I'm trying to setup a samba-fileserver (CentOS 6.3) to serve my Windows- / Mac-clients, but can't seem to set the right permissions (or maybe it's not possible to achieve what I'm trying to). Here's the problem - I have no problems setting up the permissions the way I want to using chmod, chown, setfacl, put I can't seem to stop group-members from altering the permissions. These are my settings:
[test] path = /tmp/test read only = no valid users = @"DOMAIN+Domain Users" admin users = @"DOMAIN+Domain Admins" force group = "root" force user = "root" directory mode = 0770 force directory mode = 0770 create mode = 0660 force create mode = 0660 access based share enum = yes hide unreadable = yes
[testserver]# ls -l
drwxrwx---+ 3 root root 4096 Mar 21 09:20 /tmp/test
[testserver]# getfacl /tmp/test
getfacl: Removing leading '/' from absolute path names # file: tmp/test # owner: root # group: root user::rwx group::--- group:domain\040users:rwx mask::rwx other::--- default:user::rwx default:group::--- default:group:domain\040users:rwx default:mask::rwx default:other::---
Everything seems ok, but when I go to a Windows-client and access the share as a member of "domain users", I can change the permissions. For instance I can give Everyone read and write permissions to the file or directory. Am I missing something obvious or is there no way to prevent this?