I have a Samba 4 server running as a domain member sharing a bunch of document images that get updated regularly. I have the root folder of the share set up as owned by user "foo" and group "Domain Users" with "Domain Admins" having full control of the group. User "bar" creates new files and folders by copying files to the folder.

When user "admin1" (member of Domain Admins) tries to change or update security permissions on the new files, we get "access denied". When user "foo" tries (a member of Domain Users) tries to change the files, we also get "access denied". Even making sure that the files and folders are set to allow "Domain Users" full control, we still get access denied. It's like the group permissions are being ignored and only the user permissions are applied.

Am I maybe not understanding how Windows ACLs work?

  • In Linux, the umask for new files controls permissions on new files. Investigate the share settings to determine what umask is being applied. It sounds like you've got permissions which do not allow write access for group or others. Others should probably not have access, but it sounds like you want all domain users to have it. You need the permissions similar to rwxrwx... for newly created files. In order to achieve this, you have to make sure the umask is 007. The part that I cannot answer is how to configure Samba to achieve this. – Xalorous Oct 27 '16 at 16:42
  • Umask has nothing to do with this. Lol. – drookie Oct 27 '16 at 17:03
  • Attach to the post both global setting from samba config, share which has this ussue, and getfacl <path> for the directory which this share is configured in. In general - this is solvable, since it's a general samba functionality. – drookie Oct 27 '16 at 17:04
  • I figured it out. Had to do with the libnss libraries not being in the right place. – Brent Dec 15 '16 at 20:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.