Phantom shares when Samba audit prefix contains brackets in the value string

[devopsinf-pichilemu]

Bug Info

Describe the bug When setting up a shared folder through Samba, if one enables the Audit option, several lines are added to the configuration, like the following:

full_audit:prefix = ???%I???%u???%m???%S???%T???

However, this leaves all the question marks in the logs, making them relatively unreadable. Therefore, I tried changing the value to the following:

full_audit:prefix = [%T][%I][%u-%m][%S]

But this caused "ghost shared folders" to appear, which cannot be edited, and also prevented re-editing the value of full_audit:prefix where the change to brackets was made.

For example, this is one of the shared folders in which I made the change:

[REDACTED]
path = /var/repositorios/[REDACTED]
read only = No
vfs objects = full_audit catia fruit streams_xattr recycle
full_audit:prefix = [%T][%I][%u-%m][%S]
recycle:exclude_dir = .recycle
recycle:exclude = .tmp,.temp,.o,.obj,.TMP,.TEMP
recycle:noversions = .tmp,.temp,.o,.obj,.TMP,.TEMP
recycle:versions = yes
recycle:keeptree = yes
recycle:touch = yes
full_audit:failure = connect
full_audit:success = connect disconnect openat renameat linkat unlinkat
full_audit:facility = local5
full_audit:priority = notice
fruit:nfs_aces = no
fruit:zero_file_id = yes
fruit:metadata = stream
fruit:encoding = native

As can be seen, [%T] is part of the value of full_audit:prefix, and is interpreted as a configuration name, since each shared folder is preceded by [folder_name].

To Reproduce

1. Set or edit a share
2. Change the full_audit:prefix to a string containing brackets
3. Save changes

Server Side

• OS: Rocky 8.9
• Cockpit Version: 300.1