samba - Feb 2018 - ACL not set from Microsoft

I missed than one. Very useful hint.
Now I can set ACLs again.
Thank you.


Il 15/02/2018 13:23, Miguel Medalha ha scritto:
> Here's what I was looking for.
>
> On Tue Mar 22 08:19:42 UTC 2016 Uri Simchoni posted the following to 
> the samba-technical mailing list:
>
> "Attached patch avoids setting the POSIX ACLs to match the NT ACLs, if
> "ignore system acls" is set. I believe this new behavior is more 
> consistent with the vfs_acl_xattr man page. It also has the following 
> benefits: - Avoid unnecessary sid->xid translations - Better 
> compatibility with Windows, since by default Windows does not enforce 
> existence of "traverse folder" right on parent folders, and
modifying
> POSIX ACLs on parent folders could cause the kernel to deny access 
> (dunno how RichACLs would handle this one :( )."
>
> A discussion about the subject can be found on the archives after this 
> post.
>
> Version 4.4.3 of Samba was the first one to receive this change of 
> behavior, as can be seen by its Release Notes:
>
> o Uri Simchoni <uri at samba.org>
> * BUG 11806: vfs_acl_common: Avoid setting POSIX ACLs if "ignore 
> system acls" is set.

Please note that a new vfs_acl_xattr parameter was also later introduced 
(see "man vfs_acl_xattr"):

acl_xattr:default acl style = [posix|windows]
            This parameter determines the type of ACL that is synthesized in
            case a file or directory lacks an security.NTACL xattr.

            When set to posix, an ACL will be synthesized based on the POSIX
            mode permissions for user, group and others, with an 
additional ACE
            for NT Authority\SYSTEM will full rights.

            When set to windows, an ACL is synthesized the same way Windows
            does it, only including permissions for the owner and NT
            Authority\SYSTEM.

            The default for this option is posix.

Ok. This is useful, although it might not be my case.
We have support for security.NTACL attribute, I suppose due to ext4 with 
user_xattr option.
So, do you confirm that I can do without this option?