Always permission 777 on mount shared cifs

Question

I have a little problem when I mount a SMB shared folder from a Synology NAS. I want to mount a shared folder with permissions: git:root 700

But the mounted folder always have permission set to 777 ( even after a chmod 700 without error)

In my /etc/fstab I used this line:

#uid=999 ---> git user
//server/folder /mnt/artifacts cifs username=windowsUser,password=xxxxx,gid=0,uid=999,file_mode=0700,dir_mode=0700,iocharset=utf8 0 0

Do you know why I cannot set my rights to 700 ? I did a mistake ? Something stupid ?

Thanks in advance for your help ;)

Answer 1

Your problem is a very common one. You are using incorrect tags to be able to change the file permissions of the mounted folder.

You need to add 'umask=', instead of 'file_mode=700' and 'dir_mode=700' as it is using system mount options not CIFS's options.

To do this you can use:

//address/location /mount/location cifs credentials=/location,uid=id,gid=id,umask=700 0 0

This will mount the file share under the set file permissions.

For security I would recommend using a credentials file, which contains the username and password, and must be set as read only.

Answer 2

a good start is to check out the manpage for CIFS:

$ man mount.cifs
[...]
   file_mode=arg
       If the server does not support the CIFS Unix extensions this overrides the default file mode.

   dir_mode=arg
       If the server does not support the CIFS Unix extensions this overrides the default mode for directories.
[...]
   nounix
       Disable the CIFS Unix Extensions for this mount. 
[...]

So since the file_mode (and dir_mode) seem to only work if the server does not support the CIFS Unix extensions, i would start by disabling them (via the nounix option)

Answer 3

If the remote machine user ID and the local machine user ID do not match, the permissions will default to 777. Mount.cifs doesn't support umask, so instead "noperm" option can be used. This way even if the permissions of the users on the local and remote machines don't match, the user will still be allowed to read and write to the folder, the equivalent of umask=000.

//address/location /mount/location cifs username=username,password=password,noperm,vers=2.0 0 0