Ygtjki

I have a SAMBA server with ROLE_DOMAIN_MEMBER in Active Directory. My main aim is to make a different permissions on share sub-folders on very single share. It can be done using Linux acl or Windows permissions GUI. But I prefere a Windows GUI. In this case users can do this by themselves.

I'm already tried to change permissions using chmod,chown,acl, windows gui, windows consol gui. And I can change permissions to sub-folder but it seems thatit doesn't work and only groups added to samba-share worked for me and also for sub-folders

valid users = "+DOMAIN.LOCALIT" # "+DOMAIN.LOCALadm" # "+DOMAIN.LOCALDR" # "DOMAIN.LOCALPRINTERS"
admin users = "+DOMAIN.LOCALIT" # "+DOMAIN.LOCALadm" # "+DOMAIN.LOCALDR" # "DOMAIN.LOCALPRINTERS"

I print here all my smb.cfg and a single test share:

[global]
# No .tld
workgroup = DOMAIN
netbios name = samba4
server string = %h server (Samba, Ubuntu)
# Active Directory System
security = ads
# With .tld
realm = DOMAIN.LOCAL
# Just a member server
domain master = no
local master = no
preferred master = no
dns proxy = no
# Disable printing error log messages when CUPS is not installed.
printcap name = /dev/null
load printers = no
printcap cache time = 0
#additional section
obey pam restrictions = yes
map to guest = bad user
dns proxy = no
vfs objects = acl_xattr
map acl inherit = yes
nt acl support = yes
acl map full control = yes
#acl compatibility = auto
store dos attributes = yes
map archive = no
map hidden = no
map read only = no
map system = no
# Works both in samba 3.2 and 3.6.
#idmap backend = tdb
# no .tld
idmap config * : backend = tdb
idmap config * : range = 10000-99999
winbind enum users = yes
winbind enum groups = yes
# This way users log in with username instead of username@example.com
winbind use default domain = yes
# Inherit groups in groups
winbind nested groups = yes
winbind refresh tickets = yes
winbind offline logon = true
#winbind separator = 
# Becomes /home/example/username
template homedir = /home/%D/%U
#logon drive = H:
#logon home = \smb%U
# No shell access
template shell = /bin/bash
client use spnego = yes
client ntlmv2 auth = yes
#password server = dc01.domain.local, dc02.domain.local
password server = *
encrypt passwords = yes
unix password sync = yes
pam password change = yes
smb passwd file = /etc/samba/smbpasswd
os level = 20
restrict anonymous = 2
log file = /var/log/samba/samba.log
log level = 3
#logging = syslog@1 /var/log/samba/log.%m
vfs objects = full_audit
full_audit:success = mkdir rmdir unlink pwrite
full_audit:prefix = %u|%I|%m|%S
full_audit:failure = none
full_audit:facility = local5
full_audit:priority = notice
recycle:repository = /home/recycle/
recycle:keeptree = yes
recycle:versions = yes
max log size = 100000
panic action = /usr/share/samba/panic-action %d
guest ok = yes

[test$]
 path = /FS/test$
 browseable = yes
 read only = no
 inherit acls = yes
 inherit permissions = yes
 create mask = 700
 directory mask = 700
 valid users = "+DOMAIN.LOCALIT" # "+DOMAIN.LOCALadm" # "+DOMAIN.LOCALDR" # "DOMAIN.LOCALPRINTERS"
 admin users = "+DOMAIN.LOCALIT" # "+DOMAIN.LOCALadm" # "+DOMAIN.LOCALDR" # "DOMAIN.LOCALPRINTERS"



┌─[root@samba4]─[/FS]
└──╼ #ls -ld test$/
drwxrwx---+ 6 root root 4096 Jun 25 15:44 test$/

ACL configuration:

cat /boot/config-4.4.0-87-generic | grep _ACL
CONFIG_EXT4_FS_POSIX_ACL=y
CONFIG_REISERFS_FS_POSIX_ACL=y
CONFIG_JFS_POSIX_ACL=y
CONFIG_XFS_POSIX_ACL=y
CONFIG_BTRFS_FS_POSIX_ACL=y
CONFIG_F2FS_FS_POSIX_ACL=y
CONFIG_FS_POSIX_ACL=y
CONFIG_TMPFS_POSIX_ACL=y
CONFIG_HFSPLUS_FS_POSIX_ACL=y
CONFIG_JFFS2_FS_POSIX_ACL=y
CONFIG_NFS_V3_ACL=y
CONFIG_NFSD_V2_ACL=y
CONFIG_NFSD_V3_ACL=y
CONFIG_NFS_ACL_SUPPORT=m
CONFIG_CEPH_FS_POSIX_ACL=y
CONFIG_CIFS_ACL=y
CONFIG_9P_FS_POSIX_ACL=y

My fstab:

UUID=4ec48dfe-c45d-124b-8145-09fe59cfad9b /FS ext4 relatime,acl,user_xattr,errors=remount-ro 0 1

In samba.log I see a problem with acl permission while I try to change permission to test directory

set_nt_acl: failed to set file acl on file test (Operation not permitted).

Also I change permission on test directory to 777 and delete options "create mask", "directory mask", "admin users". Now I can't even add new user to file permission

If you wanting to use Windows permissions you need to remove the UNIX/Linux permission controls that override them.

chmod 777 '/FS/test$'

Remove these lines from your share definition:

create mask = 700
directory mask = 700
admin users = ...