mjhjmtu

I'm using FreeBSD with the following file system structures, and I don't understand the anomalous behaviour at mountpoints:

1. I have a ZFS file system that's mounted at /mnt/myfs/myzfspool/dataset1.


2. I have ordinary dirs at /mnt/myfs/data/mountpoints and /mnt/myfs/data/links.


3. I create a nullfs mount to bring the ZFS dataset within the Samba share (to avoid wide link issues) using mount_nullfs -o nfsv4acls /mnt/myfs/myzfspool/dataset1 /mnt/myfs/data/mountpoints/myfs_1
   


4. I create a symlink within /mnt/myfs/data/links pointing to that mountpoint (ln -sv /mnt/myfs/data/mountpoints/myfs_1 /mnt/myfs/data/links/mysymlink)


5. I use Samba to share /mnt/myfs (as SVRmyfs), /mnt/myfs/data (as SVRdata) and /mnt/myfs/data/links (as SVRlinks) across the LAN, for testing purposes. Samba is configured to allow symlinks to be followed by default. (follow symlinks = yes, wide links = no)

The anomaly is this:

If I access the share \SVRdata, and within it, navigate to \SVRdatamountpointsmyfs_1, it's browseable. I have complete access to the mounted ZFS file system.

But if I access the same share and within it, navigate to /mnt/data/links/mysymlink, which is a symlink to the same dir, in the same file system as above, it won't let me browse within the contents - smbd log shows clearly that the error is symlink outside file system path.

I don't understand why Samba's behaviour differs. In the first case, the share contains a nullfs mountpoint within the share and it's allowed to be traversed; in the second case the share contains a symlink to the same nullfs mountpoint within the share, but it's not allowed to be traversed. At no point is the symlink traversing, and if it is then it's because the mount is traversing so it should be caught both times in that case.

• As possibly relevant debug information, if I navigate using the \SVRmyfs share instead (which is parent to both dataset and links, in their "true" locations) then navigating to /mnt/myfs/data/links/mysymlink instead of /mnt/data/links/mysymlink does work in both cases, which confirms the log info, that it's a Samba symlink traversal issue not a permissions or other issue.

Why is Samba allowing one to traverse but not the other, and what is the "easy fix"?