[Samba] Behavior of acl_xattr:ignore system acls = yes on a share

[Peter Milesson]

On 30.01.2024 16:51, Ralph Boehme via samba wrote:
> On 1/30/24 16:27, Rowland Penny via samba wrote:
>> On Tue, 30 Jan 2024 16:13:41 +0100
>> Peter Milesson via samba <samba at lists.samba.org> wrote:
>>
>>> Hi folks,
>>>
>>> It seems that the setting acl_xattr:ignore system acls = yes reduces
>>> Windows compatibility when defined for a share. In all attempts I
>>> have used Windows tools (except editing smb.conf)
>>
>> Lets walk through the relevant part of that parameter:
>> 'ignore system acls'
>>
>> It does what it says, with it set, Samba totally ignores the Unix acls
>> you can see with 'ls' and getfacl. You must set the permissions from
>> Windows and either read them from Windows or with tools such as
>> 'samba-tool ntacl get'.
>
> ...and you must start with a clean state, iow a share basedirectory 
> that doesn't have any POSIX ACEs, just root:Domain Users 0777 or 
> similar. "ignore systems acls" only implies Samba will not attempt 
> itself to map the NT ACL to a POSIX ACL and apply in on disk. It 
> doesn't apply that existing POSIX ACLs will be enforced by the kernel 
> and inheritted by the kernel if applicable.
>
> Cheers!
> -slow
>
>
Hi folks,

I setup a new share and tried to configure it.

*Setup shared folder*

  * Create the folder /data/migrtest
  * Set ownership to root:"Domain Admins"
  * chmod 0770 migrtest


*smb.conf*

[Migrtest]

    path = /data/migrtest
    read only = no
    acl_xattr:ignore system acls = yes

Then smbcontrol smbd reload-config and smbcontrol winbind reload-config

*Windows Computer Management*

  * Starting Computer Management as Administrator
  * Connecting to the server
  * Selecting Shares and Properties of the share Migrtest


*Tab Security*
Owner: Administrator at private.talps

-Permissions list-
root (Unix User\root)    Full Control    This folder only
Domain Admins (Private\Domain Admins)    Read, write & Execute    This 
folder only
SYSTEM    Full control    This folder only

If I click on OK, no complaints. But the share is not accessible by any 
users, except for a Domain Admin user. Further, it is not possible to 
change share permissions, e.g. add any users or groups. No error 
message, but the changes will not persist

Trying to change the permissions above to something more normal:

  * disable inheritance
  * remove root
  * change access for Domain Adminst to Full control and This folder,
    subfolders and files
  * change SYSTEM to Full Control and This, folder, subfolders and files
  * add testgroup Read & Execute and This folder, subfolders and files

When clicking OK, the error message below pops up:

    An error occurred while applying security information to:

    \\linuxdev\Migrtest

    "Failed to enumerate objects in the container. Access is denied"


Setting up the share initially without acl_xattr:ignore system acls = 
yes, and turning on acl_xattr:ignore system acls = yes  after defining 
access permissions under the security tab seems to work.

Best regards,

Peter