samba - Jul 2022 - SMB Windows ACL functionality

On 7/12/22 16:43, Rowland Penny via samba wrote:
> it also looks like you should set 'acl_xattr:ignore system acls =
yes'
> on the shares if setting permissions from Windows, but only if you also
> set a user.map and never change the permissions as Administrator.
please be extra careful there,  as this very much sounds more like bugs 
then expected behaviour...

Thanks!
-slow

-- 
Ralph Boehme, Samba Team                 https://samba.org/
SerNet Samba Team Lead      https://sernet.de/en/team-samba
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.samba.org/pipermail/samba/attachments/20220712/41dcddad/OpenPGP_signature.sig>

On Tue, 2022-07-12 at 17:08 +0200, Ralph Boehme wrote:
> On 7/12/22 16:43, Rowland Penny via samba wrote:
> > it also looks like you should set 'acl_xattr:ignore system acls
> > yes'
> > on the shares if setting permissions from Windows, but only if you
> > also
> > set a user.map and never change the permissions as Administrator.
> 
> please be extra careful there,  as this very much sounds more like
> bugs 
> then expected behaviour...
> 
> Thanks!
> -slow
It could well be bugs, but this is what is happening. You get different
output from samba-tool if you set 'acl_xattr:ignore system acls = yes'
on one share but not another and map Administrator to root with a
user.map and change the permissions as DOMAIN\Administrator on WIN10.
Doing the changes as an admin user gives the same output.

The opposite happens if you do not map Administrator to root,
Administrator cannot change anything, but an admin user can, but you
get different output from samba-tool.

As you know, someone wants to stop mapping Administrator to root, can
you now see why I am against this.

Rowland