I am setting up a file server with a shared directory. Inside, there are per-user folders that are readable by any user and a shared directory that is readable and writeable by any user. The per-user folders are simple enough. However, I am having some issues with the shared folder. I performed the standard procedure for making a set GID folder:

# chown root shared
# chmod -R ug+rwX shared
# chgrp -R users shared
# find shared -type d -exec chmod g+s "{}" \;
# find shared -type d -exec setfacl -m "default:group::rwx" "{}" \;

After ensuring all users are in the 'users' group, this works perfectly via direct console login, ssh, rsync, etc. However, there are some issues with samba.

With the default samba config, the SGID bit and GID are propagated, but new files and folders do not have the group write bit set. This appears to be because the ACL is being ignored. According to Samba Ignoring POSIX ACLs, the solution is to add vfs objects = acl_xattr to smb.conf. When I set that, the group write permission is correctly set. However, the group is then set to the user's primary group instead of the group of the parent directory, which rather defeats the purpose of the set GID bit. I tried the other smb.conf adjustments noted in the link (map acl inherit = yes, store dos attributes = yes, and inherit acls = yes), but these had no effect. What's the proper way to make this work?


2 Answers 2


To set group, user and permissions for new files and folders, I use this config on the server (in smb.conf):

   writeable = yes
   force user  = "user"
   force group = "users"
   create mask = 0664
   force create mode = 0664
   directory mask = 0775
   force directory mode = 0755

You could handle the common folder this way, through a separate shared folder.

Note: as pointed out in the comments, this setup may not be compatible with ACLs. I would recommend doing this only if you are going to rely on UNIX permissions only.

  • Ah, but I don't want to set the group write bit on the whole share, just on one subdirectory. And I likewise don't want to force a user or group on the whole share. Commented Dec 15, 2017 at 6:27
  • this is what i do (on a separate share from user shares) but according to one of the answers to this question the force and mask parameters are incompatible with ACLs.
    – quixotic
    Commented Dec 15, 2017 at 7:39
  • @quixotic Good point: my assumption was that with this setup one would not need ACLs, but there could be other reasons for needing them.
    – simlev
    Commented Dec 15, 2017 at 8:06

If vfs objects = acl_xattr, then automatically inherit acls = yes, as per the man pages describing inherit acls in smb.conf:

Note that using the VFS modules acl_xattr or acl_tdb which store native Windows as meta-data will automatically turn this option on for any share for which they are loaded, as they require this option to emulate Windows ACLs correctly.

And once inherit acls is turned on, the unix mode used to create new files/directories will be 0777 (effectively zeroing out the setgid bit):

Enabling this option sets the unix mode to 0777, thus guaranteeing that default directory acls are propagated.

Explicitly specifying inherit acls = no alongside vfs objects = acl_xattr seems to work, but they're probably not meant to be used together this way and may have unknown/hidden side effects.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .