I'm trying to set up a very simple samba configuration, in which a single user (the owner of the share) has full access to the share, and other users have only read access. The following is the smb.conf:

security = user
workgroup = WORKGROUP
server string = Samba Server %v
encrypt passwords = yes
log file = /var/log/samba/log.%m
max log size = 50

create mask = 644
force create mode = 644
directory mask = 755
force directory mode = 755

comment = Test
path = /admin/test
writeable = yes
browseable = yes

I can create and modify files from windows without problems most of the time, but some applications add extended ACL when saving files (like MS Word for example), and afterwards I can't modify or overwrite those files, but oddly enough I can delete them.

root@vsapdes:/admin/test=>ls -l
total 16
-rw-r--r--  1 usrcap usr     4 Jun 27 12:59 notepad_file_no_acl.txt
-rw-r--r--+ 1 usrcap usr 11256 Jun 27  2019 word_file_with_acl.docx
root@vsapdes:/admin/test=>aclget word_file_with_acl.docx
* ACL_type   AIXC
base permissions
    owner(usrcap):  rw-
    group(usr):  r--
    others:  r--
extended permissions
    specify  r--     g:usr
    specify  rw-     u:usrcap

The samba server is version 4.9.3 and is running on AIX 7.1 in case that has anything to do with the problem (I can modify the file from the terminal with the same user I login into samba with, so I don't think thats the case).


I can think of two things you can do.

You can declare the owner user as the share admin as described in the smb.conf documentation. The admin user is not bound by any ACL restrictions and can do as he likes.

Another possibility would be to just disable ACLs. I have not tried this myself but you could experiment with disabling the options map acl inherit, store dos attributes and ea support. If you don't care for the ACLs at all you could certainly try this.

  • 1
    Already tried those and several other options but couldn't prevent samba from writing extended ACLs. The admin users option does work, and even if it's a dirty workaround it's ok for my scenario. – rabusmar Jul 5 '19 at 19:27

Of course, when you use network share like that, you need ACLs, it's the most important feature for the client to use it with Windows. (In businesses context of course.)

If it's not a bug of your version of Samba, you can change the ACLs of your shared folder directly from Windows to disable write extented attributes in your folder (because it's not really mandatory for Office).

You just need to change permissions of your user (or your group) to disable "Extented Attribute Write" (Uncheck the option) directly in the root of your shared folder.

For example (in French, sorry) (You need to go in Security Tab of your folder, and click Advanced. After that, just choose your group/user and click modify) :

enter image description here

In our infrastructure, we don't prepare or change ACLs from terminal, we change any permissions directly from Windows (It's more simple by far).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.