Home / server / Questions / 396453
Accepted
Brian
Asked: 2012-06-08 05:30:19 +0800 CST

Forcing file permissions on subdirectories on a samba share

  • 772

I have a samba server setup and working, to authenticate users to a DOMAIN that is running on another samba machine. I don't think Samba is part of my issue, but I'm trying to be thorough. I have been asked to setup shares for different departments with the following folder structure: (using art dept as example)

Art Public Private Protected

Public, anyone can read and write Private, only people in the group DOMAIN\Art can enter, and they have full control of files inside Protected, anyone can read, only members of group DOMAIN\Art can write.

I have set a very unrestricted share permission in samba, and was trying to lock it down with the file permissions. From the smb.conf:

[art]
comment = Art Dept files
path = /dat/art
browseable = yes
read only = no
valid users = @DOMAIN\everyone
read list =
write list = @DOMAIN\everyone
admin list = @DOMAIN\art', @'DOMAIN\Domain Admins

I have set the folder permissions correctly: (I think)

drwxrws--- 2 root DOMAIN\art      4096 Jun  6 16:54 private
drwxrwsr-t 2 root DOMAIN\art      4096 Jun  6 17:09 protected
drwxrwsrwx 2 root DOMAIN\everyone 4096 Jun  6 16:55 public

Basically, Public and Private work the way I want, however, with protected, I am having some issues. By default a user not in the group "domain\art" can only read in that folder. they cannot create new documents, etc. however, if anyone in the correct group creates a file, or a folder, the permissions are set to 744. So, If User1 is in the domain\art group, and creates a file in the protected folder, anyone can change it. rwxrw-rw- 1 DOMAIN\User1 DOMAIN\art 4.3K Jun 6 17:09 newdb.txt

How can I force that folder (protected) to propagate the permissions 775 on all new files and subdirectories inside that folder?

I have tried setting the sticky bit:

chmod g+s protected
chmod a+s protected

and it doesn't seem to help. Any other ideas?

linux filesystems samba

1 Answers

  1. Best Answer

    I ran into this same problem a couple of months ago; I was able to resolve this one by specifying the default permissions using access control lists.

    setfacl -d -m u::rwx folder
setfacl -d -m g::rwx folder
setfacl -d -m o::r-x folder

    In order to check once completed use

    getfacl folder

    Mounting the file system also needs to be added to /etc/fstab (add acl as an option). 

    /dev/VolGroup00/LogVol00 /                      ext3    acl,defaults    1 1
LABEL=/boot             /boot                   ext3    defaults        1 2
tmpfs                   /dev/shm                tmpfs   defaults        0 0
devpts                  /dev/pts                devpts  gid=5,mode=620  0 0
sysfs                   /sys                    sysfs   defaults        0 0
    • 1