samba - Nov 2003 - How to set up a share in smb.conf for ACL's

I have a great understanding problem about acls and share-definitions. I
use Samba 3.0.1pre3, compiled with acl-support, everything works fine,
ACL's can be set with Windows XP File-Manager and the getfacl shows that
it is OK. My Problem ist that I dont know how to define a share for
acls.

For example, here is my share

[user1]
Path=/lanman/user1
Valid users=user1,@root
Force user=user1
Read only=No


User1 can work with the share. Now, I want user2 to work with it and I
want to define it with ACL-Settings, so getfacl on /lanman/user1 shows
the following (even all Subdirectories and Files within the share):

Getfacl /lanman/user1:
# file: user1
# owner: user1
# group: users
user::rwx
user:user2:rwx
group::---
mask::rwx
other::---
default:user::rwx
default:user:user2:rwx
default:group::---
default:mask::rwx
default:other::---

But when user2 tries to connect to that share, no success !

Can somebody tell me what ist wrong ?

I know that with valid users =user1,user2 I can solve this problem. But
I need ACL's inside share definitions to grant access to some files not
to all valid users !

I hope you understand what I want to say with my bad english ;-) !!!

Dirk Hennrichs wrote:
> 
> For example, here is my share
> 
> [user1]
> Path=/lanman/user1
> Valid users=user1,@root
> Force user=user1
> Read only=No
> 
> 
> User1 can work with the share. Now, I want user2 to work with it and I
> want to define it with ACL-Settings, so getfacl on /lanman/user1 shows
> the following (even all Subdirectories and Files within the share):
> 
> Getfacl /lanman/user1:
> # file: user1
> # owner: user1
> # group: users
> user::rwx
> user:user2:rwx
> group::---
> mask::rwx
> other::---
> default:user::rwx
> default:user:user2:rwx
> default:group::---
> default:mask::rwx
> default:other::---
> 
> But when user2 tries to connect to that share, no success !
> 
> Can somebody tell me what ist wrong ?
> 
> I know that with valid users =user1,user2 I can solve this problem. But
> I need ACL's inside share definitions to grant access to some files not
> to all valid users !
valid users options have higher priority than those an filesystem level 
ACL's. So even user2 have rights to access user1 dir, Samba won't let
him.

Solutions for you is: add all chosen users to "valid users" and tune 
fiesystem ACL's as necessary.

Dan