[Samba] File permissions getting destroyed with M$ software on ZFS

RegioGis regio-gis at ec.europa.eu
Tue Oct 5 06:07:08 MDT 2010


Thanks for your input. 
B.t.w., I use security = ADS
I tried hundreds of combinations of configurations and options, but it just
won't work.
It works rather ok if you limit it to the Unix permissions ( plain user and
group permissions ) , but as soon as you try to put an ace referring to an
AD group, it totally looses track.

example 1:

root# ls -l /pool2/gisdata
drwxrwx---+  4 ackerra  gis            4 Oct  5 10:58 d1
drwxrwx---   3 ackerra  gis            3 Oct  5 12:01 d2
drwxrwxr-x   2 regio-gis10 gis            2 Oct  5 11:55 d3

root # ls -lvd /pool2/gisdata/d1
drwxrwx---+  4 ackerra  gis            4 Oct  5 10:58 d1

I mount the share (/pool2/gisdata) on a XP workstation, being AD user
'regio-gis10', memeber of AD group 'regio-users' , having no unix account.
In Windows explorer, I can see d2 and d3, but not d1

example 2:

root # ls -lvd /pool2/gisdata/d2
drwxrwx---   3 ackerra  gis            3 Oct  5 12:01 d2

One would think that an arbitrary AD user ( regio-gis10 in this case ) does
not have access on the directory d2, no ?
Well, it is not the case ... via samba I could create a directory dx in d2,
being the AD user 'regio-gis10'.

root # ls -l /pool2/gisdata/d2
total 3
drwxrwx---   2 regio-gis10 gis            2 Oct  5 12:01 dx

So sometimes I get extra permissions, sometimes I get too few permissions,
but it is never right ...

wbinfo, net ads and getent commands all work perfectly, and give the
accurate info though.

smb.conf :
        path = /pool2/gisdata
        #admin users = ackerra
        force group = gis
        read only = no
        create mask = 0660
        directory mask = 0770
        force unknown acl user = yes
        acl check permissions = no
        inherit permissions = yes
        inherit acls = yes
        #map acl inherit = yes
        store dos attributes = yes
        easupport = yes
        map read only = no
        map archive = no
        map hidden = no
        map system = no
        vfs objects = zfsacl
        nfs4:acedup = merge
        nfs4:mode = special
        zfsacl: aceorder = dontcare

samba version is solaris bundled version 3.0.35


View this message in context: http://samba.2283325.n4.nabble.com/File-permissions-getting-destroyed-with-M-software-on-ZFS-tp2915766p2955872.html
Sent from the Samba - General mailing list archive at Nabble.com.

More information about the samba mailing list