[Samba] read-only problem in 3.0.0

[Greg Louis]

We have a problem with shares that we would like to keep read-only for
some users; it worked with 2.2.8a, but with 3.0.0 there is this odd
behaviour:  Users with read-only privilege can browse the files, can
copy them out of the share (eg to their own hard disks) and open the
copies, and can open the files in situ with Notepad; but if they try to
open files in the share with Excel, for example, or Access or AutoCad,
a dialogue is displayed to the effect that the file can't be found. 
Users with write access don't have this problem.  AFAIK the apps aren't
trying to write into the files.

The share is set up as follows, on a quad Xeon machine running Linux
kernel 2.2.25:
- the shared directory and its subdirs are owned by creator, group users,
  linux permissions 751 (771, 755, 775 have been tried as well out of
  desperation ;)
- The Samba share definition has a valid-users list, which is a superset
  of a read list (the idea being, users on the read list get read-only
  access)
- the share is not marked read-only (it's been tried both ways)
- Linux file permissions are at least 660 (some 664)
- all users belong to group users so in principle the "other"
  permissions shouldn't manage

There is no active directory, no domain controller (association among
machines is workgroup based).

Details:

Samba was configured like this:
./configure --prefix=/usr             \
 --with-privatedir=/etc/samba/private \
 --with-lockdir=/var/lock/samba       \
 --with-swatdir=/usr/share/samba/swat \
 --with-configdir=/etc/samba          \
 --with-codepagedir=/etc/codepages    \
 --with-localstatedir=/var            \
 --with-readline                      \
 --without-pam                        \
 --with-ssl                           \
 --with-sslinc=/usr/include/openssl   \
 --with-syslog                        \
 --with-quotas

One share that gives us the trouble is configured like this:
[global]
...
        log level = 2
        log file = /fs/is/samba/%I.log
        time server = Yes
        deadtime = 30
        keepalive = 0
        read size = 8192
        socket options = IPTOS_LOWDELAY TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
        show add printer wizard = No
        dns proxy = No
        ldap ssl = no
        admin users = ...
        printer admin = ...
        create mask = 0774
        directory mask = 0775
        nt acl support = No
        posix locking = No
        strict locking = No
        wide links = No
        fake directory create times = Yes
...
[ddc]
        path = /fs/ddc
        valid users = <lots>
	read list = <subset of valid users>
        read only = No
        delete readonly = Yes
        dos filemode = Yes

Can anyone help, please?

-- 
| G r e g  L o u i s               | gpg key:  0x400B1AA86D9E3E64 |
| Consultronics Corporate Manager  |   available on my website or |
| Information Systems & Technology |   from any keyserver.        |
| http://www.consultronics.com     | http://www.bgl.nu/~glouis    |