samba - Sep 2007 - [Fwd: Re: acl permissions not staying]

Please if anyone has any info...

Neil Wilson wrote:
> Hi guys,
> 
> I've got a problem where if I set permissions on a folder(Admin) 
> "setfacl -R -d -m u::rwx,g::wrx,o::- Admin/" and "setfacl -m
o:- Admin"
> 
> I get the following.
> 
> mail:/data/samba/shared # getfacl Admin/
> # file: Admin
> # owner: BCP+administrator
> # group: samba
> user::rwx
> user:samba:rwx
> group::rwx
> group:BCP+admin:r-x
> mask::rwx
> other::---
> default:user::rwx
> default:group::rwx
> default:group:BCP+admin:r-x
> default:mask::rwx
> default:other::---
> 
> If I then browse to the share through windows and look at the 
> permissions for "everyone(other)", they have "none"
which is what I want.
> I only want the user and group to have rwx on the folder(recursively) 
> and I want everyone to have no access.
> 
> If I then go and change any of the permissions through windows eg: 
> adding/removing a group/user etc. then suddenly "everyone(other) gets 
> the following permissions.
> 
> mail:/data/samba/shared # getfacl Admin/
> # file: Admin
> # owner: BCP+administrator
> # group: samba
> user::rwx
> user:samba:rwx
> group::rwx
> group:BCP+admin:r-x
> mask::rwx
> other::r-x
> default:user::rwx
> default:group::rwx
> default:group:BCP+admin:r-x
> default:mask::rwx
> default:other::r--
> 
> No matter what I do through windows I cant remove access for
"everyone"
> unless I use the setfacl coomand again like above.
> 
> Another thing is that the permissions I'm applying aren't being
applied
> recursively, even though I'm applying them to recursively.
> 
> mail:/data/samba/shared/Admin/Pippa # getfacl Wills/
> # file: Wills
> # owner: BCP+administrator
> # group: samba
> user::rwx
> group::rwx
> other::---
> default:user::rwx
> default:group::rwx
> default:other::---
> 
> Please could someone shed some light here as I'm very baffled.
> 
> Thanks in advance.
> 
> Regards.
> 
> Neil
> 
-- 
This email and all contents are subject to the following disclaimer:
http://www.dcdata.co.za/emaildisclaimer.html

On 9/21/07, Neil Wilson <neilw@dcdata.co.za>
wrote:
> Please if anyone has any info...
That really doesn't help dude (neither does top-posting, btw).

-- 
Frank Van Damme

A: Because it destroys the flow of the conversation
Q: Why is it bad?
A: No, it's bad.
Q: Should I top post in replies to mails or on usenet?

Dale Schroeder wrote:
> Neil,
> 
> Without seeing your smb.conf,
> 
> Unless needed for some unstated reason, change underlying POSIX 
> permissions to 0770.
> If you don't want to do that, in Samba use
>    force directory mode = 0770
>    force create mode = 0770
Thanks to everyone for the replies.

I found that it was inheriting permissions from a parent directory(0775) 
  so I've moved the data off that folder, and created a new one with 0770.

Another thing I found useful after reading the man page for smb.conf 
were the "directory security mask" etc.

Thanks.

Regards.

Neil

-- 
This email and all contents are subject to the following disclaimer:
http://www.dcdata.co.za/emaildisclaimer.html