[Samba] smbcacls syntax eludes me (perhaps)

[James G. Sack]

(Is this the right place to post such question?)

I can't seem to grasp the right syntax for smbcacls

  This is a 306rc2, security=user system w/ passwords set via
  smbpasswd,   and smbclient gives expected r/w behavior.I've seen the
  same on a 302a security=domain or ads system (I believe), which is why
  I think I'm misinterpreting something (or is smbcacls broken??)
  -- or what else am I doing wrong?

I have acls working in the kernel and filesystem, and can get apparently
normal smbcacls output, eg

  smbcacls //x126/b1 hi -Ujgs%jgs
gives
 REVISION:1
 OWNER:"X126"\jgs
 GROUP:"X126"\jgs
 ACL:"X126"\jgs:ALLOWED/0/RW
 ACL:"X126"\jgs:ALLOWED/0/R
 ACL:"X126"\tstuser:ALLOWED/0/W
 ACL:\Everyone:ALLOWED/0/R

I try to give tstuser read-perms
  smbcacls //x126/b1 hi -Ujgs%jgs -M 'ACL:"X126"\tstuser:1/0/R'
and I get
  Failed to parse ACL ACL:X126\tstuser

Any syntax variation I try (incl, ie: ALLOWED in place of the 1)
produces the same error. 
-d3 adds
  lsa_io_sec_qos: length c does not match size 8

Do I have the right syntax?
Is something else wrong?

 The share has readonly=no, write list=jgs
 and jgs can access b1 rw (eg via smbclient)

I also added an admin user, (with write) and tried smbcacls as the admin
user, with no change.

Thanks,
..jim