[Samba] changing file permissions

[Adam Nielsen]

> > 'security mask' will restrict the options that can be changed, but
> > I'd probably use the 'force security mode' option instead, which
> > will allow the student to change permissions, but will always force
> > certain permissions on regardless of what the student sets.

>    Is there a reason for that?  Thanks for the information.  I 
> appreciate it.

It's probably just me, but I see 'security mask' as a slightly weaker
option, because it doesn't force a certain set of permissions on a
file - it just stops the existing permissions from being changed from a
Windows box.

If the permissions ever *do* change for some reason (e.g. a file is
created in an odd way, or even due to a bug) you probably won't be able
to change the permissions back again since 'security mask' will block
you from adjusting the affected permissions.

Contrast this with the 'force security mode' option which allows
permissions to be changed freely, but forces certain permissions to be
always on - e.g. you could force the group-read bit on, so that no
matter what permissions the user sets, the files always end up
group-readable.  Even if the permissions are initially incorrect when
the file is created, as soon as an attempt is made to change them all
the 'forced-on' permissions will be applied.

Having said that, it's probably much of a muchness, as both these
options can be easily bypassed if anyone can access the server without
going through Samba.

Hope this explains my reasoning a bit better ;-)

Cheers,
Adam.