samba - Jul 2023 - Migration of files with Windows ACL's to Samba server

Hi Nick,
Sorry for the late reply, been busy 
with some other issues, and this was not such a priority

Basically I have 

        vfs objects = acl_xattr
        inherit acls = yes
        inherit permissions = yes
        map acl inherit = yes


in my samba global config and shares are normal shares:

[testg] 
        comment = privuser testing share for ACL testing purposes
        path = /storage/testg
        browseable = yes
        read only = no
        inherit acls = yes
        inherit permissions = yes
        map archive = no

But when I want as this user - privuser to change any
permissions/acls/anything on any file in that share it gives me: Unable
to save permission changes to file, The request is not supported.

So looks like I am missing something?

Regards
Borut

On Thu, 2023-07-20 at 07:50 -0400, Nick Couchman wrote:
> On Thu, Jul 20, 2023 at 7:08?AM Borut Rozman via samba
> <samba at lists.samba.org> wrote:
> > 
> > Hi there,
> > 
> > It might that this question was already answered but I can't
really
> > find any proper documentation for this.
> > 
> > I am in a process of migrating about 70T of files from our Win2016
> > storage server to a Samba (2:4.17.9+dfsg-0+deb12u3) server. Whilst
> > doing this I want to preserve all the ACL's which were set on
> > Windows
> > shares.
> > 
> > Is there any related documentation around this topic how to
> > approach
> > this so the permissions are preserved.
> > 
> > We used this command to copy the data from one to another share:
> > 
> > robocopy <Source> <Destination> /MIR /DCOPY:T /MT:3 /XJ
/R:1 /W:3
> > /NDL
> > /NP /LOG+:logfile.txt
> > 
> 
> Assuming that you have Samba set up to properly store the Windows
> ACLs
> with your choice of VFS module, your robocopy command just needs a
> few
> extra flags. I usually do something like:
> 
> robocopy /mir /copy:datso /dcopy:dat /r:0 /ndl /mt <src> <dest>
> 
> The /copy:datso flag copies (d)ata, (a)ttributes, (t)imestamps,
> (s)ecurity, and (o)wnership, which should capture everything you
> need.
> On /dcopy, this copies data, attributes, and timestamps associated
> with the directory. This should cover everything. If you still have
> issues with permissions not being properly copied, you can use /sec
> and /secfix to try to force robocopy to do the job. In my dayjob, my
> team has used this method to migrate several hundred terrabytes of
> data from Windows file servers to a couple of different Linux/Samba
> platforms with very good success.
> 
> -Nick

On 28/07/2023 13:50, Borut Rozman via samba wrote:
> Hi Nick,
> Sorry for the late reply, been busy
> with some other issues, and this was not such a priority
> 
> Basically I have
> 
>          vfs objects = acl_xattr
>          inherit acls = yes
>          inherit permissions = yes
>          map acl inherit = yes
> 
> 
> in my samba global config and shares are normal shares:
> 
> [testg]
>          comment = privuser testing share for ACL testing purposes
>          path = /storage/testg
>          browseable = yes
>          read only = no
>          inherit acls = yes
>          inherit permissions = yes
>          map archive = no
> 
> But when I want as this user - privuser to change any
> permissions/acls/anything on any file in that share it gives me: Unable
> to save permission changes to file, The request is not supported.
> 
> So looks like I am missing something?
> 
> Regards
> Borut
> 
Hi, Whilst you have given us some info, you do not seem to have given us 
much. Just about all you have told is that you are running Samba 4.17.9 
On Debian 12 and that you are running it as a server, but what sort of 
server ?

Would it be possible for you to post the output of 'testparm -s' ? 
Sanitised if you must.
Also the output of 'ls -lad /storage/testg'

It will probably also help if you can tell us what the filesystem is.

Rowland