samba - Jun 2014 - vfs_recycle and permissions

Hi,

at our site we are using Samba 4.1.8 as an AD controller and on
another machine as member server and all is working fine so far. Now I
want to provide recycle repositories for some shares on the member
server, so I set

vfs objects = acl_xattr recycle
recycle:keeptree = yes

in the corresponding share sections in smb.conf on the member server.
The problem is that the subdirectories created in the repository seem
to receive arbitrary permissions (UNIX permissions, UNIX ACLs and NT
ACLs) regardless of the recycle:directory_mode and recycle:subdir_mode
settings, whereas the files which are moved to the recycle repository
keep their original permissions.
Ideally, also the directories in the recycle repository would keep the
original permissions.
Is there a way to configure the vfs_recycle module so that also the
directory tree in the recycle repository retains the original
permissions and ACLs?
How do other people deal with permissions in the recycle repository in
combination with NT ACLs?

Best regards
Andreas

Hi,

we are testing this patch to inherit NT ACLs. Maybe you could test it 
also, feedback will be really appreciated :)

Just add to smb.conf:
recycle: inherit_nt_acl = yes

Cheers.

On 13/06/14 09:39, samba.20.andwin at spamgourmet.com
wrote:
> Hi,
>
> at our site we are using Samba 4.1.8 as an AD controller and on
> another machine as member server and all is working fine so far. Now I
> want to provide recycle repositories for some shares on the member
> server, so I set
>
> vfs objects = acl_xattr recycle
> recycle:keeptree = yes
>
> in the corresponding share sections in smb.conf on the member server.
> The problem is that the subdirectories created in the repository seem
> to receive arbitrary permissions (UNIX permissions, UNIX ACLs and NT
> ACLs) regardless of the recycle:directory_mode and recycle:subdir_mode
> settings, whereas the files which are moved to the recycle repository
> keep their original permissions.
> Ideally, also the directories in the recycle repository would keep the
> original permissions.
> Is there a way to configure the vfs_recycle module so that also the
> directory tree in the recycle repository retains the original
> permissions and ACLs?
> How do other people deal with permissions in the recycle repository in
> combination with NT ACLs?
>
> Best regards
> Andreas
>
-- 
Samuel Cabrero - Developer
scabrero at zentyal.com

Zentyal - Active Exchange
www.zentyal.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-vfs-recycle-Inherit-NT-ACLs.patch
Type: text/x-patch
Size: 9687 bytes
Desc: not available
URL:
<http://lists.samba.org/pipermail/samba/attachments/20140613/8402aaef/attachment.bin>

On my member server im using this on my shares ( the Windows only shares ) 

   vfs objects = acl_xattr recycle
   acl_xattr:ignore system acls = yes
   recycle:keeptree = yes
   recycle:versions = yes


When set to yes, a best effort mapping from/to the POSIX ACL layer will not be
done by this module
see:  http://www.samba.org/samba/docs/man/manpages/vfs_acl_xattr.8.html 

Greetz, 

Louis

>-----Oorspronkelijk bericht-----
>Van: samba.20.andwin at spamgourmet.com 
>[mailto:samba-bounces at lists.samba.org] Namens 
>samba.20.andwin at spamgourmet.com
>Verzonden: vrijdag 13 juni 2014 9:40
>Aan: samba at lists.samba.org
>Onderwerp: [Samba] vfs_recycle and permissions
>
>Hi,
>
>at our site we are using Samba 4.1.8 as an AD controller and on
>another machine as member server and all is working fine so far. Now I
>want to provide recycle repositories for some shares on the member
>server, so I set
>
>vfs objects = acl_xattr recycle
>recycle:keeptree = yes
>
>in the corresponding share sections in smb.conf on the member server.
>The problem is that the subdirectories created in the repository seem
>to receive arbitrary permissions (UNIX permissions, UNIX ACLs and NT
>ACLs) regardless of the recycle:directory_mode and recycle:subdir_mode
>settings, whereas the files which are moved to the recycle repository
>keep their original permissions.
>Ideally, also the directories in the recycle repository would keep the
>original permissions.
>Is there a way to configure the vfs_recycle module so that also the
>directory tree in the recycle repository retains the original
>permissions and ACLs?
>How do other people deal with permissions in the recycle repository in
>combination with NT ACLs?
>
>Best regards
>Andreas
>
>-- 
>To unsubscribe from this list go to the following URL and read the
>instructions:  https://lists.samba.org/mailman/options/samba
>
>