Arch Linux

twistero

Member

Registered: 2022-12-06

Posts: 1

cifs multiuser mount works at first, but "Permission denied" later

I have several Samba shares hosted on a TrueNAS-Scale server, and mount them with the "multiuser" option from an Arch Linux machine. After cifscreds add as my user, I can access the share, but after some time I no longer have access, and apparently my session keyring is revoked. Why?

On the Arch machine, I have systemd mount units enabled for each share like this:

$ cat /etc/systemd/system/mnt-share.mount
[Unit]
Description=Mount share
After=nss-lookup.target

[Mount]
What=//truenas-scale.localdomain/share
Where=/mnt/share
Type=cifs
Options=multiuser,sec=ntlmssp,credentials=/etc/samba/credentials/smbnobody.creds,iocharset=utf8,rw

[Install]
WantedBy=multi-user.target

(/etc/samba/credentials/smbnobody.creds contains username / password for user smbnobody, which I created on the TrueNAS server specifically to have minimal privileges to the shares, i.e. read privileges to the top level directory and nothing else.)

After a fresh boot, I SSH into the Arch machine, run cifscreds add truenas-scale.localdomain and type in the password, and I can have read / write access to /mnt/share as expected. I then start tmux, start a long-running task, and disconnect.

When I SSH back into the Arch machine after a while, often I find myself no longer having read / write access to /mnt/share:

$ ls /mnt/share
ls: cannot access '/mnt/share': Permission denied

$ ls -l /mnt
ls: cannot access '/mnt/share': Permission denied
total 0
d????????? ? ? ? ?            ? share

Attempting to add / update credentials also fails:

$ cifscreds add truenas-scale.localdomain
Error: unable to query session keyring: Key has been revoked

$ keyctl show
Session Keyring
Unable to dump key: Key has been revoked

I have to reboot the machine to gain access again.

This issue occurs if my long-running task does not access the share. If, for example, I run wget to download a large file to the share inside tmux, disconnect, and reconnect before the download completes, then read / write access to the share is still working. However, if I reconnect only after the download has completed, then I see "Permission denied".

Why does this happen, and how should I prevent it?

(I also asked this question on the Unix Stack Exchange site.)