[Pkg-samba-maint] Bug#516160: Samba 3.3.0-2 breaks delete/rename of writeable files

[sacrificial-spam-address at horizon.com]

Package: samba
Version: 2:3.3.0-2
Severity: important

Upgrading from 3.2.5-4 broke a working configuration.

Briefly, I have a guest-only writeable share.
On upgrading to 3.3.0-2, clients (verified with smbclient on local machine)
could *create* files, but could not rename or delete them.

This is an annoyance, and breaks programs that save to a temp file and
then rename.

Reverting to 3.2.5-4 fixes it instantly.  (I'd just rather have the
security fixes in 3.2.6 through 3.2.8.)

Relevant testparm output:
[global]
        map to guest = Bad Password
        obey pam restrictions = Yes
        guest account = smbuser
        log level = 2
        syslog = 0
        log file = /var/log/samba/log.%m
        max log size = 1000
        deadtime = 10
        printcap name = cups
        os level = 33
        preferred master = Yes
        domain master = Yes
        dns proxy = No
        wins support = Yes
        panic action = /usr/share/samba/panic-action %d
        use sendfile = Yes
[test]
        path = /export/test
        read only = No
        create mask = 0664
        directory mask = 0775
        guest ok = Yes


Here's a loglevel=4 trace.  I can't make any sense of it, but maybe
someone else can:

[2009/02/19 13:25:21,  3] smbd/process.c:process_smb(1554)
  Transaction 411 of length 57 (0 toread)
[2009/02/19 13:25:21,  3] smbd/process.c:switch_message(1378)
  switch message SMBecho (pid 8700) conn 0x0
[2009/02/19 13:25:21,  3] smbd/sec_ctx.c:set_sec_ctx(324)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2009/02/19 13:25:21,  3] smbd/reply.c:reply_echo(4649)
  echo 1 times
[2009/02/19 13:25:21,  3] smbd/process.c:process_smb(1554)
  Transaction 412 of length 108 (0 toread)
[2009/02/19 13:25:21,  3] smbd/process.c:switch_message(1378)
  switch message SMBtrans2 (pid 8700) conn 0x87f4c20
[2009/02/19 13:25:21,  3] smbd/sec_ctx.c:set_sec_ctx(324)
  setting sec ctx (3000, 3000) - sec_ctx_stack_ndx = 0
[2009/02/19 13:25:21,  3] smbd/trans2.c:call_trans2findfirst(1926)
  call_trans2findfirst: dirtype = 6, maxentries = 1366, close_after_first=0, close_if_end = 1 requires_resume_key = 1 level = 0x104, max_data_bytes = 16644
[2009/02/19 13:25:21,  3] smbd/dir.c:dptr_create(518)
  creating new dirptr 256 for path test, expect_close = 1
[2009/02/19 13:25:21,  4] smbd/trans2.c:call_trans2findfirst(2080)
  dptr_num is 256, wcard = empty, attr = 6
[2009/02/19 13:25:21,  3] locking/locking.c:fetch_share_mode_unlocked(857)
  fill_share_mode_lock failed
[2009/02/19 13:25:21,  4] smbd/dir.c:dptr_close_internal(249)
  closing dptr key 256
[2009/02/19 13:25:21,  4] smbd/trans2.c:call_trans2findfirst(2185)
  SMBtrans2 mask=empty directory=test dirtype=6 numentries=1
[2009/02/19 13:25:21,  3] smbd/process.c:process_smb(1554)
  Transaction 413 of length 66 (0 toread)
[2009/02/19 13:25:21,  3] smbd/process.c:switch_message(1378)
  switch message SMBunlink (pid 8700) conn 0x87f4c20
[2009/02/19 13:25:21,  4] smbd/uid.c:change_to_user(213)
  change_to_user: Skipping user change - already user
[2009/02/19 13:25:21,  3] smbd/reply.c:reply_unlink(2618)
  reply_unlink : test/empty
[2009/02/19 13:25:21,  3] smbd/dosmode.c:unix_mode(124)
  unix_mode(test/empty) returning 0664
[2009/02/19 13:25:21,  4] smbd/open.c:open_file_ntcreate_internal(1804)
  calling open_file with flags=0x0 flags2=0x0 mode=0664, access_mask = 0x10000, open_access_mask = 0x10000
[2009/02/19 13:25:21,  3] smbd/error.c:error_packet_set(61)
  error packet at smbd/reply.c(2628) cmd=6 (SMBunlink) NT_STATUS_ACCESS_DENIED


The file and directory are -rw-rw-r-- and drwxrwsr-x, owned by the
guest user.  Adding o+w didn't help.

Thanks for any pointers!