[Samba] Trouble with file shares on Samba 4

[Stephen Jones]

Hi,

Have you checked the ACLs on the shared directories from the unix side? 
Samba takes the Windows ACLs and converts them to Posix ACLs which are
'similar' in nature but not exactly the same.  You can view the Posix
ACLs using getfacl:
# getfacl /shared/directory

I don't think you mentioned whether it was working at some point and
stopped, or has never worked.  Have you changed the ownership or
permissions of these shared directories from unix? If so this may alter
the effective permissions of the ACL entries.  In directories with ACLs
applied, the permissions of the named users and groups are applied
through the group class permissions, so they don't have the same meaning
as with standard unix DAC.

Regards,

Stephen Jones


On Tue, Nov 27, 2012, at 01:10 PM, Michael B. Trausch wrote:
> On 11/26/2012 11:07 AM, Michael B. Trausch wrote:
> > Any assistance or advice on what to look for would be awesome.
> 
> One additional note that I've been able to put together.
> 
> Windows reports that the permissions that I've set on the server match
> my expectations of what Windows thinks the permissions should be.  That
> is, I added ACLs to allow user X to access the share with "Full
> Control", and Windows see this.  Windows attempts to access the share,
> but then says that access is denied.  Windows won't even show space
> utilization on the share, though Windows *can* see the ACLs and, again,
> they match what we think they should be.
> 
> I am _not_ an expert on Samba 4.  I do know that this functionality
> worked in a beta release, though I don't recall which one.  I'm actually
> in the process of setting up a test network to replicate the problem, as
> I cannot officially submit a bug report based on the network I'm
> discussing at present.  I fully expect to be able to have enough
> information within 24 hours to create a bug report.  I also plan on
> testing with git master to see if anything changed since rc5 that might
> fix the problem, but it essentially seems that while the permissions are
> correct, they're not being correctly interpreted or honored.
> 
> 	--- MIke
> 
> -- 
> Michael B. Trausch
> President, Naunet Corporation
> 
> Web:   https://www.naunetcorp.com
> Telephone: +1-678-287-0693
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> Email had 1 attachment:
> + signature.asc
>   1k (application/pgp-signature)