samba - Sep 2014 - create and directory mask ignored for profiles?

On our old 3.6.x PDC profiles are created the way we want (mode 700/600).
I am upgrading the hardware and putting OpenSUSE 13.1 with samba-4.1.11
on it.  In testing I have found that no matter what I do, profile
directories are created mode 770 and files mode 670.

The profile share config:
  path = /local/samba/profiles  # this dir is mode 1777, old and new
  profile acls = yes
  browseable = no
  guest ok = no
  read only = no
  csc policy = disable
  create mask = 0600
  directory mask = 0700
  store dos attributes = yes

It is specific to the profile share.  In our home directory share the
masks work as expected.  I've tried toggling profile acls, store dos
attributes and inherit permissions.  I've tried a different directory to
store the profiles.  The only difference between the old config that works
on 3.6.x and the new config is that I have added the masks in an attempt
to fix the problem: we did not need to specify them before.

After hours of searching this is the closest thing I can find to someone
else having this problem:
https://lists.samba.org/archive/samba/2004-July/090029.html

I feel like am I missing something blindingly obvious.
-- 
Jon Martin 
System Administrator - Computing Science
Information Services & Technology at University of Alberta
780-492-1662  http://ualberta.ca/IST/

On 19/09/14 05:44, Jon Martin wrote:
> On our old 3.6.x PDC profiles are created the way we want (mode 700/600).
> I am upgrading the hardware and putting OpenSUSE 13.1 with samba-4.1.11
> on it.  In testing I have found that no matter what I do, profile
> directories are created mode 770 and files mode 670.
>
> The profile share config:
>    path = /local/samba/profiles  # this dir is mode 1777, old and new
>    profile acls = yes
>    browseable = no
>    guest ok = no
>    read only = no
>    csc policy = disable
>    create mask = 0600
>    directory mask = 0700
>    store dos attributes = yes
>
Hi
On 4.1, just use:
chmod 1777 /local/smb/profiles
and
[profiles]
path = /local/samba/profiles
read only = No

That works with AD domains anyway.
HTH,
Steve