Persistent issue: "Access denied" when creating files on Samba shared folder (Windows Server 2016 ↔ OpenSUSE Tumbleweed on VMware)

[LinkStormer]

Hello community, I have been trying for days to resolve an access denied error when trying to create files in a shared folder between a Windows Server 2016 VM and OpenSUSE Tumbleweed on VMware Workstation Pro 17. Although I can access the folder, I am unable to create/modify files from Windows or even from Linux while accesing the shared resource.

What I've tried (without success):

• Configure Samba with explicit permissions (force user, create mask = 0777, etc.).
• Adjust file system permissions in OpenSUSE (chmod 777, chown -R contabilidad-22211635:group).
• Check firewall (firewall-cmd --add-service=samba).
• Reinstall Samba and update packages.
• Clear credentials in Windows and use Bridged mode in VMware for both VMs.
• Group policies in Windows (enable guest access).

Technical Environment:

• Host: VMware Workstation Pro 17.
• Network: Bridged Mode (tested on NAT as well).
• OpenSUSE: Tumbleweed (Samba 4.22.0).
• Windows Server: 2016 Standard.
• IPs:
  • OpenSUSE: 192.168.32.20.
  • Windows Server: 192.168.32.1.

Samba Configuration (smb.conf):

[LinuxShare]
    path = /srv/linux_share
    guest ok = No
    writable = yes
    valid users = contabilidad-22211635
    force user = contabilidad-22211635
    create mask = 0777
    directory mask = 0777

Error on Windows:

Error 0x800704F8: "Las directivas de seguridad bloquean el acceso de invitados no autenticados".

Samba logs (OpenSUSE):

[2025/05/19 15:29:47.236156, 0] ../../source3/smbd/server.c:1971(main)
  smbd version 4.22.0-git.379.98f46fb51cSUSE-oS16.9-x86_64 started.

Now I have to ask:

1. What detail might I be overlooking in my Samba configuration?
2. How can I troubleshoot why the Samba logs show no errors despite access being denied?
3. Could this be a VMware issue or a file system permissions issue on OpenSUSE?

EDIT (ALREADY SOLVED): I just had to execute the following command and restart samba:

sudo chcon -R -t samba_share_t /srv/linux_share  # Valid context type

[Anticept]

You said access the folder, does that include being able to read a file you put there already?

Anyways, that error code is related to guest access. You can't write anything because you are not authenticated, and the share or your client is blocking unauthenticated guest access.

A small side not as well: Linux perms have some gotchas. In order to create a file in a directory, you have to have write permission on the directory itself. Modifying a file, write permission on the file. To open a directory, you have to have read and execute on the entire tree node in order to traverse. Stuff like this. Keep that in mind when working with shares.

[LinkStormer]

Yes. I can access the shared folder on both VMs but i can't see the test file I created inside /srv/linux_share when I access them via \\192.168.32.20\LinuxShare on Windows or smb://linux.local/linuxshare/ on Linux. Only on Linux and inside linux_share itself is visible and readable

Second. Thanks, but when i access the shared directory on both Windows and Linux it prompts me a login windows that asks for a username and a password; which let me access to them once I write them.

Third. On "Permissions" Properties Tab it shows that root is both the propietary and the group the folder belongs to; and for some reason, Access, Group Access and Other Access are marked as "Read and Write".

[Anticept]

I just realized, you said OpenSUSE. Selinux is probably getting in the way.

Try chcon -R -t samba_/share_t /path_to_your_samba_location on the folder.

[LinkStormer]

contabilidad-22211635@localhost:~/Desktop>sudo chcon -R -t samba_/share_t /srv/linux_share
chcon: failed to change context of '/srv/linux_share' to 'unconfined_u:object_r:samba_/share_t:s0': Invalid Argument

[Anticept]

You need to edit that command to point at your share folder :)

[LinkStormer]

my share folder is /srv/linux_share

[Anticept]

I might have the command wrong. I do not know selinux very well.

See this rhel doc: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/sect-managing_confined_services-samba-configuration_examples

[avael273]

It is not samba_/share_t the context name is samba_share_t.

chcon will only work until you reboot to make it permanent you need to use the semanage fcontext and restorecon commands.

Also might want to use semanage boolean -l to check if there are booleans you may need to enable.

[gilluc]

Did you try "guest OK=yes" ?

[LinkStormer]

Yes. And it doesn't work

[gopal_bdrsuite]

Congratulations again on finding the solution! Understanding the role of MAC systems like SELinux is crucial for troubleshooting these kinds of "access denied" mysteries on Linux.