Dear all,
I got the following situation, a share called "Bureaus", with the
follwong
subdirs:
/Bureaus/A
/Bureaus/B
/Bureaus/C
etc.
where A,B,C.. are the bureau names
under all the bureau names are directories:
A/Task1
A/Task2
A/Task3
A/Archive
For all the bureau names.
I've got groups, a groups, everyone is a member of "Domain Users",
and that's
also always the primary group.
And, a group A, a group B etc, and groups "Task1 A", Task1
B"..."Task2 A" etc.
The simple idea is to give everyone access to Bureaus, only those who are member
of group A can go into /Bureaus/A, and only those who are a member of group
"Task1 A" can go to /Bureaus/A/Task1 and do there whatevery they want.
So fa so good, I've made acl's which allow "Domain Users" to
r-x /Bureau,
without passing this to the subdirectories, an acl which allows r-x to group A
(also without allowing this to subfolders) for /Bureau/A, and for
/Bureau/A/Task1 including subdirectories the acl is "allow group Task1
everything".
That works fine.
But now for the Archive directory, the /Bureau/A/Archive should be read-only for
members of the group A, and read-write for members of the group "Archive
Mods
A".
And that's the problem, if I add an acl (with the windows rights management
stuff) for the group A to have read-only right for /Bureau/A/Archive and
subdirectories, and for the same directories an acl with "allow
everything" for
members of the group "Archive Mods A", then the effitive rights for
members of
"Archive Mods A" is read-only, since the most restrictive rights
apply.
What I expected at first was that the rights would be additive and only a deny
would have the effect which I'm seeing now.
How can I make it work?
The options I have:
global: map acl inherit = Yes
The share /Bureaus:
path = /samba/Bureau
public = no
browseable = yes
writable = yes
printable = no
force create mode = 0770
directory mask = 0770
security mask = 0777
force security mode = 0
directory security mask = 0777
force directory security mode = 0
hide unreadable = yes
Kind regards,
Jeroen Vriesman.
