On Tue, 28 Nov 2023 16:00:22 +0100
Marco Gaiarin via samba <samba at lists.samba.org> wrote:
>
> In a fresh samba AD domain i'm setting up the 'Profiles' share
for
> roaming profiles, following the wiki:
>
> https://wiki.samba.org/index.php/Roaming_Windows_User_Profiles
> https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs
>
> leading to:
>
> [profiles]
> comment = Network Profiles Share
> csc policy = disable
> map acl inherit = Yes
> path = /srv/samba/profiles
> read only = No
> vfs objects = acl_xattr
> acl_xattr:default acl style = windows
> acl_xattr:ignore system acls = yes
Why have you added those two last lines ?
>
> But failing to create profiles for users; after fiddling a bit, i was
> forced to have '/srv/samba/profiles' as 775 :unixadm (a group
member
> of 'Domain Aministrators') and profile folders get created
'777':
>
> root at vdmacpn1:~# ls -la /srv/samba/profiles/
> totale 16
> drwxrwxr-x 7 gaio unixadm 92 28 nov 15.49 .
> drwxrwxr-x 5 root root 54 2 nov 19.24 ..
> drwxrwxrwx 2 daniela segreteria 6 4 nov 10.57 daniela.V2
> drwxrwxrwx 16 daniela segreteria 281 25 nov 11.59 daniela.V6
> drwxrwxrwx 15 gaio domain users 272 28 nov 15.49 gaio.V2
> drwxrwxrwx 15 gaio sa 4096 28 nov 14.47 gaio.V2.good
> drwxrwxrwx 17 gaio sa 4096 4 nov 11.57 gaio.V6
>
> This seems a little strange and dangerous to me.
>
>
> What i'm missing?! Thanks.
Well, because you have added this line:
acl_xattr:ignore system acls = yes
It does exactly what it says, Samba ignores the Unix attrs, the 'ugo'
ones (rwx), so what have you set from Windows ?
You can read these on Linux with:
sudo samba-tool ntacl get /srv/samba/profiles --as-sddl
Rowland