Can't execute from shared folders

Solid Kuro · Jun 28th 2020

While using Win10, I'm trying to run .exe files from folders shared with SMB/CIFS, but I keep getting this kind of error:

Wherever I look in OMV control panel I can only find the configuration of read/write permissions. I have 2 user accounts in OMV and basically want them to do whatever they want with those shares. How can I do that?

macom · Jun 28th 2020

Data drives are mounted with "noexec" option. You can check if it is working when you mount it with "exec". There are some threads about this how to do it.

EDIT: as ananas mentioned "noexec" does not prevent to execute exe on smb shares.

RE: Installation and Setup Videos - Beginning, Intermediate and Advanced

https://openmediavault.readthe…m-environmental-variables

Solid Kuro · Jun 30th 2020

macom thank you for your reply.

I've followed the instructions from TDL's video (removed the noexec attribute, saved, rebooted), deleted all shared folders from SMB/CIFS and "Shared folders", then shared them again, but the problem remains.

Following additional checks from the second link here's what i got:

1. /etc/openmediavault/config.xml

Display Spoiler

2. /etc/fstab

Display Spoiler

3. cat /proc/mounts

Display Spoiler

Code

root@SERVER:~# cat /proc/mounts
sysfs /sys sysfs rw,nosuid,nodev,noexec,relatime 0 0
proc /proc proc rw,nosuid,nodev,noexec,relatime 0 0
udev /dev devtmpfs rw,nosuid,relatime,size=996112k,nr_inodes=249028,mode=755 0 0
devpts /dev/pts devpts rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000 0 0
tmpfs /run tmpfs rw,nosuid,noexec,relatime,size=203796k,mode=755 0 0
/dev/sdb1 / ext4 rw,relatime,errors=remount-ro 0 0
securityfs /sys/kernel/security securityfs rw,nosuid,nodev,noexec,relatime 0 0
tmpfs /dev/shm tmpfs rw,nosuid,nodev 0 0
tmpfs /run/lock tmpfs rw,nosuid,nodev,noexec,relatime,size=5120k 0 0
tmpfs /sys/fs/cgroup tmpfs ro,nosuid,nodev,noexec,mode=755 0 0
cgroup2 /sys/fs/cgroup/unified cgroup2 rw,nosuid,nodev,noexec,relatime,nsdelegate 0 0
cgroup /sys/fs/cgroup/systemd cgroup rw,nosuid,nodev,noexec,relatime,xattr,name=systemd 0 0
pstore /sys/fs/pstore pstore rw,nosuid,nodev,noexec,relatime 0 0
none /sys/fs/bpf bpf rw,nosuid,nodev,noexec,relatime,mode=700 0 0
cgroup /sys/fs/cgroup/cpu,cpuacct cgroup rw,nosuid,nodev,noexec,relatime,cpu,cpuacct 0 0
cgroup /sys/fs/cgroup/net_cls,net_prio cgroup rw,nosuid,nodev,noexec,relatime,net_cls,net_prio 0 0
cgroup /sys/fs/cgroup/pids cgroup rw,nosuid,nodev,noexec,relatime,pids 0 0
cgroup /sys/fs/cgroup/perf_event cgroup rw,nosuid,nodev,noexec,relatime,perf_event 0 0
cgroup /sys/fs/cgroup/rdma cgroup rw,nosuid,nodev,noexec,relatime,rdma 0 0
cgroup /sys/fs/cgroup/freezer cgroup rw,nosuid,nodev,noexec,relatime,freezer 0 0
