2

This seems to pop up often (like here and here) but still haven't found a working and satisfactory solution.

The problem is as follow:

  • Mixed Linux and Windows environment; Linux users accessing thru NFS and Windows users using SMB; it's an AD domain and Kerberos works fine;

  • The idea would be to have subtrees owned by groups, like on plain POSIX with setgid directories; filesystems supports EA and POSIX ACLs. So for example I have this directory:

drwxrws---+ 1 vntmsm tecnico-acl 2868 giu 16 12:07 Foto
# file: Foto
# owner: vntmsm
# group: tecnico-acl
# flags: -s-
user::rwx
group::rwx
other::---
default:user::rwx
default:group::rwx
default:other::---

And I want that any user in the 'tecnico-acl' group can work in that subtree. Creating a file for example would do this:

-rw-rw---- 1 vntmsm tecnico-acl 911922 apr 13  2021 Foto/Valigia.jpg
# file: Foto/Valigia.jpg
# owner: vntmsm
# group: tecnico-acl
user::rw-
group::rw-
other::---

For reference this is what smbcacls says about that directory and file

# This is the directory
REVISION:1
CONTROL:SR|DP
OWNER:PROXIND\vntmsm
GROUP:PROXIND\tecnico-acl
ACL:PROXIND\vntmsm:ALLOWED/0x0/FULL
ACL:PROXIND\tecnico-acl:ALLOWED/0x0/FULL
ACL:Everyone:ALLOWED/0x0/
ACL:Creator Owner:ALLOWED/OI|CI|IO/FULL
ACL:Creator Group:ALLOWED/OI|CI|IO/FULL
ACL:Everyone:ALLOWED/OI|CI|IO/
# This is the file
REVISION:1
CONTROL:SR|DP
OWNER:PROXIND\vntmsm
GROUP:PROXIND\tecnico-acl
ACL:PROXIND\vntmsm:ALLOWED/0x0/RWDPO
ACL:PROXIND\tecnico-acl:ALLOWED/0x0/RWDPO
ACL:Everyone:ALLOWED/0x0/

So no funky ACLs, just the usual setgid behaviour. I'm not an expert in Windows ACLs but they seem at least plausible.

However (and this is the issue) when I create a file thru Samba (from Windows or from smbclient, for example) this is what I get:

-rwxrwx---+ 1 vntmsm Domain Users 377406 giu 16 09:00 Foto/1470307.jpg
# file: Foto/1470307.jpg
# owner: vntmsm
# group: Domain\040Users
user::rwx
user:vntmsm:rwx
group::rwx
group:Domain\040Users:rwx
mask::rwx
other::---

And from smbcacls:

REVISION:1
CONTROL:SR|SI|DI|DP
OWNER:PROXIND\vntmsm
GROUP:PROXIND\Domain Users
ACL:PROXIND\vntmsm:ALLOWED/I/FULL
ACL:PROXIND\Domain Users:ALLOWED/I/FULL

I see two issues here:

  • First of all the file is executable (and it shouldn't); I don't see a reason for Windows to create an executable file (AFAIK it has no concept of execute ACLs)

  • The primary group is Domain Users so Samba is clearly ignoring the setgid bit and doing its stuff

I do not need support for Windows ACLs (and for the moment neither for POSIX ACLs, just plain old file permissions) but I can't find a way to make Samba honour the setgid bit (also why it creates executable files?)

Most of the solution around use force group on the share but it's not acceptable here (we use different subtrees with different groups)

At the moment my smb.conf has this in the global section (it's a member server):

idmap config * : backend = tdb
idmap config * : range = 3000-3999
idmap config DOMAIN : backend = ad
idmap config DOMAIN : range = 0-2999
idmap config DOMAIN : schema_mode = rfc2307
idmap config DOMAIN : unix_nss_info = yes
idmap config DOMAIN : unix_primary_group = yes
inherit acls = yes
inherit permissions = yes
kerberos method = system keytab
load printers = yes
log file = /var/log/samba/log.%m
map acl inherit = yes
max log size = 100000
min print space = 100000
pid directory = /var/lock/samba
printing = lprng
private dir = /etc/samba/private
realm = AD.DOMAIN
rpc_server:spoolss = external
rpc_daemon:spoolssd = fork
security = ADS
show add printer wizard = yes
spoolss:architecture = Windows x64
store dos attributes = yes
unix charset = UTF8
username map script = /bin/echo
utmp = Yes
vfs objects = acl_xattr
winbind enum groups = yes
winbind enum users = yes
winbind nss info = rfc2307
winbind use default domain = yes
workgroup = DOMAIN

and on the share I have this

[share]
path = /data/share
create mask = 0660
directory mask = 02770
force directory mode = 02000
read only = No

I read around that the acl_xattr has some incompatibilies or whatever with other options; it's really not clear…

Is there a way to simply have samba obey the POSIX semantic?

1
  • Maybe the directory defaults? default:user::rwx default:group::rwx
    – K-attila-
    Jun 16, 2022 at 11:44

1 Answer 1

2

Finally found it!

The trick is using

nt acl support = no

in the global section. Samba then reverts to standard POSIX semantic (and also maps sanely POSIX ACLs to Windows ones).

No more executable files and setgid is correctly handled now.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .