samba - Aug 2015 - ACLs on Samba share not preserved when copying with Windows Explorer

----- Original Message -----
> From: "Rowland Penny" <rowlandpenny241155 at gmail.com>
> To: samba at lists.samba.org
> Sent: Tuesday, August 11, 2015 2:19:09 PM
> Subject: Re: [Samba] ACLs on Samba share not preserved when copying with
Windows Explorer
> 
> Hi, is the share stored on a standalone server or an AD member server or
> what ?
> 
> Not that this should matter, your problem is most likely caused by you
> using ACLs and trying to enforce Unix permissions. You should use one or
> the other, not both.
> 
> Oh, and you don't have to use the 'acl' mount option with ext4,
it is
> one of the 'defaults'
> 
> Rowland
> 
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
Hi Rowland,

This Samba 3 server is joined to a Samba 4 AD domain using winbind.

Can you elaborate on how I am attempting to enforce UNIX permissions?
As far as I am aware, I am only setting the necessary octal bits in
order to be able to configure the POSIX ACLs.

Thanks,

Andrew

On 11/08/15 22:01, Andrew Martin wrote:
> ----- Original Message -----
>> From: "Rowland Penny" <rowlandpenny241155 at gmail.com>
>> To: samba at lists.samba.org
>> Sent: Tuesday, August 11, 2015 2:19:09 PM
>> Subject: Re: [Samba] ACLs on Samba share not preserved when copying
with Windows Explorer
>>
>> Hi, is the share stored on a standalone server or an AD member server
or
>> what ?
>>
>> Not that this should matter, your problem is most likely caused by you
>> using ACLs and trying to enforce Unix permissions. You should use one
or
>> the other, not both.
>>
>> Oh, and you don't have to use the 'acl' mount option with
ext4, it is
>> one of the 'defaults'
>>
>> Rowland
>>
>> --
>> To unsubscribe from this list go to the following URL and read the
>> instructions:  https://lists.samba.org/mailman/options/samba
>>
> Hi Rowland,
>
> This Samba 3 server is joined to a Samba 4 AD domain using winbind.
>
> Can you elaborate on how I am attempting to enforce UNIX permissions?
> As far as I am aware, I am only setting the necessary octal bits in
> order to be able to configure the POSIX ACLs.
>
> Thanks,
>
> Andrew
>
Hi Andrew, Unix permissions == POSIX ACLs i.e the rwx bits you get from 
ls -la /some/directory_or_file. You need to use either POSIX ACLs or set 
the permissions from windows (or with setfacl), do not try and mix them 
as you are doing.

Rowland

----- Original Message -----
> From: "Rowland Penny" <rowlandpenny241155 at gmail.com>
> To: samba at lists.samba.org
> Sent: Wednesday, August 12, 2015 1:46:53 AM
> Subject: Re: [Samba] ACLs on Samba share not preserved when copying with
Windows Explorer
> 
> >>
> > Hi Rowland,
> >
> > This Samba 3 server is joined to a Samba 4 AD domain using winbind.
> >
> > Can you elaborate on how I am attempting to enforce UNIX permissions?
> > As far as I am aware, I am only setting the necessary octal bits in
> > order to be able to configure the POSIX ACLs.
> >
> > Thanks,
> >
> > Andrew
> >
> 
> Hi Andrew, Unix permissions == POSIX ACLs i.e the rwx bits you get from
> ls -la /some/directory_or_file. You need to use either POSIX ACLs or set
> the permissions from windows (or with setfacl), do not try and mix them
> as you are doing.
> 
Rowland,

My understanding is that there are 3 different permission systems:
 - basic UNIX octal permissions (rwx for owner, group, others)
 - POSIX ACLs (managed by getfacl/setfacl): http://linux.die.net/man/5/acl
 - Windows/ZFS/NFSv4 ACLs (managed by nfs4_getfacl/nfs4_setfacl)

My understanding is that Samba handles mapping between Windows ACLs and 
POSIX ACLs, is this not correct?
http://www.linuxtopia.org/online_books/network_administration_guides/samba_reference_guide/23_AccessControls_25.html

When configuring the ACLs on my share, I have used setfacl exclusively for
configuring permissions (as you suggested), however the situation I described
originally is the result. 

----- Original Message -----
> From: "Ali Bendriss" <ali.bendriss at gmail.com>
> To: "Andrew Martin" <amartin at xes-inc.com>
> Cc: "buhorojo" <buhorojo.lcb at gmail.com>, samba at
lists.samba.org
> Sent: Tuesday, August 11, 2015 5:45:04 PM
> Subject: Re: [Samba] ACLs on Samba share not preserved when copying with
Windows Explorer
> 
> Hi,
> 
> Cant say nothing about the different behaviour between your application
> and windows explorer. But if you want to look further or find a
> workaround, you may check the man page of smb.conf
> as a starting point search for the section about :
> - inherit acls
> - inherit permissions
> 
Ali,

Setting "inherit acls = yes" on the share seems to have corrected the
problem! One question I have is that the smb.conf manpage states "Enabling 
this option sets the unix mode to 0777, thus guaranteeing that default 
directory acls are propagated." 

In my test case, the files created inside of the share after setting
"inherit acls" are still 770 as expected, not 777 as the manpage seems
to indicate. The parent directory is 770, so are the files just inheriting
the parent directory's octal permissions, despite what the manpage says?

Thanks,

Andrew

On 12/08/15 08:46, Rowland Penny wrote:
>
>>
>
> Hi Andrew, Unix permissions == POSIX ACLs
Nope. Try:
  Unix permissions != POSIX ACLs