I've had a few shares configured in Samba 4.9.3 (Arch Linux), everything was fine. Access control was done via unix accounts and groups. Then I decided to change the running system.
I set up a Time Machine backup volume in Samba, introducing the
vfs_fruit module. That part seems to have started the problems. Sources said that macOS can be picky and the module chain
catia fruit streams_xattr needs to be enabled on all the shares, not just the Time Machine share. So I did that.
(The Time Machine backup went through with those settings. TBH I didn't try restoring yet and I'm a little scared of it.)
However, whenever I create a folder on a normal share (via Finder.app), it now gets unix permissions
drwxr-xr-x+ that differ from the
directory mask = 2770 that I configured for the share. Apart from that, it has these ACLs set:
> getfacl /mnt/dungeon/tmp/untitled\ folder getfacl: Removing leading '/' from absolute path names # file: mnt/dungeon/tmp/untitled folder # owner: nobody # group: smb_tmp user::rwx user:nobody:rwx #effective:r-x group::rwx #effective:r-x group:smb_tmp:rwx #effective:r-x mask::r-x other::r-x default:user::rwx default:user:nobody:rwx default:group::rwx default:group:smb_tmp:rwx default:mask::rwx default:other::---
mask::r-x part seems to prevent my user (in group smb_tmp) from even renaming the "untitled folder" I created. If I set mask to
rwx manually like this, the folder becomes editable:
sudo setfacl -m mask::rwx /mnt/dungeon/tmp/untitled\ folder
Changing the folder's permissions from Finder.app is not possible, it tells me I don't have the necessary permission.
If I create a folder in the same location from a Windows 8 client, it has the proper unix access rights and no ACLs set.
I also tried modifying my user's umask on the server, but changing that from the default
027 didn't change anything.
The other Samba options I tried are in the global section of my smb.conf. None of them changed the ACLs of the folders I created.
What do I need to do to have both Time Machine backup and group-owned shares work properly? I'm not particularly afraid of ACLs, but if I can get by without them that'd be just fine.