cgroup /sys/fs/cgroup/cpuset cgroup rw,nosuid,nodev,noexec,relatime,cpuset 0 0
cgroup /sys/fs/cgroup/devices cgroup rw,nosuid,nodev,noexec,relatime,devices 0 0
cgroup /sys/fs/cgroup/memory cgroup rw,nosuid,nodev,noexec,relatime,memory 0 0
cgroup /sys/fs/cgroup/blkio cgroup rw,nosuid,nodev,noexec,relatime,blkio 0 0
mqueue /dev/mqueue mqueue rw,relatime 0 0
hugetlbfs /dev/hugepages hugetlbfs rw,relatime,pagesize=2M 0 0
debugfs /sys/kernel/debug debugfs rw,relatime 0 0
systemd-1 /proc/sys/fs/binfmt_misc autofs rw,relatime,fd=51,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=12477 0 0
sunrpc /run/rpc_pipefs rpc_pipefs rw,relatime 0 0
/dev/sda1 /srv/dev-disk-by-label-3tb ext4 rw,relatime,jqfmt=vfsv0,usrjquota=aquota.user,grpjquota=aquota.group 0 0
/dev/sdc1 /srv/dev-disk-by-label-1tb ext4 rw,relatime,jqfmt=vfsv0,usrjquota=aquota.user,grpjquota=aquota.group 0 0
tmpfs /tmp tmpfs rw,relatime 0 0
overlay /var/lib/docker/overlay2/30ccf0a14110919322f4c0f57fdbbec7f2a0e50d2ac147d83e5b5589ec11750e/merged overlay rw,relatime,lowerdir=/var/lib/docker/overlay2/l/TAZMQ7ORPPEWWRTYK4E6IVYWJJ:/var/lib/docker/overlay2/l/DJGOILTVYJPEF6M3O74F7OH2DB:/var/lib/docker/overlay2/l/ZU5AW3WFEGQTCN3IKQHYT25QSP,upperdir=/var/lib/docker/overlay2/30ccf0a14110919322f4c0f57fdbbec7f2a0e50d2ac147d83e5b5589ec11750e/diff,workdir=/var/lib/docker/overlay2/30ccf0a14110919322f4c0f57fdbbec7f2a0e50d2ac147d83e5b5589ec11750e/work 0 0
overlay /var/lib/docker/overlay2/09c427a00217d3cfa709f8054899abff0900ad647d059e697d24c4955d9442c6/merged overlay rw,relatime,lowerdir=/var/lib/docker/overlay2/l/I3KNHAKIVC4KLNF64CNAFHIXAN:/var/lib/docker/overlay2/l/4PW2ULZ6NOORDQLPURA6C3NPJZ:/var/lib/docker/overlay2/l/74FIVCXMPP4IT2BS5IINFB34HC:/var/lib/docker/overlay2/l/YJJBWZCI53KWKHF3O6WEESPZVF:/var/lib/docker/overlay2/l/CRHOVY4BM5M4JLC4NK6CZMBOPG:/var/lib/docker/overlay2/l/2SRSQNPNSBK7T5W4YV7QLFB7CR:/var/lib/docker/overlay2/l/3VMRAMWQAUD53GCXTHVGIHBPCH,upperdir=/var/lib/docker/overlay2/09c427a00217d3cfa709f8054899abff0900ad647d059e697d24c4955d9442c6/diff,workdir=/var/lib/docker/overlay2/09c427a00217d3cfa709f8054899abff0900ad647d059e697d24c4955d9442c6/work 0 0
shm /var/lib/docker/containers/13790dd3068ad0f7e1085f7f60271595d24e5ce9034950f91fd33ef6a2f1ecbf/mounts/shm tmpfs rw,nosuid,nodev,noexec,relatime,size=65536k 0 0
nsfs /run/docker/netns/460d813f8142 nsfs rw 0 0
nsfs /run/docker/netns/c7d66f184ff5 nsfs rw 0 0

Display More

In the last part there's an 'rw' attribute in these lines:

Code

/dev/sda1 /srv/dev-disk-by-label-3tb ext4 rw,relatime,jqfmt=vfsv0,usrjquota=aquota.user,grpjquota=aquota.group 0 0
/dev/sdc1 /srv/dev-disk-by-label-1tb ext4 rw,relatime,jqfmt=vfsv0,usrjquota=aquota.user,grpjquota=aquota.group 0 0

Could this be the problem? Any other ideas?

macom · Jul 1st 2020

Is the executable bit set on file system level?

