0

I have setup a Samba file server as a Active Directory member. The file server works fine and users can access a share, create files and folders, delete and modify them etc.

Now consider the following scenario.

a) the user "Administrator" creates a folder and gives permissions as follows: Domain Admins = Full control, Domain Users = Change. With these permissions, it should be possible that all members of the "Domain Admins" can edit the folder's permissions. However, members of the "Domain Users" can only view, but not change the permissions.

b) I log into the Samba file server as an ordinary "Domain User" and create a new folder. As predicted in a), I cannot edit its permissions. However, what I can do is the following: go to "Advanced", then disable inheritance. Windows then asks if the permissions of the subfolders and files shall be changed. Surprisingly, this works, and now I, as a ordinary "Domain User", who shall not have the ability to change permissions, can now gain "full control" of the folder I just created, even though the parent folder denies the full control.

I believe in my Samba config there is a problem with ACL inheritance, I believe a restricted user should not be allowed to switch off ACL inheritance. What could be the problem?

below is my smb.conf and the shares.conf.

[global]

# ...... removed some stuff that is not important

#-------------------------------------------------------------------
# idmap
#
idmap config * : backend = tdb
idmap config * : range = 10000000-20000000
idmap config MYDOMAIN : backend = ad
idmap config MYDOMAIN : schema_mode = rfc2307
idmap config MYDOMAIN : range = 500-9999999
idmap config MYDOMAIN : unix_primary_group = yes

#-------------------------------------------------------------------
# winbind
#
#winbind enum users = yes
#winbind enum groups = yes

ea support = yes
vfs objects = catia fruit acl_xattr streams_xattr
fruit:metadata = stream
fruit:model = MacSamba
fruit:veto_appledouble = no
fruit:posix_rename = yes
fruit:zero_file_id = yes
fruit:wipe_intentionally_left_blank_rfork = yes
fruit:delete_empty_adfiles = yes

inherit acls = yes
inherit permissions = yes
map acl inherit = yes
nt acl support = yes

include = /etc/samba/shares.conf

and the shares.conf:

[pub]
comment = Public
path = /tank/pub
read only = no

Edit: I did some more experimentation. I found that the key is that restricted users can disable inheritance on folders they own, the question is how I can avoid this. I found a workaround by setting "inherit owner = yes" to my smb.conf. This makes all new files and folders owned by "root" and therefore, nobody has full control permissions unless explicitly granted.

1 Answer 1

0

You're missing acl group control = yes:

If this parameter is set, then Samba […] also allows the primary group owner of a file or directory to modify the permissions and ACLs on that file.

Although I haven't (and can't) test this next part, it goes on to suggest that,

This parameter is best used with the inherit owner option and also on a share containing directories with the UNIX setgid bit set on them, which causes new files and directories created within it to inherit the group ownership from the containing directory.

Reading on, you might want to have the ACL configuration settings set like this,

acl group control = yes
acl map full control = no
inherit acls = yes
inherit owner = windows and unix
map acl inherit = yes

Basically, Windows ACLs and UNIX file permissions (at least the outwardly visible ones) don't really map to each other at all, and there's a lot of fudging going on to make permissions work properly on a Windows share.

2
  • I just tried this. Unfortunately, it also does not work. Obviously, the owner/creator of something is always allowed to change permissions. Therefore, if inherit owner is configured, normal users cannot change permissions. All other options don't seem to have an effect on my installation. But I now found another solution: I use the "Owner rights" principal and don't give it full control. With this, creator/owner cannot change permissions. I believe this is an acceptable workaround.
    – T. Pluess
    Commented Sep 20, 2023 at 15:27
  • @T.Pluess I think the reason for acl group control is that in the UNIX/Linux world of permssions, a group (such as Domain Admins) doesn't own anything and therefore can't change permissions, etc. When you set this option, Samba fudges the permissions rights so that Domain Admins can be an "owner" - and therefore have Full Control. At least, that's how I read it but as I no longer have an AD setup to hand I can't confirm for certain Commented Sep 20, 2023 at 15:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .