Dear Maintainer,

On a fresh install of Debian, user enters the following command:

    user@debian:~# net usershare add testing /home/user/myusershare/
guest_ok=y

The resulting usershare generated by Samba is as follows:

    root@debian:~# cat /var/lib/samba/usershares/testing
    #VERSION 2
    path=/home/user/myusershare/
    comment=guest_ok=y
    usershare_acl=S-1-1-0:R
    guest_ok=n
    sharename=testing

Note that the 'guest_ok=y' parameter has been parsed as a comment not as
specifying guest access.  This appears inconsistent with the man page
for net(8), which suggests [comment] and [acl
] are *optional* parameters. The usershare is created with what are
presumably default values for ACL and guest_ok.

    USERSHARE ADD sharename path [comment] [acl] [guest_ok=[y|n]]

The only way to ensure the guest_ok=y parameter is correctly added to
the usershare definition is to include both a comment and an ACL - eg:

    net usershare add testing /home/user/myusershare mycomment S-1-1-0:f
guest_ok=y

This is contrary to the man page which suggests [comment] and [acl] are
optional.  This requires user to know what to specify for ACL, which
would require reading various documentation for
most users. The default values for ACL and guest_ok are unsuitable in
this case.

This is either a bug in the software or the man page.  The man page
could be updated to note that all 3 parameters must be specified by the
user if the user wishes to specify guest_ok=y.

Presumably this could impact any gui tools that rely on net(8) in the
background to create usershares.

This is a fresh install of Debian. Testparm output as follows:

    root@debian:~# testparm
    Load smb config files from /etc/samba/smb.conf
    Loaded services file OK.
    Weak crypto is allowed by GnuTLS (e.g. NTLM as a compatibility
fallback)

    Server role: ROLE_STANDALONE

    Press enter to see a dump of your service definitions

    # Global parameters
    [global]
           interfaces = 127.0.0.0/8 enp1s0
           log file = /var/log/samba/log.%m
           logging = file
           map to guest = Bad User
           max log size = 1000
           obey pam restrictions = Yes
           pam password change = Yes
           panic action = /usr/share/samba/panic-action %d
           passwd chat = *Enter\snew\s*\spassword:* %n\n
*Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
           passwd program = /usr/bin/passwd %u
           server role = standalone server
           unix password sync = Yes
           usershare allow guests = Yes
           idmap config * : backend = tdb


    [homes]
           browseable = No
           comment = Home Directories
           create mask = 0700
           directory mask = 0700
           valid users = %S


    [printers]
           browseable = No
           comment = All Printers
           create mask = 0700
           path = /var/tmp
           printable = Yes


    [print$]
           comment = Printer Drivers
           path = /var/lib/samba/printers

Regards
Chris

17.07.2024 11:04, debian-reportbug@mx.brindabella.org wrote:

The net(8) manpage says:

      The usershare commands are:
          net usershare add sharename path [comment [acl] [guest_ok=[y|n]]] - to add or change a user defined share.
          net usershare delete sharename - to delete a user defined share.
          net usershare info [--long] [wildcard sharename] - to print info about a user defined share.
          net usershare list [--long] [wildcard sharename] - to list user defined shares.

    USERSHARE ADD sharename path [comment] [acl] [guest_ok=[y|n]]
        Add or replace a new user defined share, with name "sharename".
    ....

Note the list of all usershare commands just 4 lines above the line you
quoted.


Either way, please address this upstream.

Thanks,

/mjt

17.07.2024 11:47, Michael Tokarev wrote:

Actually there's just a single extra "]" in there, right after the "comment",
which shouldn't be there.  Note two "]"s at the end.

/mjt

Will report upstream then.

The man page explicitly states that the comment and acl parameters are
optional, which implies it is sufficient to just specify guest_ok=y. 
But if only this parameter is passed, it is interpreted as being the
comment parameter.  In other words, they are not optional.

Extract from net(8):

         The optional "comment" parameter is the comment that will
appear on the share when browsed to by a client.

        The optional "acl" field specifies which users have read and
write access to the entire share. ...<omitted>.

        The default if no "acl" is given is "Everyone:R", which means
any authenticated user has read-only access.

        The optional "guest_ok" has the same effect as the parameter of
the same name in /etc/samba/smb.conf, in that it allows guest access to
this user defined share. This parameter
        is only allowed if the global parameter "usershare allow guests"
has been set to true in the /etc/samba/smb.conf.

I subsequently learned you can specify empty comment/acl parameters:

$ net usershare add sharename /path/to/dir "" "" guest_ok=y

But specifying empty parameters in quotes is not the same as them being
optional.