We have implemented Samba on our campus. Accounts and groups are maintained in an LDAP DIT. Access to shared folders is group based. Our Samba share definitions have something like:
valid users = +share_a-rw, +share_a-r
This allows users from read/write and read groups to have access.
On the file system, the share group owner is
share_a-rw (the group with read/write) access, and read access is provided by a POSIX file ACL. Default ACLs are set for the read group as well, so new file created in the folder get the ACL. The folder is setGID so the main group is also propagated.
The system has been working well, but I noticed that if an end user "moves" a file from one share to another rather than copying, the file does not contain the ACL for the read group. We are using MS DFS links to make all our file servers appear as a single large server.
I am wondering if there is some setting in Samba that can make the behavior emulate a copy rather than a move. Has anybody had any experience with this issue?