samba - Feb 2013 - Append/delete permissions

Hi,

I am new on the list but have been using samba for a while. At the moment I have
the following problem/request:

- have a group of ordinary users (lets call it ALL)
- have a group of admin users (lets call it ADMIN)
- have a share X

I want all my ordinary users (they are in valid users list as @ALL) to be able
to create/add files and folders in this share but NOT be able to delete them
once they are added. Besides, I want that all those created files/folders can be
deleted by the admin users from ADMIN group.

I suppose this is possible but don't know how. I have been playing with
create mode/mask, directory mode/mask, force user/group, inherit owner, inherit
permissions, chattr, etc but didn't make any success. I am using Samba 3.5.6
on Linux Debian machine.

Thanks very much for any useful information

regards, dejan

From: Dejan Gambin <dejan.gambin at coin.hr>
Date: Wed, 6 Feb 2013 22:11:08 +0100
> I am new on the list but have been using samba for a while. At the moment
> I have the following problem/request:
> 
> - have a group of ordinary users (lets call it ALL)
> - have a group of admin users (lets call it ADMIN)
> - have a share X
> 
> I want all my ordinary users (they are in valid users list as @ALL) to be
able to create/add files and folders in this share but NOT be able to delete
them once they are added. Besides, I want that all those created files/folders
can be deleted by the admin users from ADMIN group.
> 
> I suppose this is possible but don't know how.
To set "vfs object = acl_xattr" and to enable xattr on your file
system,
Samba can store NTFS ACLs. But as far as I examined, there are some
problems around access control.

Please try.
> I have been playing with create mode/mask, directory mode/mask, force
> user/group, inherit owner, inherit permissions, chattr, etc but didn't
> make any success. I am using Samba 3.5.6 on Linux Debian machine.
No, you cannot archive with these parameters. These parameters work in UNIX
semantics, which does not have 'can DELETE' flag.

---
TAKAHASHI Motonobu <monyo at monyo.com> / @damemonyo 
                   facebook.com/takahashi.motonobu