[Samba] Inheritance of ACLs with Samba

[Miguel Medalha]

Hello dear list members

I am not an experienced user of Samba, so I can be committing some basic 
mistake, but it seems to me that there is something wrong with the way 
Samba propagates ACLs. I tried versions 3.0.32 and 3.2.4 and the result 
is the same. This happens with "map acl inherit = yes" on smb.conf.

I have a directory (dir) with the following ACLs:

# file: dir
USER   Admin      rwx  rwx
user   Pencil     r-x  r-x
user   Admin      rwx  rwx
GROUP  Admins     rwx  rwx
group  Admins     rwx  rwx
group  Designers  r-x  r-x
mask              rwx  rwx
other             ---  ---

These ACLs appear under the "Advanced" tab of Windows XP ACL Editor as 
(for the sake of clarity I will ommit CREATOR OWNER and CREATOR GROUP, 
which always get "Full Control" on "Subfolders and Files Only":

Type       Name      Permission            Inherited from     Apply to
---------------------------------------------------------------------------------------
Allow      Admin      Full Control        <not inherited>    This 
folder, subfolders and files
Allow      Admins     Full Control        <not inherited>    This 
folder, subfolders and files
Allow      Everyone   None                <not inherited>    This 
folder, subfolders and files
Allow      Pencil     Read & Execute      <not inherited>    This 
folder, subfolders and files
Allow      Designers  Read & Execute      <not inherited>    This 
folder, subfolders and files


I now create "subdir1" inside "dir" and this is what I get:


Type       Name      Permission      Inherited from           Apply to
---------------------------------------------------------------------------------------
Allow      Admin     Full Control    \\testserver\admin\dir   This 
folder, subfolders and files
Allow      Admins    Full Control    \\testserver\admin\dir   This 
folder, subfolders and files
Allow      Admins    Full Control     <not inherited>         This 
folder only
Allow      Everyone  None             <not inherited>         This 
folder, subfolders and files
Allow      Pencil    Read & Execute  \\testserver\admin\dir   This 
folder, subfolders and files
Allow      Designers Read & Execute  \\testserver\admin\dir   This 
folder, subfolders and files


There is now a duplicated entry for the owner group "Admins", *and 
always only for that group*, which applies to "This folder only". A 
"subdir2" inside "subdir1" will receive these same ACLs, and so on. A 
new created file will receive two "Full Control" ACLs for Admin, one 
inherited from \\testserver\admin\dir and one "not inherited", as follows:


Type       Name      Permission      Inherited from           
-----------------------------------------------------------
Allow      Admin     Full Control    \\testserver\admin\dir
Allow      Admins    Full Control    \\testserver\admin\dir
Allow      Admins    Full Control     <not inherited>
Allow      Everyone  None             <not inherited>
Allow      Pencil    Read & Execute  \\testserver\admin\dir
Allow      Designers Read & Execute  \\testserver\admin\dir



If I turn off ""map acl inherit" the duplication disappears and 
inheritance works as intended (from the default ACLs), although Windows 
ACL editor will report the ACLs as "not inherited".

I tried all possible combinations of ACLs with getfacl and the behaviour 
of the Owner Group is always different from the other entries.


The [global] section of my test smb.conf contains the following:

    server string =
    workgroup = test
    os level = 33
    interfaces = 127.0.0.1 eth0
    encrypt passwords = yes
    passdb backend = tdbsam:/etc/samba/passdb.tdb
    bind interfaces only = true
    security = user
    inherit acls = Yes
    map acl inherit = Yes
    acl group control = Yes
    store dos attributes = Yes
    map hidden = No
    map system = No
    map archive = No
    map readonly = No
    dos filemode = Yes


Is anyone else encountering this problem or am I committing some obvious 
error?

I would have a lot more to say about the way inheritance works (or 
doesn't work) from the Windows ACL editor, but that would make this a 
very long message...

I can't wait until Samba gets a proper Windows ACL implementation 
(through the VFS?) and we get done with this POSIX ACL thing (which by 
the way is not even a ratified standard...).

It would be great to hear some comment on this from the members of the 
list or any of the samba developers who can spare a minute.

A big thank you to all of the Samba team!