[Samba] Samba 4 AD with Bind 9.9 dlz permission access to /var/lib/samba/private/

[steve]

On Wed, 2013-12-25 at 03:43 +0800, Chan Min Wai wrote:
> Dear all,
> 
> Would like to ask for input on the following.
> When using with bind 9.9 with dlz module.
> It seem that we would have a permission issue where names would need to
> have access to
> 
> /var/lib/samba/private/ for a few files.
> to be more precise it would be
> 
> /var/lib/samba/private/dns (whole folder)
> /var/lib/samba/private/named.conf
> /var/lib/samba/private/named.conf.update
> /var/lib/samba/private/dns.keytab
> 
> However as I can see private was 400...
> drwx------+  7 root root    4096 Dec 25 03:34 private

That seems very restrictive. We have a default source build
at /usr/local/samba with:
drwxr-xr-x  7 root root 4096 Dec 13 13:31 private

That let's everyone in, then named has further access as you state.
HTH
Steve