Hi,
I use samba 3.0.22 as PDC on Debian with workstations under windows XP
SP1 and SP2.
I use ACLs to have a fine grained access rules.
When I copy a directory from a client to a samba share, default ACLs
are forgiven.
exemple : after I copy the directory A on the samba share :
getfacl A/
# file: A/
# owner: user1
# group: sambausers
user::rwx
group::---
other::---
default:user::rwx
default:group::---
default:other::---
But the parent directory has default ACLs, I can prove it :
getfacl .
# file: .
# owner: user1
# group: sambausers
user::rwx
user:root:rwx
user:bacula:r-x
group::---
group:sambaguests:rwx
group:User_Standard:rwx
group:User_Lead:rwx
mask::rwx
other::---
default:user::rwx
default:user:root:rwx
default:user:bacula:r-x
default:group::---
default:group:sambaguests:rwx
default:group:User_Standard:rwx
default:group:User_Lead:rwx
default:mask::rwx
default:other::---
Is it a bug ? because default ACLs are applied if I copy files. So Why
different behavior between directory and files ?
I noticed that it happened only to local directories which belong to
MYDOMAIN\user. If the owner of the local directory is
LOCALCOMPUTER\user the default ACLs is applied correctly. But once
again, it concerns only directory. When the file belong to
MYDOMAIN\user ACLs are applied correctly.
All what I want is that default ACLs are applied all the time whatever
the owner of local directory.
I try to play with "directory security mask", "force directory
security mode", inherit permissions without success.
Thank you for your help, I really don't know what to do.
My smb.conf looks like that :
#
-----------------------------------------------------------------------------
# Global parameters
#
-----------------------------------------------------------------------------
[global]
dos charset = 850
unix charset = ISO8859-1
workgroup = elb-lyon
netbios name = server02
server string = server02.elb-lyon
os level = 65
domain logons = Yes
domain master = Yes
local master = Yes
preferred master = Yes
wins support = Yes
obey pam restrictions = Yes
passdb backend = tdbsam, guest
passwd program = /usr/bin/passwd %u
passwd chat = *New*UNIX*password* %n\n
*ReType*new*UNIX*password* %n\n
*passwd:*all*authentication*tokens*updated*successfully*
passwd chat debug = Yes
pam password change = Yes
unix password sync = Yes
syslog = 0
log level = 2
# log level max = 10
log file = /var/log/samba/log.%m
max log size = 25600
dns proxy = No
panic action = /usr/share/samba/panic-action %d
invalid users = root2
# paramètres samba utilisateur par defaut
logon drive = P:
logon home = \\server02\%U
logon path = \\server02\profiles\%U
logon script = %U.cmd
# gestion des comptes posix automatique :)
# Gestion des comptes POSIX
add machine script = /usr/sbin/useradd -g sambamachines -c
Machine -d /dev/null -s /bin/false '%u'
add user script = /usr/sbin/useradd -g sambausers -c
Utilisateur -d /dev/null -s /bin/false '%u'
add group script = /usr/sbin/groupadd '%g'
add user to group script = /usr/bin/gpasswd -a '%u' '%g'
delete user script = /usr/sbin/userdel -r '%u'
delete group script = /usr/sbin/groupdel '%g'
delete user from group script = /usr/bin/gpasswd -d '%u' '%g'
set primary group script = /usr/sbin/usermod -g '%g' '%u'
veto files = /lost+found/ .recycle/ aquota.user/ aquota.group/
guest account = guest
hosts allow = 192.168.0. 127.
#
-----------------------------------------------------------------------------
# Necessaire Domaine
#
-----------------------------------------------------------------------------
[homes]
path = /mnt/SAN01/vd3_home2/home2/%u
comment = Home Directories
valid users = %S
guest ok = No
writable = Yes
create mask = 0700
directory mask = 0700
browseable = No
[netlogon]
path = /mnt/SAN01/vd3_home2/netlogon
comment = Partage NetLogon
valid users = @sambausers @sambaguests root
guest ok = No
read only = Yes
browseable = No
[profiles]
path = /mnt/SAN01/vd3_home2/profiles
comment = Profils utilisateurs
valid users = @sambausers @sambaguests root
guest ok = No
writable = Yes
create mode = 0700
browseable = No
#
-----------------------------------------------------------------------------
# Partages
#
-----------------------------------------------------------------------------
[vd1_echange]
comment = Zone d'echange.
path = /mnt/SAN01/vd1_echange
valid users = root @sambaadmins @sambaguests @User_Standard
guest ok = No
writable = Yes
create mask = 0770
directory mask = 0770
browseable = yes
# inherit permissions = yes
inherit acls = yes
hide unreadable = Yes
# directory security mask = 0000
# force directory security mode = 0777
