File in a Samba share can be edited and saved even though it has root permissions?

Hello,

I am using the Ubuntu mate live cd/usb running 20-04-focal-LTS.
I am testing a network share I plan on sharing between Ubuntu mate and a Windows 10 PC.

Here is my smb.conf

[global]
workgroup = WORKGROUP
security=user
netbios name = osmc
server string = Raspbian on Pi3
server role = standalone server
follow symlinks = yes
wide links = no
unix extensions = no
lock directory = /var/cache/samba
load printers = no
printing = bsd
printcap name = /dev/null
disable spoolss = yes
log level = 1
map to guest = bad user

read raw = Yes
write raw = Yes
strict locking = no
min receivefile size = 16384
use sendfile = true
aio read size = 2048
aio write size = 2048
create mask = 0666
directory mask = 0777

[root]
comment = OSMC Root Directory
path = /
browseable = yes
read only = no
writable = yes
force user = root
valid users = root,osmc
create mask = 0777
directory mask = 0777

[osmc]
browsable = yes
read only = no
valid users = osmc
path = /home/osmc
comment = OSMC Home Directory

[automount template]
browseable = yes
-valid = no
valid users = osmc
path = %P
hide files = /$RECYCLE.BIN/System Volume Information/desktop.ini/thumbs.db/

include = /etc/samba/smb-shares.conf

This smb.conf file somehow manages to create a samba share for any USB drive connected.

If I create a file directly in the filesystem of the USB drive while sudo su (root) then I get a file with root:root ownership and rw-r--r-- permissions. But then if I use the Ubuntu-mate file explorer to browse to the file via the Samba share and use the text editor Pluma to edit the file.....

From Ubuntu-mate I notice the ownership of the file changes... I think this is because Pluma actually creates a new file every time you save an edit to the file. So then the new file gets the ownership and permissions as dictated by the create mask and directory mask directives in smb.conf.

Can someone confirm if that is correct or no?

Also:
If true, is that also the reason why I can save an edit to a file that only has write permissions on the owner (root) and I am not root? Or am I? In this case I think I am the osmc user while accessing a file from the file explorer. I don't have a force user statement in the [automount template] share. However, when using the Live USB trying out Ubuntu-mate is the "Live Session User" running as root? And if so would that be the reason why I can edit a file with root only write access ?

In contrast, when I try from Windows 10 to edit and save a file with root:root and rw-r--r-- from the Samba share I CANNOT save it, instead I get a permission denied error popup message.

-- This was from Ubuntu - mate (shows the inode changing when I save an edit to the file while using Pluma)

root@osmc:/media/4TB1/DataShare# nano test-2.txt
root@osmc:/media/4TB1/DataShare# ls -il test-2.txt 
216272635 -rw-r--r-- 1 root root 5 Feb 25 00:45 test-2.txt
root@osmc:/media/4TB1/DataShare# ls -il test-2.txt 
216272633 -rw-rw-rw- 1 osmc osmc 14 Feb 25 00:45 test-2.txt
root@osmc:/media/4TB1/DataShare#

-- This was from Windows (the inode does not change when I save an edit to the file while using Notepad)

osmc@osmc:/media/4TB1/DataShare$ ls -il test-4.txt
216272638 -rw-r--r-- 1 osmc osmc 6 Feb 25 01:06 test-4.txt
osmc@osmc:/media/4TB1/DataShare$ umask
0022
osmc@osmc:/media/4TB1/DataShare$ ls -il test-4.txt
216272638 -rw-r--r-- 1 osmc osmc 13 Feb 25 01:07 test-4.txt
osmc@osmc:/media/4TB1/DataShare$

umask is 0022 when working from the OSMC command line as root and creating files from there (not from the Samba Share).

When using the Ubuntu mate desktop file explorer to get to the samba share I am logged in as "Live Session User" maybe that user as root access?

When I run this command from a ubunut mate terminal running as the ubuntu-mate user. I think this means that ubuntu-mate user also has root access?

ubuntu-mate@ubuntu-mate:~$ id
uid=999(ubuntu-mate) gid=999(ubuntu-mate) groups=999(ubuntu-mate),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),120(lpadmin),132(lxd),133(sambashare)
ubuntu-mate@ubuntu-mate:~$

Another command proving this...

ubuntu-mate@ubuntu-mate:~$ cat /etc/group | grep sudo
sudo:x:27:ubuntu-mate

So ubuntu-mate is a member of the group called: sudo.

But I am not acting as that user when opening and editing a file in Ubuntu mate file explorer am I? I thought I was acting as the "Live Session User" then?

When I run this command from the Ubuntu mate terminal:

ubuntu-mate@ubuntu-mate:~$ cat /etc/passwd | grep ubuntu
ubuntu-mate:x:999:999:Live session user,,,:/home/ubuntu-mate:/bin/bash

So maybe ubuntu-mate and live session user are both the same and both likely have root access?

Thank you,

Maybe I made the question too complicated? I wanted to provide as much info as possible to help.

In short...
I have a file on a linux OS with these permissions:

root@osmc:/media/4TB1/DataShare# nano test-2.txt
root@osmc:/media/4TB1/DataShare# ls -il test-2.txt
216272635 -rw-r--r-- 1 root root 5 Feb 25 00:45 test-2.txt

In Ubuntu mate OS the directory /media/4TB1 is available from a Samba share (see post 1) from the file explorer. If I open the file above test-2.txt I can edit it and save the file with Pluma text editor. When I do so the file has these permissions:

root@osmc:/media/4TB1/DataShare# ls -il test-2.txt
216272633 -rw-rw-rw- 1 osmc osmc 14 Feb 25 00:45 test-2.txt

Why is this possible?

  1. Because Pluma creates a new file when you save it in Pluma? And the new permissions come from the way the share is defined?
  2. Ubuntu-mate Live Session User in the Live USB runs as root?

Cheers,