[Samba] Samba 4 AD share: Access denied

[Andrew Bartlett]

On Fri, 2014-08-15 at 16:28 -0400, Ryan Ashley wrote:
> That was it! It did not work but I was already building 4.1.11 from a 
> clean clone. No clue why it did not work with 4.1.9, but it works FINE 
> now. What gets me is that it worked that way from day one for about two 
> weeks, then it died. I never thought to check above that level due to 
> the directory itself not being shared or even accessible remotely. Home 
> was 750 and when I reverted it to 755 and the shared directory to 775, 
> the shares began working.
> 
> Now, this did NOT fix it on the print-server. I am still getting access 
> denied. I followed the guide and created /srv/samba/printer_drivers and 
> the entire sub-directory structure. The "printer_drivers" directory is 
> 2755 as per the wiki article. The directories above it are 755 and are 
> owned by root and the root group. So I have 755 for /srv, 755 for 
> /srv/samba, and 2755 for /srv/samba/printer_drivers and everything below 
> it, but I am getting access denied. I have one driver there in x64/3, 
> and all files in there are 664. Do these non-executable files need to be 
> 775 despite being DLLs and such?

They might need to be if the windows client wants to see an execute
permission on the file in the NT ACL, then we need to set the unix
execute bit.  This can be overridden (matching behaviour before Samba
4.0) with 'acl allow execute always = yes'.

I suggest trying it and seeing.

Andrew Bartlett

-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba