Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Home directories are shared by Samba running on CentOS 6.3 with the following configuration:

[homes]
        comment = Home Directories
        read only = No
        inherit acls = Yes
        inherit owner = Yes
        browseable = No
        csc policy = disable

The Samba server is joined to an active directory domain where the user applefoo is a member of the group domain admins and the user bananabar is a member of the group domain users. The desktop of bananabar is redirected to \\samba\bananabar\Desktop which has the following ACEs:

# file: Desktop/
# owner: bananabar
# group: domain\040users
user::rwx
group::r-x
group:domain\040admins:rwx
mask::rwx
other::r-x
default:user::rwx
default:group::r-x
default:group:domain\040admins:rwx
default:mask::rwx
default:other::r-x

When bananabar creates a file/directory on his desktop, they are created with the following ACEs:

# file: New Folder by bananabar
# owner: bananabar
# group: domain\040users
user::rwx
group::r-x
group:domain\040admins:rwx
mask::rwx
other::r-x
default:user::rwx
default:group::r-x
default:group:domain\040admins:rwx
default:mask::rwx
default:other::r-x

# file: New Text Document by bananabar.txt
# owner: bananabar
# group: domain\040users
user::rwx
group::r-x
group:domain\040admins:rwx
mask::rwx
other::r--

On the other hand, when applefoo creates files/directories in \\samba\bananabar\Desktop, they are created with the following ACEs:

# file: New Folder by applefoo
# owner: bananabar
# group: domain\040users
user::rwx
group::r-x
group:domain\040admins:rwx      #effective:r-x
mask::r-x
other::r-x
default:user::rwx
default:group::r-x
default:group:domain\040admins:rwx
default:mask::rwx
default:other::r-x

# file: New Text Document by applefoo.txt
# owner: bananabar
# group: domain\040users
user::rwx
group::r-x      #effective:r--
group:domain\040admins:rwx      #effective:r--
mask::r--
other::r--

The only difference between the two is the mask where the files/directories created by applefoo are effectively read-only for the group domain admins. How do I get applefoo to create files/directories with the same ACEs as bananabar? Are the masks assigned by Samba or is Windows responsible for it? This happens whether I create them using Windows XP, Windows 7, or Windows Server 2008 R2.

share|improve this question

1 Answer 1

create mask = 770
directory mask = 770
force directory mode = 0700
share|improve this answer
4  
This answer needs an explanation. –  kasperd May 26 at 12:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.