What I basically want to do, is to be able to set SGID (setgid) on certain directories from Windows on Samba shares. Reminder: Files and directories created within directory with SGID set inherit the primary group of parent directory.


I have an environment with few dozen groups which need to access files related to projects they belong to. As the membership of project groups and the groups themselves is changing quite often, I want to delegate setting of permissions to group leaders as much as it is possible. While managing group membership was easy (GOSa privilege delegation took care of this nicely), I'm struggling with file permissions.

Note: the number of groups and other similar hierarchies is large, so creating different shares for each group or hierarchies is unworkable (the amount of possible mount points in Windows is limited, using UNC paths is unfortunately impossible too).

The folders in the share look like this:

/share root
+-- hierarchy 1
+-- hierarchy 2
|   ...
+-- hierarchy 20
+-- projects
    +-- project A
    |   +-- dir A
    |   +-- file
    +-- project B
    +-- ...
    +-- project Z

Samba ACL Group Control

The nice feature of samba (acl group control) allows me to allow members of primary group owning the directory or file to edit its permissions (unlike the regular: owner, root and "admin users" from smb.conf).

So when I have a folder like this (POSIX ACL from getfacl):

# file: project A
# owner: root
# group: proj-a-adm
# flags: -s-

Members of group proj-a-adm can edit permissions of this directory (and all directories and files created within), while members of proj-a group can modify files themselves, but can't change permissions of those files. Domain Users can only read files within.


When there is a new project created, a root user needs to run chmod g+s projects/project\ AA on command line.

I can edit permissions of files and folders after a new project was created without a problem using Windows file permissions window, but creation of new project folder requires running a command in the shell which is rather hackish.

  • How do you create new projects? In particular, how does the group of projects/projectsABC get set? I'm thinking about whether making projects/ itself setgid would work.
    – jade
    Jan 15, 2012 at 23:22
  • Currently: ssh samba-server chgrp proj-abc-adm projects/projectsABC. I asked how to do it easier from Windows in another question: serverfault.com/questions/347096/… I'll probably just use a script that enumerates all groups and checks if groups with specific prefix have corresponding folders. Jan 16, 2012 at 9:46
  • @jon And no, making projects/ SGID wouldn't work. This would help in that making a new project folder would make it inherit the SGID but the primary group would be the primary group of projects/ -- let's call them projects-admins. No regular user can change group of a SGID folder. Jan 16, 2012 at 10:41

1 Answer 1


A) Write a small web form and a small script that will create a group and a directory for a project.

B) Write a small windows batch file that will do the same over ssh. You can use the ssh client from the cygwin project or some native windows ssh client.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .