Samba recycle bin not accessible

[mrmarkuz]

The first user that deletes a file creates the .recycle directory but with 700 permissions, so users from the same group can't access the recycle bin.

Steps to reproduce

• Setup internal samba user domain and enable the file server
• Create users "user1" and "user2" and add them to a group "group1"
• Setup a samba share "testshare", allow write for "group1" and enable the recycle bin
• As "user1" create a file in the "testshare" and delete it
• As "user2" try to access the recycle bin

Expected behavior

The recycle bin is accessible

Actual behavior

The recycle bin isn't accessible for user2 due to wrong permissions. Only user1 is granted rights to access it:

root@dc1:/# smbcacls -N //dc1/myshare1 '.recycle'
REVISION:1
CONTROL:SR|DP
OWNER:NBDOM\user1
GROUP:NBDOM\Domain Users
ACL:NBDOM\user1:ALLOWED/0x0/FULL
ACL:NT AUTHORITY\SYSTEM:ALLOWED/0x0/FULL

Proposed solution

Set recycle:directory_mode = 0770 so users that are in the same group can access the recycle bin.

Components

Samba 3.0.0

See also

• https://community.nethserver.org/t/recycle-bin-folder-is-not-accessible-and-samba-audit-problem-in-grafana/25985
• https://mattermost.nethesis.it/nethserver/pl/ht4zxd434brw9yif8ropyfxr6c

---

Thanks to gio.pelli

[DavidePrincipi]

In Testing 3.0.2-dev.3

Implementation notes

• For vfs_recycle limitations, we cannot match the expectation, the solution is a bit different.
• The fix configures recycle:repository = .recycle/%U, that means every user has their own recycle bin private namespace.
• Only the user who deletes the file can access it in the recycle bin. Only exception: Administrator.
• Existing shares receive the fix on the next alter-share action invocation with recyle bin enabled

Test case

• Configure a share accessible to members of group G1, enable Recycle bin
• User U1 removes files and also content nested in a directory structure
• Only U1 and Administrator can access the removed content. U2 cannot access.
• Users with read-only access can enter the .recycle directory, but cannot see the contents of users' private dirs.