I'm using ACLs to enable rw access to both local and samba users, and noticed that group permissions is always set to rwx.
This is the ACL set on the test directory:
ubuntu@server:/test$ getfacl .
# file: .
# owner: samba
# group: samba
user::rwx
user:samba:rwx
user:ubuntu:rwx
group::rwx
mask::rwx
other::r-x
default:user::rwx
default:user:samba:rwx
default:user:ubuntu:rwx
default:group::rwx
default:mask::rwx
default:other::r-x
Files created via Samba will result in -rw-rwxr--+:
ubuntu@server:/test$ ls -l
total 0
-rw-rwxr--+ 1 samba samba 0 Feb 19 03:40 file1
To isolate the issue, I've set create mask = 0000 on smb.conf:
/etc/samba/smb.conf:
[Share]
path = /test
browseable = yes
guest ok = yes
read only = no
map archive = no
create mask = 0000
ubuntu@server:/test$ sudo systemctl restart smbd.service
*Create file2 via Samba*
ubuntu@server:/test$ ls -l
total 0
-rw-rwxr--+ 1 samba samba 0 Feb 19 03:40 file1
----rwx---+ 1 samba samba 0 Feb 19 03:41 file2
We can find out that it's not ACL misbehaving by creating a file under the samba user:
ubuntu@server:/test$ sudo -u samba touch file3
ubuntu@server:/test$ ls -l
total 0
-rw-rwxr--+ 1 samba samba 0 Feb 19 03:40 file1
----rwx---+ 1 samba samba 0 Feb 19 03:41 file2
-rw-rw-r--+ 1 samba samba 0 Feb 19 03:42 file3
So we can see here, it's samba that's setting g+rwx.
The problem goes away after disabling ACL:
ubuntu@server:/test$ sudo setfacl -b /test
ubuntu@server:/test$ sudo getfacl .
# file: .
# owner: samba
# group: samba
user::rwx
group::rwx
other::r-x
*Create file4 via Samba*
ubuntu@server:/test$ ls -l
total 0
-rw-rwxr--+ 1 samba samba 0 Feb 19 03:40 file1
----rwx---+ 1 samba samba 0 Feb 19 03:41 file2
-rw-rw-r--+ 1 samba samba 0 Feb 19 03:42 file3
---------- 1 samba samba 0 Feb 19 03:43 file4
So is it correct to conclude that with ACL activated, samba will set g+rwx? Is it a bug, or did I miss something out?
I've scoured through the samba docs and tried all the options relevant to permissions: create mask, force create mode, inherit permissions, map archive,hidden,readonly,system, and am at a loss what else could be causing this.
