

It returns “-rw-r–r-- 1 nefastor nefastor…”

The flags match what Windows is telling me, which isn’t surprising.

Here’s my smb.conf :

#
# SMB.CONF(5)           The configuration file for the Samba suite
# $FreeBSD$
#


[global]
        dns proxy = No
        aio max threads = 2
        max log size = 5120
        load printers = No
        printing = bsd
        disable spoolss = Yes
        dos filemode = Yes
        kernel change notify = No
        directory name cache size = 0
        nsupdate command = /usr/local/bin/samba-nsupdate -g
        unix charset = UTF-8
        log level = 1 auth_json_audit:3@/var/log/samba4/auth_audit.log
        obey pam restrictions = False
        enable web service discovery = True
        logging = file
        server min protocol = SMB2_02
        unix extensions = No
        restrict anonymous = 2
        server string = TrueNAS Server
        bind interfaces only = Yes
        netbios name = truenas
        netbios aliases =
        server role = standalone
        workgroup = WORKGROUP
        idmap config *: backend = tdb
        idmap config *: range = 90000001-100000000
        registry shares = yes
        include = registry

Nefastor · June 18, 2021, 5:25pm

TrueNAS is very specific about having to do everything through the GUI or it won’t be saved. For instance, I’ve read that the smb.conf file is auto-generated by TrueNAS, so any modification will be overwritten when I change anything through the GUI.

Normally, though, I should be covered :

This is the default ACL for my dataset. I do notice something weird, though… the permissions are for “owner@”, not for “User”, but IIRC that’s the same thing. Although there is a “User” option for who the permissions apply to. “This is not confusing at all”, says I, imitating @wendell’s sarcastic tone

Pollomoolokki · June 18, 2021, 5:59pm

You need to have permission to execute.
Your TrueNAS image has Execute

“-rw-r–r-- 1 nefastor nefastor…”
into “-rwxr–r-- 1 nefastor nefastor…”

Notice the fourth line changing to x.
You can do this with

chmod u+x
user is given permission to execute

source: https://www.guru99.com/file-permissions.html

Tested this on my own system. (Not on smb tho )

~>ls test.sh
-rw-r–r-- 1
~>./test.sh
bash: ./test.sh: Permission denied
~>chmod u+x test.sh
~>ls test.sh
-rwxr–r-- 1
~>./test.sh
test

Nefastor · June 18, 2021, 6:15pm

Your solution worked !

I looked into the SMB share configuration UI because I remembered it has two modes “basic” and “advanced” settings. And sure enough, in advanced mode I can enter additional parameters :

My executable files now appear to execute (I’ve only tested with a couple, but it should mean it’s all good).

I forgot to mention that I recently updated TrueNAS from 12.0-U2.1 to 12.0-U4. I’m guessing something got broken from one version to another… unless there is a reason for this change. Considering it’s about limiting what can be done with the data, I’m going to hazard this must serve a purpose (other than wasting our time). That’s just one more thing I must log in my personal TrueNAS knowledge base…

@Pollomoolokki : here’s the weird thing, friend : after I added that command to my share configuration, the files’ individual permissions didn’t change, Windows still reports my exe’s as read-only, no execute… and yet they execute. Doing my Wendell impression again : not confusing at all !

I’ve looked at the smb.conf file generated by TrueNAS : it does not contain the “acl allow execute always = yes” command. On one hand, now we know why IXSystems insists everything should be setup through the GUI… but on the other, I don’t really like that kind of “we’re hiding it for your own good” vibe. Smells too much like Microsoft for my taste.

Interestingly, though, a new file appeared in my NAS /etc/local : smb4_share.conf.

It is, however, empty : it just contains the same header comment as smb.conf. But it wasn’t there five minutes ago…

Oh well, it appears my problem has been solved. I’ll do some more checks and research and then mark the thread as “solved”. Thank you for your quick help, everyone ! Many blessings of bytes and gigahertz be upon you !

anon7678104 · June 18, 2021, 8:40pm

right click on the icon and its there in the same menu as manage, you want straight to manage.

oh bollix. i sent you there my bad. i miswrote the first instruction it should have been right click on the icon and in the menu you will find the network share.

sorry

Nefastor · June 18, 2021, 10:12pm

Errare humanum est. All is forgiven

yuri20071 · June 19, 2021, 5:52pm

I’ve had issues with some installers that try to elevate the moment you start them, this is most likely because the account that you elevate to does not have access to the share or mapped drive.

This is just an explanation though, I’ve not yet been able to figure out a solution

Nefastor · June 19, 2021, 7:48pm

@zlynx provided a (the ?) solution to the problem. I’ll elaborate a little on it.

The root cause of the problem appears to be an evolution in how Samba works by default between TrueNAS-12.0-U2.1 and TrueNAS-12.0-U4. It’s one more thing to be aware of when updating your NAS. Specifically, now TrueNAS does not allow files stored in a dataset to be executed through Samba. If you need to be able to run programs stored on your NAS, this needs to be enabled explicitly.

To do that, login to the TrueNAS GUI (as this is the only legitimate way to change TrueNAS settings). Expand the “Sharing” category, select “Windows Shares (SMB)”, find the share you need to execute files from and edit its settings. You should see the basic user interface :

Click on “Advanced Options” to expose additional controls. You’re looking for a field titled “Auxiliary Parameters”.

In that field, enter the line :

acl allow execute always = yes

It should look like that :

Save the share settings. You’re done, problem solved.