I have an Ubuntu 10.04.4 LTS server running Samba, and joined to our Active Directory domain using PBIS (formerly likewise-open.) Samba is configured to do authentication using AD users/groups, and this is working correctly. Also, standard Linux permissions (user, group, others) world properly with Samba. BUT, Samba seems to totally ignore any permissions set with extended ACLs.
I have tried various smb.conf configurations I have seen recommended elsewhere, and none of them seem to have any effect.
- Files share is on it's own drive. Mount info from /etc/fstab for the drive is:
- UUID=372aa637-4b7b-45cc-8340-9d028893c196 /media/news-drive ext4 user_xattr,acl 0 2
- Machine is joined to domain using PBIS (formerly likewise-open)
- Samba config for the share is:
[shared] comment = , nt acl support = yes admin users = force user = force group = \domain^users create mask = 0770 directory mask = 0770
- Global Samba Config
workgroup = dns proxy = no server string = load printers = no cups options = raw guest account = pcguest log file = /var/log/samba/%m.log max log size = 50 security = ADS realm = socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 interfaces = 172.16.0.20 10.4.1.20 127.0.0.1 bind interfaces only = yes idmap uid = 16777216-33554431 idmap gid = 16777216-33554431 map to guest = Bad User
- I have also used some of these in the global config, without success
idmap backend = idmap_rid:=16777216-33554431 nt acl support = yes inherit acls = Yes map acl inherit = Yes map archive = no map hidden = no map read only = no map system = no store dos attributes = yes inherit permissions = Yes template shell = /bin/false winbind use default domain = no
What am I missing here, to get Samba to work with the extended ACLs?
An Example of What is Happening
I have a folder in a samba share. The share itself is wide open within our domain (the "valid users" setting is set to the "Domain Users" group for the AD domain.) Within that share, I have a folder with more restrictive permissions at the file system level (owned by one AD user, with the group set to an AD group with just a few people in it and permissions chmod-ed to 770)
The issue is, I need to give access to that folder to another AD group, so I run "setfacl -m u::rwx " to give them permission to access it. This works within Linux (if I ssh in which one of those users and navigate to the folder)...but if I connect to the SMB share with that same user, and try and navigate to that folder, access is denied.