[Samba] Allow single sub-folder access on an otherwise prohibited share - why does the solution work?

[Andrew Walker]

>
> Why is the second method working (and working as expected)? The only info
> I found on the web is that DENY takes precedence over ALLOW, which does not
> explain my finding, right?
>

In Windows, explicit permissions take precedence over inherited
permissions, even inherited deny permissions.
https://technet.microsoft.com/en-us/library/cc783530(v=ws.10).aspx

Samba apparently does the same.