[Samba] Fix sharing ACL

[Rowland Penny]

On Mon, 24 Oct 2016 15:42:43 +0000 (UTC)
Ricardo Pardim Claus via samba <samba at lists.samba.org> wrote:

> Dear Rowland, 
> Follow my smb.conf
> 
> The smb.conf the fileserver:
> 
> 

Can I suggest you try this smb.conf:

# Global parameters 
[global]
workgroup = DOMAIN 
security = ADS 
realm = domain.local 

netbios name = SRV16 
server string = Samba4 Server 

winbind enum users = yes 
winbind enum groups = yes 
winbind use default domain = Yes 
winbind nss info = RFC2307 

idmap config * : backend = tdb 
idmap config * : range = 2000-9999 
idmap config DOMAIN: backend = rid 
idmap config DOMAIN: range = 10000-99999 

log file = /var/log/samba/samba.log 
log level = 9 

vfs objects = acl_xattr
map acl inherit = Yes 
store dos attributes = Yes 
guest account = guest 

[data] 
comment = Folder data
path = /mnt/data 
read only = no 
browseable = yes 
guest ok=yes 

vfs objects = acl_xattr, recycle, shadow_copy2, full_audit 
#inherit acls = Yes # NOTE: using acl_xattr turns this on
inherit permissions = Yes # NOTE: this overides the next two lines
create mask = 0774 
directory mask = 0774 

# Recycle
recycle:facility = LOCAL1 
recycle:priority = NOTICE 
recycle:maxsize = 0 
recycle:directory_mode = 0774 
recycle:subdir_mode = 0774 
recycle:keeptree = true 
recycle:touch = true 
recycle:versions = true 
recycle:exclude = *.tmp, *.log, *.obj, ~*.*, *.bak, *.exe, *.bin 
recycle:exclude_dir = tmp, temp, cache 
# SHADOW COPY / SNAPSHOT 
shadow:mountpoint = /mnt/data/ 
shadow:snapdir = .snapshot 
shadow:basedir = /mnt/ 
shadow:sort = desc 
shadow:localtime = yes 
shadow:format = @GMT-%Y.%m.%d-%H.%M.%S 
# AUDIT FILESERVER 
full_audit:prefix = %u|%I|%S|%g 
full_audit:success = all 
full_audit:failure = all !open 
full_audit:facility = local1 
full_audit:priority = ALERT 

Can I also suggest you read these two Samba wiki pages:

https://wiki.samba.org/index.php/Shares_with_Windows_ACLs
https://wiki.samba.org/index.php/Shares_with_POSIX_ACLs

Decide which of the two ways you want to use and then set the share up
that way.

Rowland