Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an Ubuntu 10.04.4 LTS server running Samba, and joined to our Active Directory domain using PBIS (formerly likewise-open.) Samba is configured to do authentication using AD users/groups, and this is working correctly. Also, standard Linux permissions (user, group, others) world properly with Samba. BUT, Samba seems to totally ignore any permissions set with extended ACLs.

I have tried various smb.conf configurations I have seen recommended elsewhere, and none of them seem to have any effect.

Machine Setup:

  • Files share is on it's own drive. Mount info from /etc/fstab for the drive is:
    • UUID=372aa637-4b7b-45cc-8340-9d028893c196 /media/news-drive ext4 user_xattr,acl 0 2
  • Machine is joined to domain using PBIS (formerly likewise-open)
  • Samba config for the share is:
[shared]
   comment = , 
   nt acl support = yes
   admin users = 
   force user = 
   force group = \domain^users
   create mask = 0770
   directory mask = 0770
  • Global Samba Config
workgroup = 
dns proxy = no
server string = 
load printers = no
cups options = raw
guest account = pcguest
log file = /var/log/samba/%m.log
max log size = 50
security = ADS
realm = 
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
interfaces = 172.16.0.20 10.4.1.20 127.0.0.1
bind interfaces only = yes
idmap uid = 16777216-33554431
idmap gid = 16777216-33554431
map to guest = Bad User
  • I have also used some of these in the global config, without success
idmap backend = idmap_rid:=16777216-33554431
nt acl support = yes
inherit acls = Yes
map acl inherit = Yes
map archive = no
map hidden = no
map read only = no
map system = no
store dos attributes = yes
inherit permissions = Yes
template shell = /bin/false
winbind use default domain = no

What am I missing here, to get Samba to work with the extended ACLs?

An Example of What is Happening

I have a folder in a samba share. The share itself is wide open within our domain (the "valid users" setting is set to the "Domain Users" group for the AD domain.) Within that share, I have a folder with more restrictive permissions at the file system level (owned by one AD user, with the group set to an AD group with just a few people in it and permissions chmod-ed to 770)

The issue is, I need to give access to that folder to another AD group, so I run "setfacl -m u::rwx " to give them permission to access it. This works within Linux (if I ssh in which one of those users and navigate to the folder)...but if I connect to the SMB share with that same user, and try and navigate to that folder, access is denied.

share|improve this question
    
hmmm....I really don't see a specific question here. – mdpc Dec 19 '12 at 21:45
    
Sorry, I thought the "what am I doing wrong" was implied. :) – woodsbw Dec 19 '12 at 22:05
    
I guess I still don't understand the specific problem. A specific example might help everybody to understand your problem. Do you want Samba to map NTFS permission to the underlying Linux ACLs assigned for the windows user to see/use? – mdpc Dec 19 '12 at 22:06
    
Added to question – woodsbw Dec 19 '12 at 22:15

Coming late to this question, I'd still like to point to the official Samba documentation for support of ACLs. This is valid for Samba 4.0.0 onwards, which certainly was not available at the time this question got asked. But since the question pops up in search engines, this link might be helpful.

The basic steps are:

1. Ensure the file system supports acls (ext4 nowadays does by default, no need for extra mount options)

2. Ensure Samba was compiled with ACL support. (Yes, by default on Ubuntu 14.04 LTS):

smbd -b | grep HAVE_LIBACL

3. Enable ACL by setting the following in the [global] section of /etc/samba/smb.conf:

vfs objects = acl_xattr
map acl inherit = yes
store dos attributes = yes

For details really visit the official docs as linked to above.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.