[Samba] samba performance & ACL behavior

[Herb Burnswell]

All,

I am building a glusterfs environment for file storage and need to use
ACL's.  The CentOS system is joined to AD.  We have ingested data into the
Gluster environment at /toplevel.

OS: CentOS 7.3
Glusterfs: 3.10.5
Samba:  4.4.4

smb.conf:

[global]
        workgroup = GROUP
        security = ADS
        realm = GROUP.DOMAIN.COM

        template homedir = /home/%U
        template shell = /bin/bash

        winbind use default domain = yes
        winbind enum users = yes
        winbind enum groups = yes

        map acl inherit = yes
        store dos attributes = yes
        vfs objects = acl_xattr
        inherit acls = yes
        inherit owner = yes
        inherit permissions = yes

        idmap config * : backend = tdb
        idmap config * : range = 2000-9999
        idmap config GROUP : backend = rid
        idmap config GROUP : range = 1000000-1999999

[toplevel]
        vfs objects = glusterfs

        glusterfs:volume = vol
        glusterfs:logfile = /var/log/samba/glusterfs-vol.log
        glusterfs:loglevel = 7
path = /toplevel
        public = no
        writable = yes
        guest ok = no
        valid users = @"group1",@"group2",@"group3"
        kernel share modes = no

*Question 1:*

*Are there any performance concerns with the above settings in the
smb.conf?*

The ACL's on /toplevel are:

# getfacl toplevel
# file: toplevel
# owner: root
# group: root
user::rwx
group::r-x
group:group1:rwx
group:group2:r--
group:group3:rwx
mask::rwx
other::r-x
default:user::rwx
default:group::r-x
default:group:group1:rwx
default:group:group2:r--
default:group:group3:rwx
default:mask::rwx
default:other::r-x

When I create a directory under /toplevel directly on the Linux server as
root, the ACL's are:

# getfacl testing1
# file: testing1
# owner: root
# group: root
user::rwx
group::r-x
group:group1:rwx
group:group2:r--
group:group3:rwx
mask::rwx
other::r-x
default:user::rwx
default:group::r-x
default:group:group1:rwx
default:group:group2:r--
default:group:group3:rwx
default:mask::rwx
default:other::r-x

However, when I create a directory under /toplevel via Windows as a user
from group1, the ACL's are:

# getfacl testing2
# file: testing2
# owner: root
# group: root
user::rwx
user:root:rwx
user:group1:rwx
user:group2:r--
user:group3:rwx
group::r-x
group:root:r-x
group:group1:rwx
group:group2:r--
group:group3:rwx
mask::rwx
other::r-x
default:user::rwx
default:user:root:rwx
default:user:group1:rwx
default:user:group2:r--
default:user:group3:rwx
default:group::r-x
default:group:root:r-x
default:group:group1:rwx
default:group:group2:r--
default:group:group3:rwx
default:mask::rwx
default:other::r-x

*Question 2:*

*Can someone explain why creating the directory via Windows adds these
permissions:*

*user:group1:rwx*
*user:group2:r--*
*user:group3:rwx*

*default:user:root:rwx*
*default:user:group1:rwx*
*default:user:group2:r--*
*default:user:group3:rwx*

*Is this expected/needed or is there something I should modify to avoid
these additions?*

When I create a file under /toplevel directly on the Linux server as root,
the ACL's are:

# getfacl test.txt
# file: test.txt
# owner: root
# group: root
user::rw-
group::r-x #effective:r--
group:group1:rwx #effective:rw-
group:group2:r--
group:group3:rwx #effective:rw-
mask::rw-
other::r--

With:

-rw-rw-r--+ 1 root root 0 Oct  3 16:07 test.txt

When I create a file under /toplevel via Windows as a user from group1, the
ACL's are:

# getfacl test1.txt
# file: test1.txt
# owner: root
# group: root
user::rwx
user:root:rwx
user:group1:rwx
user:group2:r--
user:group3:rwx
group::r-x
group:root:r-x
group:group1:rwx
group:group2:r--
group:group3:rwx
mask::rwx
other::r-x

With:

-rwxrwxr-x+ 1 root root 0 Oct  3 16:09 test1.txt

*Question 3:*

*The file creation under /toplevel on the LInux server as root creates
'effective' permissions, can anyone explain why?*

*Question 4:*

*The file creation under /toplevel via Windows as a user from group1 adds **the
'user:group*:***' permissions (same question above), but also creates the
'x' bit automatically for other.  We need this for access to newly created
directories but don't necessarily love the idea of having execute
permissions for other by default on newly created files.  Is there any way
to address this?*

I apologize for the multiple questions and if some are not ideal for this
forum.  Any potential guidance is greatly appreciated, thanks in advance..

HB