[Samba] Problems with ACLs in 2.2.8

[Jan Houstek]

> > Since the upgrade I have problems with rights. In a directory with empty
> > ACL for the creator group and the same default ACL files created by samba
> > have rwx set while files created in shell have (expected) empty ACL for
> > the group).
> >
> > I can describe it in detail if anyone is interested.
>
> Yes I'm interested. Can you give me a lot more detail on how
> you reproduce this (users, groups, used - user you log into
> on the Samba server, what application you create the files
> with etc.).

OK. Here are the details:

server:
	linux 2.4.19 with xfs 1.2 and its ACL
	libacl 2.0.19
	samba 2.2.8 compiled from source with --with-acl-support
	acting as PDC
	interesting parts of smb.conf
		create mask = 0600
		directory mask = 0700
		[testshare]
			path = /data/testshare
			readonly = No
client:
	1) Windows XP, servicepack 1.2a
	2) smbmount from another linux box

server:~# getfacl /data/testshare/testdir
# file: testdir
# owner: testuser
# group: users
user::rwx
group::---
group:somegroup:r-x
group:anothergroup:rwx
mask::rwx
other::---
default:user::rwx
default:group::---
default:group:somegroup:r-x
default:group:anothergroup:rwx
default:mask::rwx
default:other::---

server:~# umask 007
server:~# mkdir /data/testshare/testdir/test1
server:~# getfacl /data/testshare/testdir/test1
# file: test1
# owner: root
# group: root
user::rwx
group::---
group:somegroup:r-x
group:anothergroup:rwx
mask::rwx
other::---
default:user::rwx
default:group::---
default:group:somegroup:r-x
default:group:anothergroup:rwx
default:mask::rwx
default:other::---

On windows:
	logon to domain as testuser
	create test2 in testdir (right mouse button -> New -> Folder)

server:~# getfacl /data/testshare/testdir/test2
# file: test2
# owner: testuser
# group: users
user::rwx
group::rwx			# !!! problem !!!
group:somegroup:r-x
group:anothergroup:rwx
mask::rwx
other::---
default:user::rwx
default:group::---
default:group:somegroup:r-x
default:group:anothergroup:rwx
default:mask::rwx
default:other::---

Please write back if it is reproducable.

-- Honza Houstek