in Citrix environment cannot create new files in shared folder

[Reneacute Genz]

With Fedora 34 (or Ubuntu 21.04) on the local computer I can connect to the Citrix environment. Within it I cannot create new files in the shared folder (network drive B, called "Crypto-Container"). I get the error message from Windows Explorer:

Zugriff auf den Zielordner wurde verweigert
---
Sie benötigen Berechtigungen zur Durchführung des Vorgangs.
Crypto-Container
Freier Speicherplatz: 154 GB
Gesamtgröße: 163 GB
[Wiederholen] [Abbrechen]

My translation to English "Access to destination folder has been denied; You require permissions to perform this action".

 

In Citrix environment I can still read, write, and delete existing files/folders in the shared folder. Only creating new files/folders is affected. On Fedora 34 I tested with Citrix Workspace App 20.10.0.6,  21.4.0.11, and 21.6.0.28. All have the problem.

With previous operating system versions (Fedora 33 and Ubuntu 20.10) this problem does not occur.

 

Based on my testing I would exclude the following as cause of the problem:

• local custom settings (I tested with new local account; with and without custom Fedora installation; installation from scratch, and upgrade)
• SELinux (disabled in /etc/selinux/config and verified after reboot with `sestatus`)
• desktop environment (on Fedora 34 I tested GNOME and Xfce)
• permissions on local computer (`sudo ls -lAZR / 1> F33.txt 2>&1` is identical to F34); on local computer I can create new files in the shared folder.
• USB crypto token (tested with 3 different tokens)
• version of the kernel Linux (after upgrade from F32 to F34: booting with F32 kernel has the problem too)
• permission in Citrix environment: in Citrix environment in cmd.exe "icacls B:" reports what translates to "full permissions for all".

 

Logs on F34 client do not report anything useful.

 

The problem does not seem to be Citrix site-specific, because other users report it too:

https://ask.fedoraproject.org/t/write-problem-after-upgrading-from-fedora-33-to-fedora-34/14118

 

The IT team that manages the Citrix environment asked me to report the problem here. I will send them the link to this post. Thank you for your help.

[Reneacute Genz]

The final CWA 2202 release (ICAClient-rhel-22.2.0.20-0.x86_64.rpm) contains the fix for "[CVADHELP-18448]", see https://docs.citrix.com/en-us/citrix-workspace-app-for-linux/whats-new.html

It works for me. If you cannot upgrade to that version, stick to Fernando Farabote's workaround.

[Fernando Farabote1709153404]

Hallo All,

one of our linux collaborators found a solution for this:

You have to edit the file: ~/.ICAClient/All_Regions.ini in your Linux and change the following line:

 

AllowSymlinkTraversalOutsideMap=True

 

Move from "*" to "True" and this is going to correct this issue.

 

Best,

 

[Reneacute Genz]

Hi Fernando Farabote,

 

thank you for sharing. I confirm that:
$ sed -i 's/AllowSymlinkTraversalOutsideMap=\*/AllowSymlinkTraversalOutsideMap=true/g' "${HOME}/.ICAClient/All_Regions.ini"
# is:
#[Virtual Channels\Drives]
#AllowSymlinkTraversalOutsideMap=true

fixed the problem for me. I can write to shared folder in Citrix environment again. I mark it as best answer for the time being.

 

Can someone from Citrix comment if this is the recommended solution or if Citrix intends to fix it otherwise?

 

 

Notes from my tests:

1. Disconnect from Citrix environment, change setting, re-logon to Citrix environment was sufficient, but caused problems, i.e. click on Windows icon did not work anymore, hence I had to use the Citrix top panel to log off. Better play it safe: log off, change setting, log in again.
2. changing value system wide is possible and works with the following files, but they get reset on ICAClient update:
   $ fgrep -ri AllowSymlinkTraversalOutsideMap /opt/Citrix/ICAClient/
   ...
   /opt/Citrix/ICAClient/config/All_Regions.ini:AllowSymlinkTraversalOutsideMap=*
   /opt/Citrix/ICAClient/config/usertemplate/All_Regions.ini:AllowSymlinkTraversalOutsideMap=*
3. you must store in user configuration file; I did not find the "[Virtual Channels]" header in other files mentioned here:
   https://docs.citrix.com/en-us/citrix-workspace-app-for-linux/configure-xenapp.html
   and storing header and value does not work with:
   • ${HOME}/.ICAClient/wfclient.ini
   • /opt/Citrix/ICAClient/config/module.ini

[Roger Erens]

22 hours ago, Reneacute Genz said:

With Fedora 34 (or Ubuntu 21.04) on the local computer I can connect to the Citrix environment. Within it I cannot create new files in the shared folder (network drive B, called "Crypto-Container"). I get the error message from Windows Explorer:

 

 

In Citrix environment I can still read, write, and delete existing files/folders in the shared folder. Only creating new files/folders is affected. On Fedora 34 I tested with Citrix Workspace App 20.10.0.6,  21.4.0.11, and 21.6.0.28. All have the problem.

With previous operating system versions (Fedora 33 and Ubuntu 20.10) this problem does not occur.

 

 

Same here on Ubuntu21.04 and openSUSE Tumbleweed.

I can read, update, and delete existing files in the shared folder, but not cannot create new files/folders on Client Mapped Drive.

And also for USB-disk:

On Ubuntu, I installed both

ctxusb_21.6.0.28_amd64.deb and

icaclient_21.6.0.28_amd64.deb

 

[Daniel Anken]

Same issue here on Arch Linux, with icaclient 21.8.0.40.

It was working fine until some update last spring (sorry I do not have more information about the previous working version).

 

No SELinux or other potentially blocking security.

I checked .ICAClient/wfclient.ini:

DrivePathW=/home/user/some/folder
DriveEnabledW=True
DriveReadAccessW=0
DriveWriteAccessW=0

 

I even tried to give 777 permissions to the folder, without success.

Thanks to René, I noticed that I can also edit existing files, but not create new ones.

I check in the Citrix session and saw that the folder had 'Read only' selected. Tried unticking the checkbox, but it does not fix the issue.

 

Any idea how to fix this ?
 

Thank you,

Daniel

 

[Reneacute Genz]

Citrix Workspace App 2202 beta covers this use case, see "[CVADHELP-18448]":

https://www.citrix.com/downloads/workspace-app/betas-and-tech-previews/workspace-app-tp-for-linux.html

Current description omits "Windows VDA". Beta version ICAClient-22.2.0.11-0.x86_64.rpm does not contain the fix. I gave feedback and was told both should be fixed for final release.