I have a samba server setup and working, to authenticate users to a DOMAIN that is running on another samba machine. I don't think Samba is part of my issue, but I'm trying to be thorough. I have been asked to setup shares for different departments with the following folder structure: (using art dept as example)

Art Public Private Protected

Public, anyone can read and write Private, only people in the group DOMAIN\Art can enter, and they have full control of files inside Protected, anyone can read, only members of group DOMAIN\Art can write.

I have set a very unrestricted share permission in samba, and was trying to lock it down with the file permissions. From the smb.conf:

comment = Art Dept files
path = /dat/art
browseable = yes
read only = no
valid users = @DOMAIN\everyone
read list =
write list = @DOMAIN\everyone
admin list = @DOMAIN\art', @'DOMAIN\Domain Admins

I have set the folder permissions correctly: (I think)

drwxrws--- 2 root DOMAIN\art      4096 Jun  6 16:54 private
drwxrwsr-t 2 root DOMAIN\art      4096 Jun  6 17:09 protected
drwxrwsrwx 2 root DOMAIN\everyone 4096 Jun  6 16:55 public

Basically, Public and Private work the way I want, however, with protected, I am having some issues. By default a user not in the group "domain\art" can only read in that folder. they cannot create new documents, etc. however, if anyone in the correct group creates a file, or a folder, the permissions are set to 744. So, If User1 is in the domain\art group, and creates a file in the protected folder, anyone can change it. rwxrw-rw- 1 DOMAIN\User1 DOMAIN\art 4.3K Jun 6 17:09 newdb.txt

How can I force that folder (protected) to propagate the permissions 775 on all new files and subdirectories inside that folder?

I have tried setting the sticky bit:

chmod g+s protected
chmod a+s protected 

and it doesn't seem to help. Any other ideas?

  • I know I can use the smb.conf to add "force create mode".. but if I make it more restrictive for the protected folder (775), it would cause problems with the other folders .. – Brian Jun 7 '12 at 13:36

I ran into this same problem a couple of months ago; I was able to resolve this one by specifying the default permissions using access control lists.

setfacl -d -m u::rwx folder
setfacl -d -m g::rwx folder
setfacl -d -m o::r-x folder

In order to check once completed use

getfacl folder

Mounting the file system also needs to be added to /etc/fstab (add acl as an option).

/dev/VolGroup00/LogVol00 /                      ext3    acl,defaults    1 1
LABEL=/boot             /boot                   ext3    defaults        1 2
tmpfs                   /dev/shm                tmpfs   defaults        0 0
devpts                  /dev/pts                devpts  gid=5,mode=620  0 0
sysfs                   /sys                    sysfs   defaults        0 0
  • Can also add acl support without editing fstab using mount -o remount,acl /. If you want to give an individual user special permissions this route just put the username between ::. – Rob Jun 7 '12 at 14:07
  • Interesting notion. One minor (and possibly obvious) point to add is to make sure you can change read-only to read-write for the folder(s) concerned in Windows as well .... – J Evans Feb 7 '15 at 14:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.