Solid Kuro · Jul 2nd 2020

Quote from macom

Is the executable bit set on file system level?

How do I do that? (I'm fairly new to linux systems).

***

Meanwhile, I followed the guide from one of your previous links and i added the line

Code

OMV_FSTAB_MNTOPS_EXT4="defaults,nofail,user_xattr,usrjquota=aquota.user,grpjquota=aquota.group,jqfmt=vfsv0"

to /etc/default/openmediavault, so now when I mount my ext4 drives, there's no 'noexec' attribute by deafault. The problem is still there.

***

Another thought. Could the problem be that OMV overrides access rights to R/W only when you set up a folder to share?

Display Spoiler

macom · Jul 3rd 2020

Quote from Solid Kuro

How do I do that? (I'm fairly new to linux systems).

***

Post the output of

ls -l <filename> in CLI

http://linuxcommand.org/lc3_lts0090.php

https://linuxacademy.com/guide…anding-linux-permissions/

Solid Kuro · Jul 6th 2020

Quote from macom

http://linuxcommand.org/lc3_lts0090.php
https://linuxacademy.com/guide…anding-linux-permissions/

Thank you for those links. With their help I have executed the following commands:

Code

chown -R root: /srv/dev-disk-by-label-1tb
chown -R root: /srv/dev-disk-by-label-3tb
chgrp root /srv/dev-disk-by-label-1tb
chgrp root /srv/dev-disk-by-label-3tb
chmod -R 777 /srv/dev-disk-by-label-1tb
chmod -R 777 /srv/dev-disk-by-label-3tb

Looking back, 'chown' and 'chgrp' weren't really needed as I've set all files' permissions to rwx (777) anyway.

However, this doesn't solve the problem with the newly added files, as they get the default permissions.

Code

root@SERVER:~# ls -l /srv/dev-disk-by-label-3tb/Stuff/qsfv.exe
-rw-rw-r-- 1 DESKTOP users 372736 Jul 6 18:50 /srv/dev-disk-by-label-3tb/Stuff/qsfv.exe

Having read your links and a bunch of other stuff on the topic of umask and default permissions, I got a bit confused how to permanently change them to rwx for my 2 folders. What would the solution for OMV be?

macom · Jul 6th 2020

Quote from Solid Kuro

I've set all files' permissions to rwx (777) anyway.

No the best idea for security reasons.

You can use the resetperms plugin to reset it to the original permissions.

Then set permissions for those files you need it, e.g.

chmod 770 /srv/dev-disk-by-label-3tb/Stuff/qsfv.exe

ananas · Jul 6th 2020

Please stop posting such nonsense !

Windows can of course execute files on a CIFS Share.

The "noxexec" options in /etc/fstab (or in a mount command) only affects the local linux system that has the file system mounted.

Now I need a beer ...

Cheers,

Thomas

Solid Kuro · Jul 6th 2020

Quote from macom

No the best idea for security reasons.
You can use the resetperms plugin to reset it to the original permissions.

Then set permissions for those files you need it, e.g.

chmod 770 /srv/dev-disk-by-label-3tb/Stuff/qsfv.exe

Display More

But then, if I understand it correctly, I'll need to run this command every time I add any new files as the default permissions is set to "-rw-rw-r--". I need a permanent solution for all the files added to my 2 ext4 hdd's. I want all of those files to be fully readable/writable/executable for 2 OMV users who have access to SMB/CIFS shared folders (no guests allowed though) and also not to have any writing/execution problems with those files if I transfer them to another computer.

macom · Jul 7th 2020

Quote from ananas

Please stop posting such nonsense !
Windows can of course execute files on a CIFS Share.
The "noxexec" options in /etc/fstab (or in a mount command) only affects the local linux system that has the file system mounted.

Yes, my mistake. Found this out on my system. However it seems to be not that obvious as I did not find a documentation for this in the web. Only trial and error approach as I did. Maybe you can point me in the right direction.

Based on the tests on my system the executable bit is necessary on a ext4 smb share. Seems to be also confirmed by OP.

Dmitrych · Aug 20th 2020

Quote from Solid Kuro

While using Win10, I'm trying to run .exe files from folders shared with SMB/CIFS, but I keep getting this kind of error:

Bro, you're asking a question in the wrong forum. The problem is directly related to the April update of Windows 10 1803, where for security reasons, support for executing exe files from samba v1 was disabled.

What can you do here:

try to run this file in windows 8 compatibility mode, it helps (sometimes),

disable support for SMB 1.0 / CIFS Client in Windows components (be sure to reboot),

well, if we talk about OMV, add the line "server min protocol = SMB2" to the additional SMB options in OMV

Zeric · Feb 8th 2021

Quote from Dmitrych

Bro, you're asking a question in the wrong forum. The problem is directly related to the April update of Windows 10 1803, where for security reasons, support for executing exe files from samba v1 was disabled.
What can you do here:
try to run this file in windows 8 compatibility mode, it helps (sometimes),
disable support for SMB 1.0 / CIFS Client in Windows components (be sure to reboot),
well, if we talk about OMV, add the line "server min protocol = SMB2" to the additional SMB options in OMV

I'm also having this issue and don't see a confirmed fix. In my case, I verified that SMB 1.0 is already disabled on Windows clients, yet new files created on an SMB share from a windows machine (that end in *.exe) are not executable on the share. This seems to be a posix permission issue, not an samba version issue.

Quote from macom

Yes, my mistake. Found this out on my system. However it seems to be not that obvious as I did not find a documentation for this in the web. Only trial and error approach as I did. Maybe you can point me in the right direction.

Based on the tests on my system the executable bit is necessary on a ext4 smb share. Seems to be also confirmed by OP.

When looking at the file system on OMV, new files are created with the group executable bit not set (0660 instead of 0670 or 0770). If I change them from the Linux CLI to add execute (chmod g+x [file name]) then execute works fine from Windows, but obviously I don't want to have to change it from the CLI every time a windows machine adds a new executable file.

The OMV documentation indicates that shares are created with 2770, meaning that new files are created with 770, but that's not what I'm seeing when files are created from a windows system over smb. New files created from Windows over SMB are set to 660.

I want the default to be that files created from windows systems have the group execute bit set in linux (0670 or 0770), how can that be done in in OMV?

macom · Feb 8th 2021

Quote from Zeric

I want the default to be that files created from windows systems have the group execute bit set in linux (0670 or 0770), how can that be done in in OMV?

Samba/CIFS File and Directory Creation Permissions

Zeric · Feb 8th 2021

Quote from macom

Samba/CIFS File and Directory Creation Permissions

Thanks for the pointer, that's just what I needed to get on the right track. With some more reading, I found this can be done in the GUI on a per share basis by adding extra options for the SMB/CFIS share and it doesn't require going to the CLI at all. Just add the options and apply.

Code

create mask = 0670
force create mode = 0670
directory mask = 2770
force directory mode = 2770

jTehBishop42 · Jan 18th 2023

goto /storage/shared folders/acl

select the root of your home folder

change owner and group to yourself, and make sure you have r/w/x

check replace permissions

save

works!

timekills · May 8th 2023

Quote from jTehBishop42

goto /storage/shared folders/acl
select the root of your home folder
change owner and group to yourself, and make sure you have r/w/x
check replace permissions
save
works!

Display More

This does work.

Recommend creating a group however, and setting the group owner to that group and giving that group RWX permissions.

Then you can add users to that group that get those privilges.

Obviously only really necessary if you have more than one user to the share...but even if there's only one user it doesn't hurt to be prepared to give (or remove) those privileges en masse rather than just to a single user.

Participate now!